last executing test programs: 13.29618907s ago: executing program 2 (id=625): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) eventfd(0x5) r0 = syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x800, 0x1, 0x3c3}, &(0x7f0000000dc0)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r0, 0x847ba, 0x0, 0xe, 0x0, 0x0) 12.767976172s ago: executing program 2 (id=628): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) sendmmsg$inet(r0, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000140)={0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000380)=ANY=[], 0xf0}}], 0x2, 0x200040c0) 12.476882045s ago: executing program 2 (id=630): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) r1 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_usb_disconnect(r1) writev(r0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000100)='\r\x00', 0x2}], 0x2) 10.576607253s ago: executing program 2 (id=646): syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f0000000540)='./file0\x00', 0x0, &(0x7f0000000580), 0x1, 0x4e8, &(0x7f00000005c0)="$eJzs3U9oVNsZAPDvTv5YY2LSUrHVFgItVrGdmESjQilmVRAtbS100T8Sk5iISSaYCagUahCLFCpddGFx1Y1ddBO6K9IiFB681Vu4eG8hCm/1njyfPHkuXOVxJ3d0jGPyYmLuY/z94DL3nEnmfHc+7p1zhnPPBPDW6o6IIxHRFBHFiOjM6gvZFpcWt/TvTvXPj6dbEgsLJx4lkUTE0f758eprJdnjluwFvpU+XInY2/xyuzMXLp4dmpgYPZeVe8qT0z0zFy7+6Mzk0Njo2OjUwMGDhw8dGDhweP2OdfP26ze//fdjd669M/fdbVuGJ9N427Pnao9jvXRHd/aetERH7RNJxKn1bixnX8s7AFbtk8LOW3nHAABsvELW92+u9P87oykWO+v37/72cWf8sS3v+AAAAIC1W1hoyh4BAACAxpUY+wMAAECDq84DONo/P17dNmruwYOfblRLvMrDwYjoWsx/9f7uxWean93T2/KG7u/9w9OI7uh48tFPvvH/dIs3dB82X03zH+YdAXlq3Z93BORpxy/yjoA8vXc17wi4NBcRt4/U6f8na+7ztS8pJ0vKxwfT/t9fZmrr9P/eHr88kXcE5OlnA3lHQJ5uPMo7Am4PRsS+et//FSrr91Vtjoi26tp+6+RQe/r5/+/7tXUvf/4XHqxjkyzxcDDixzVrO56qyX+mqykrdVS+KmxJTp+ZGN0XEVsjYne0bErLvcu00Ttw46/16r/zJM3/P5Pq93/plrZf/S4wi+NB86YX/29kqDy01uNm0cO5iB3N9fL/vP+fZLl+Xf8tXftzvfqBPZV1RXctn3/epIV/ROyqe/4/H60ly67P2lO5HPRULwp1/OuDz67Uq//+79P8n90j//lJz/+25fNfuf4/W693ZvVtXP7fzSf16p/eSvP/t0uvc/1vTX5VCbA1qzs/VC6f641oTY69XN+3+pgbVfX9qL5faf53f6/+53+1/5dk60J3RcTXX6PNuXvTd+rVXy+k+b/xO+d/ftL8j6xw/icvnP+r35l//4c/qNf2zqtp/rt+vfL5v78SzO6sRv9vZV82QXnHCQAAAAAAAMD6KFTu00kKxWf7hUKxuDjP95vRVpgozZT3ni7NTo0s3s/TFS2F6lSvzpr5oL3Z/JBquW9JuT+bO3K1c3OlXBwuTYzkffAAAADQ4Noj7v3m8n+2b3nF+D91tzPvKAEAAIC1SMf/HffaKst5fW6cDwAAAA0pHf8//tOn74bxPwAAADSs2vE/AAAA0Nh+fvx4ui1Uf/dvqjR25uz49OG+fcXJ2eHicOncdHGsVBqrrNg3ufLrTZRK0719MXu+pzw6U+6ZuXDx5GRpdqp8svK7sSdHWzbgmICVFbd+vC3vGAAAgI2zlt/1t2PHTqPu5H1lAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgLb4IAAD//wws/WY=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x1a1) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xd2f0, 0x2000, 0x5, 0x2}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 9.921181926s ago: executing program 2 (id=653): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r2 = dup(r1) ioctl$BLKRRPART(r2, 0x125f, 0x0) 9.176311688s ago: executing program 2 (id=657): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x8, 0x3, 0x348, 0x270, 0x1000000, 0xffffffff, 0x0, 0xffffffff, 0x308, 0xffffffff, 0xffffffff, 0x308, 0xffffffff, 0x3, 0x0, {[{{@ip={@loopback, @private=0xa010100, 0x0, 0xff000000, 'bond_slave_1\x00', 'geneve1\x00', {}, {0xff}, 0x84, 0x0, 0x28}, 0x0, 0x1b8, 0x218, 0x0, {0x0, 0x1c8}, [@common=@inet=@sctp={{0x148}, {[0x4e24, 0x4e21], [0x4e24, 0x4e21], [0x101, 0x81c, 0x4, 0x3041800, 0x10000, 0x8, 0x7f, 0x3, 0x8000, 0xe4, 0x5e9c90b, 0x4b, 0x5, 0x2, 0x5, 0x6, 0x0, 0xea, 0x8001, 0x4, 0x6937, 0x7598, 0x4, 0x5, 0x1, 0x9, 0x7, 0x81, 0x0, 0xba11, 0x4, 0x2, 0x3d, 0x10001, 0x3ff, 0xffffffff, 0xffff, 0x8000, 0x1000, 0x0, 0x28, 0x800, 0x6, 0xfffffffa, 0xd721, 0x80000000, 0x0, 0xfff, 0x0, 0x10001, 0x2, 0x3, 0x7575bec7, 0x8cdf, 0x3, 0x4, 0x1000, 0x24, 0xd8e, 0x4, 0x8, 0x4, 0xe1, 0x8a], 0x0, [{0x80, 0xb}, {0xac, 0xc, 0x5}, {0x10, 0x4f, 0x4}, {0x4, 0x80, 0x4}], 0x4, 0x4, 0x4}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}, 0x5, 0x0, [0x25, 0x5, 0x28, 0x23, 0x12, 0x34, 0x16, 0x3, 0x10, 0x39, 0x27, 0x2a, 0x6, 0xe, 0x36, 0x10], 0x27b02525726059f5, 0x7, 0x4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x8}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x64}}}}, 0x3a8) write(r1, &(0x7f0000000340), 0x11000) vmsplice(r0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="adba69b8faf1fafbc15e7fee388d121381cf70f5f5cea82140b46a3b8d7234cde6eb75f3b89d275bd9ed38ec804a94c3c637ed69c4c04b7ad6ea2908ac095e0f", 0x40}], 0x1, 0xf) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a013000040000701fcffffff00000100017c0000040042800c00018006000600801c00007c13028078131480731306800c00010000b424d7d58bc8453e"], 0x13a0}, 0x1, 0x0, 0x0, 0x20000044}, 0xc000) 8.783096573s ago: executing program 32 (id=657): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x8, 0x3, 0x348, 0x270, 0x1000000, 0xffffffff, 0x0, 0xffffffff, 0x308, 0xffffffff, 0xffffffff, 0x308, 0xffffffff, 0x3, 0x0, {[{{@ip={@loopback, @private=0xa010100, 0x0, 0xff000000, 'bond_slave_1\x00', 'geneve1\x00', {}, {0xff}, 0x84, 0x0, 0x28}, 0x0, 0x1b8, 0x218, 0x0, {0x0, 0x1c8}, [@common=@inet=@sctp={{0x148}, {[0x4e24, 0x4e21], [0x4e24, 0x4e21], [0x101, 0x81c, 0x4, 0x3041800, 0x10000, 0x8, 0x7f, 0x3, 0x8000, 0xe4, 0x5e9c90b, 0x4b, 0x5, 0x2, 0x5, 0x6, 0x0, 0xea, 0x8001, 0x4, 0x6937, 0x7598, 0x4, 0x5, 0x1, 0x9, 0x7, 0x81, 0x0, 0xba11, 0x4, 0x2, 0x3d, 0x10001, 0x3ff, 0xffffffff, 0xffff, 0x8000, 0x1000, 0x0, 0x28, 0x800, 0x6, 0xfffffffa, 0xd721, 0x80000000, 0x0, 0xfff, 0x0, 0x10001, 0x2, 0x3, 0x7575bec7, 0x8cdf, 0x3, 0x4, 0x1000, 0x24, 0xd8e, 0x4, 0x8, 0x4, 0xe1, 0x8a], 0x0, [{0x80, 0xb}, {0xac, 0xc, 0x5}, {0x10, 0x4f, 0x4}, {0x4, 0x80, 0x4}], 0x4, 0x4, 0x4}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}, 0x5, 0x0, [0x25, 0x5, 0x28, 0x23, 0x12, 0x34, 0x16, 0x3, 0x10, 0x39, 0x27, 0x2a, 0x6, 0xe, 0x36, 0x10], 0x27b02525726059f5, 0x7, 0x4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x8}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x64}}}}, 0x3a8) write(r1, &(0x7f0000000340), 0x11000) vmsplice(r0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="adba69b8faf1fafbc15e7fee388d121381cf70f5f5cea82140b46a3b8d7234cde6eb75f3b89d275bd9ed38ec804a94c3c637ed69c4c04b7ad6ea2908ac095e0f", 0x40}], 0x1, 0xf) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a013000040000701fcffffff00000100017c0000040042800c00018006000600801c00007c13028078131480731306800c00010000b424d7d58bc8453e"], 0x13a0}, 0x1, 0x0, 0x0, 0x20000044}, 0xc000) 4.663423295s ago: executing program 3 (id=680): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000f00)=ANY=[], 0x25, 0x55be, &(0x7f0000006a80)="$eJzs3EtvG2UXAOAzTtP71y9CLNh1pAopkWqrTi+CFQVacRGtKi4LVuDYruXW9kSx64auumCJWPBPEEisWPIbWMASdogFiB1SkWcm0KQNtI3jqM3zSOMzc/zOmXdGVpQzYzmAfWsh/eO3JE7EkYiYi4jjSeTrSblE3I24WIx9ISJORkTlviUp838nDkbE0Yg4MSle1EzKt744PT51/te3f//2+0MHjn35zQ97euLAnnoxIvqrxfrtfhGzThFvlPnGuJvH/rlxGVc31ehnRf52eyWvcLuxMa6Rx7OdYny2ems4idd7jeYkdrrX8/zqoDjgcNzZqDPZIb3RWMu3W+2VPHaHWR47d4rjrt8p/rbdGY6KOq2y3id5+RiNNmKRb6+3i/NZvZnH5mBU5ou6Wau9PonjMpaHi2bWa+XzWHnCi/wUeKc7uLWejttrw242SM/X6i/V6heq9bWs1R61z1Ub/daFc+lipzcZVh21G/2LnSzr9Nq1ZtZfShc7zWa1Xk8XL7VXuo1BWq/XztbOVM8vlWun0zeufpD2WuniJL7WHdwadXvD9Hq2lhZ7LKXLtbMvL6Wn6ul7V66l1969fPnKtfc/uvTh1VevvPV6OeiBaaWLy2eWl6v1M9Xl+tI+Ov9Py0k/xvknD0//9OPOLhtE/m/rNh8wALb3QP8fW/v/0P8DU7eT/r9/s9zenf4/HqX/j2n2/5OWSv//3/1v5bH63xNT6X/nQ/+/i+cfd3e4P/vbk/X/B6c+DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZu7n+a/ezFcWiu1jZf5/Zeq5cjuJiEpE3HuIuTi4qeZcWWd+m/HzW+bwXRJ5hckxDpXL0Yi4WC5//n+3rwIAAAA8u76+e/LzolsvXhb2ekLMUnHTpnL84ynVSyJifuGXKVWrTF6en1Kx/PN9INanVC2/gXV4SsWKW24HplXtkcxtCofvC0kRKjOdDgAAMBObO4HZdiEAAADM0mf/+u4rM5sHM5bExqPMjWfB+Tfv/3kgeGTycm/Ll/sBAACAp0my1xMAAAAAdl3e//v9PwAAAHi2Fb//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8xc795CoNxHEA/7W8PvBfJMa9V3EHx/AILl0KB/ASHAGv4AU4AyYuPIIBQ2ckqUJiYErzyOeTtH0zffl2Btj8pskAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJ++N+v518/vvlybs9sndewvUmY2AAAAwCnbZj1v/5im9ovc/yp3vcntKiLqiJPV/SgeO5mjnNOc+f/mrzF8i2gTDv3jfDyPiPf5+PW6708BAAAA7tdmuZqlaj2d8hLAj2FHxY2kRZv65YdCeVVENNOfhdLqw+ltobD29/0QnwqltQtYk0Jhacnt4fS9x1IP6Rp1Ln9msmi/xLZV9/NcAABgSN1K4EwVAgAAwB34OPQAuIV/S/vqeDq+ZxynS34h+KzTAgAAAJ6gaugBAAAAAL1r6/9+9v+bXLT/X2X/PwAAACgu7f8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAn7bNer5Zrmbn7i/+M2e3v065GQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBv9ucdBUIgDMJg7/rOZO5/WGnQ0NikCoSPvzEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB487u//J+YGmeSudfG0vNIsnZqbJ0ae+fG0R/G168BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYn5cUCIEgiII5438nff/DSoKeQYQIaHhUUYsGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL7od7/8n5gaZ5K508bS8UiydtXYumrsPWgcPRhv/wYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYt5/XOKo4AODf3clummoxRgkYlSo96MWm29raq4gSPPgnCCHd1OjWapKDLcGaizfJuRfRiyAiKPGW/6HnBgpSbz3kEMGTh8jMzqSzydrEtM6m6ecDb993307fr11Cv/tmAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKGy8HS/V8zhJH0a7cdF2e3NpJq3Xd9SptZU7E2lJ49pw0Xri1epmf6i9XH5ycnxwEwEAAOCoOLHnFUmR30fE3cbqVFrXR7P8v1Fck+b83+Vd1fK2nXn/+ubSsfyliSL//+3Xe89vDzSaZOOknc7Oddpndk9l6MDLfMw9s+cVQ9nOZ9+9JNkbUn9/+bmNRraftW9u3Xq3mYXDVcwWADiI00WdB8X/h9K6NciJAfDEGCol3kX+n4wOdk4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVdhYjqeKuBYRE0P349T65tJMv/qrlTsTa3m5cPPmSrnPtItGRMzOddpnKlzL4VXs5vVPpjud9vzCtaqDkxHR56Ub+/vnST79f72mGRE9Lade6NPPh/sYa0c/u4L84xkVbd387xHt+YWRdH17Xlzraant2vB3troG8QGoKqjn789Ddzgc2c6XXxqp7n3vGxSfvUff83/5WzL8aP4kAQBwpDXykmaidxurU2lbbSxi6/ve/P+1Uhw9ef/WjW5L9/laKf+/99GF2+Wxyvl/q6L1PQ4mF698Nrlw7fobc1emL7cvtz9982zrrda5i+fPX5zMviuZnI26b0wAAAB4CM28lPP/kT7n/8dLcTzg/L97JNzN/z//tvVleaxE/t/X/UO/Qc8EAADgSdTcjp595a8/a32uqDWb8cX04uJ8q/u4/fxs97HS6R7QcF7K+X8yNuhZAQAAAFXYWK71nP9fKsXxgPP/8v3/T//44s/lPpPuvQVXI6J9euZq51J1yznUen/0+0Pyf/xQORuoOeiVAgAAMCgjeSmf/zfG0vy/vn3LQz0iXj8V8Xf+G/7YZ/6fvPf1T+Wxyvf/n6t0lYdPfby7H1k9HjE0PugZAQAAcJQdy0ua7P/RWJ36+JfjHzTd/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQtX8CAAD///FaKZc=") mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', 0x0, 0x8, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x200) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40140, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x101042, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x4) 4.423718857s ago: executing program 0 (id=683): mlockall(0x7) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) 3.357669189s ago: executing program 0 (id=685): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000440)={0x90000000}) accept4(r0, 0x0, 0x0, 0x0) 2.902154909s ago: executing program 1 (id=686): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x21007, 0x6eb6, 0x0, 0x10040, 0x1}) write$FUSE_INIT(r0, &(0x7f00000002c0)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x5090880b, 0x0, 0x10, 0xd, 0x40, 0x0, 0x0, 0x2f, 0x1}}, 0x50) 2.493449135s ago: executing program 3 (id=689): syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0x88a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.338030642s ago: executing program 4 (id=690): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) io_setup(0x20fe, &(0x7f00000001c0)=0x0) io_submit(r2, 0x1, &(0x7f0000002680)=[&(0x7f0000000240)={0x0, 0x0, 0x2, 0x0, 0x0, r1, 0x0, 0x0, 0x600}]) 2.116673478s ago: executing program 0 (id=691): r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0xea253008ce96afe, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./bus\x00', 0x200000, &(0x7f0000001140)={[{@shortname_winnt}, {@shortname_lower}, {@fat=@codepage={'codepage', 0x3d, '855'}}, {@shortname_lower}, {@shortname_lower}, {@fat=@fmask={'fmask', 0x3d, 0x3}}, {@rodir}, {@fat=@discard}, {@uni_xlate}, {@rodir}]}, 0x5, 0x21a, &(0x7f0000000180)="$eJzs3bFqU1EYB/AvbaqlIOkgFEXwiotTaCruEVEQCgqSwc1iU5QkFgwE2qHVyZfQV9DRVXAQV19ABKmCi906CJF6Y2NL2kRqcov9/ZZ8JOd/z3cuIYcMObl3rlFbXG4ubW5uxORkLvLlKMdWLqZjLMYj9SQAgP/JVrsd39uprHsBAEbD/g8Ax8+A+//tEbYEAAzZwN//x0bWEgAwZHfutnNplUxGNJ61Kq1K+pg+e3UpHkY9qjEbhfgR0d6R1jduzl+fTbZ9mY5KY72TX29VxnfnS1GI6d75UpLanZ+IqU7+41RUYy4Kcbp3fq5n/kRcuvjH/MUoxIf7sRz1WIztbDe/VkqSa7fm9+RP/hoHAAAAAAAAAAAAAAAAAAAAAADDUEx29Dy/p1jc7/U0n56vk4/+5wPtPZ8nH2fz2a4dAAAAAAAAAAAAAAAAAAAAjormymptoV6vPj6oePT+5dt+YwYscp15D3udwxenLnx+vv+Yp39zf/5t8eZ8lrdlwOLdxoMzl5szV45KPyurtYmD3lrfChFDmv1Vpmv/veq+g2delBder336OuiVM/gwAgAAAAAAAAAAAAAAAACAY677o9+sOwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA7HT//394RdZrBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAnwEAAP//Rp2fMw==") write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc0000000000000fadbfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e65f6f6619e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c204000000880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c61a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bd0700000000000000319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807f9b33e7175ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4feb54578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000103300", 0x1000}}, 0x1006) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a40)='memory.swap.current\x00', 0x275a, 0x0) 1.971310631s ago: executing program 1 (id=692): r0 = open(&(0x7f0000000340)='./bus\x00', 0x14927e, 0x102) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) munmap(&(0x7f0000001000/0x1000)=nil, 0x1000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x0, 0x0, 0x21, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r0, 0x0) 1.80911555s ago: executing program 0 (id=693): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) migrate_pages(0x0, 0x4, &(0x7f0000000000)=0x200000007f, &(0x7f0000000040)=0xa) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x5) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 1.69661327s ago: executing program 4 (id=694): timer_create(0x0, &(0x7f0000000180)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sysinfo(&(0x7f0000000000)=""/177) 1.622209547s ago: executing program 3 (id=695): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) 1.435613s ago: executing program 4 (id=696): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) getxattr(0x0, 0x0, 0x0, 0x0) 1.320108606s ago: executing program 3 (id=697): syz_mount_image$hfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x10012, &(0x7f00000004c0)=ANY=[@ANYBLOB='codepage=cp775,umask=00000000007777,iocharset=koi8-ru,\x00'/64, @ANYBLOB="7b467be6d2ffd5dbc39d475a3efbcc1a8227f7877fce1eaf2d016780277d325666f07a12652e81e75be5e881b521fcda9e61566e2b548201f553091a16ad9bb6888f170e5d63f7a84c585f22f2397bf6c9fe0ad346d27e428fa6322e2a05eddacbf8af7162ea449789312db3927438", @ANYRES8], 0x4, 0x339, &(0x7f0000000140)="$eJzs3U9P1EwcB/DvtLtL94EHK2BIPBmUxBMBPGi8QAzxNXgwRIQlIayYKCZKTETPxngzMfHIzbPRt6AX4xvQEwfjSS/EgzUzne5Ol5m2C7iF7PeTuHbb+fObttPO7GYpiKhvXVv4unNpV/4TVQA+gKuAByAAKgDOYDx4sLGZW5DfWhKIc4p9aZY3GrasAXQOLZTvKhgy19G/EUVR9C031c+exELlEWYPNnjAgO6danvQ88gObc62cjtuV38xjrDYwx4eYrjMcIiIqHz6/u/pu8SQHr97HjCpx+En9f6fSI1v9sqL41ho3f+9+H0k5P45pTbJ+d7aZrOxEk/h5NH3klmirSzrORG1d3cN8ZnlDxpDLqMWOxWLV19dazamtlUBzzCnGcnG1OsKkoYormhrwAyACcvcNENW27MNqjZUZRtmHfGPZtVonQB/+I5X9uoWPxWISXwUn8WiCPEaK63xXyUScueoIxV2dJU4/ml3iaqVYZwq1cp2+KdVJWd1DXj/tt3Kumu/BvBlLDayFNE5fg+TOF/W3LkwgvTHCnHrZtytU7lGgYpQswYz12wr0W9rrrHOuuqr1WZjavlu03XSHy3rjE68EDfEBH7gHRaM8b8nU0/C3TNTvVyolPrMyGxPRaV0HMcU1YHvdNUzSbmeuvgV8xy3cQXD9x9trS81m4175S8kXeWA2c8dcTzxiahPR7lG/m+kQSAXqgCc5VTdm6wLf6Iosm6qoBeHoKqaevlNu8lb60tCX/MOV4W8cnZsmncnBjAPQK9JrggHqf1JK9dAu8BC2X/Jo63W2E/IJKoedJCkqtQmHwOFekp935qdnFyP/z/YVYhOoPbRx/jNsoOhMsixg4jnf8Z8ZVpddeRLmDH/ifIKN0qcccyARtTrf8VmcK1inePEwWQhZ851/iJwoaNGD0mNTzuLDXWcOI7fSnb/VYZYwBfc4uf/REREREREREREREREREREREREREQnTbe/Rtj/c4L8hXSNu334hzeIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiA7HeP4v4KsnxtRsz//NelKT4sdPiAmO4vm/foHn/4rtLlpJRDZ/AwAA//9eD1xQ") syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000000)='./file2\x00', 0x99cf9, 0x0, 0x1, 0x0, &(0x7f0000000000)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x181) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) 1.319881757s ago: executing program 1 (id=698): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000080)={{&(0x7f0000f68000/0x3000)=nil, 0x3000}}) 1.26207513s ago: executing program 4 (id=699): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="18000000240001"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) recvmmsg(r0, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4077, 0xfed}], 0x1}, 0x9}], 0x1, 0x2000, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="1801"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.053465601s ago: executing program 3 (id=700): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000071284d000000000006000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x9, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x2000300, 0xe, 0x0, &(0x7f0000000600)="63e4ed8e46080000003389f7f986", 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 923.86566ms ago: executing program 1 (id=701): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000240)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@ack={0x1e, 0x4, 0x1f}]}}}}}}}}, 0x0) 827.221026ms ago: executing program 4 (id=702): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e21, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) r2 = fcntl$dupfd(r1, 0x0, r0) sendmmsg$unix(r2, &(0x7f0000007400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rights={{0x10}}, @cred={{0x1c}}], 0x30, 0x20000000}}], 0x1, 0x2004a880) 720.198642ms ago: executing program 1 (id=703): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x34, r2, 0x60b, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}]}, 0x34}}, 0x0) 491.667097ms ago: executing program 1 (id=704): r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001400090527bd7000fddbdf25021f00cb", @ANYRES32=r2, @ANYBLOB="0800040064010104080008000001000008000200e00000020800090006000000080001df7f000001080009"], 0x48}, 0x1, 0x0, 0x0, 0x4040011}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000"], 0x18}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 284.760006ms ago: executing program 0 (id=705): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="06000000040000000800000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 67.069705ms ago: executing program 0 (id=706): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x2}) setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00', 0x6) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20c}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa07, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) 341.969µs ago: executing program 4 (id=707): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b", 0x5a}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000700)=""/101, 0x65}], 0x2}, 0x20) 0s ago: executing program 3 (id=708): pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x1) syz_clone3(&(0x7f0000000300)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f00000001c0)='v', 0x1}], 0x1, 0x0) kernel console output (not intermixed with test programs): 107.295596][ T5820] ? do_raw_spin_lock+0x12b/0x2f0 [ 107.295623][ T5820] ? do_raw_spin_unlock+0xf5/0x210 [ 107.295639][ T5820] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 107.295658][ T5820] do_writepages+0x32e/0x550 [ 107.295691][ T5820] ? do_raw_spin_unlock+0xf5/0x210 [ 107.295715][ T5820] filemap_fdatawrite+0x1e9/0x2f0 [ 107.295743][ T5820] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 107.295805][ T5820] ? do_raw_spin_unlock+0xf5/0x210 [ 107.295827][ T5820] f2fs_sync_dirty_inodes+0x30e/0x860 [ 107.295857][ T5820] f2fs_write_checkpoint+0x9df/0x26a0 [ 107.295903][ T5820] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 107.295967][ T5820] kill_f2fs_super+0x314/0x720 [ 107.295988][ T5820] ? __pfx_kill_f2fs_super+0x10/0x10 [ 107.296016][ T5820] ? lockdep_hardirqs_on+0x7a/0x110 [ 107.296053][ T5820] deactivate_locked_super+0xbc/0x130 [ 107.296080][ T5820] cleanup_mnt+0x437/0x4d0 [ 107.296098][ T5820] ? _raw_spin_unlock_irq+0x23/0x50 [ 107.296123][ T5820] task_work_run+0x1d9/0x270 [ 107.296147][ T5820] ? __pfx_task_work_run+0x10/0x10 [ 107.296176][ T5820] exit_to_user_mode_loop+0xed/0x480 [ 107.296195][ T5820] ? rcu_is_watching+0x15/0xb0 [ 107.296220][ T5820] do_syscall_64+0x32d/0xf80 [ 107.296235][ T5820] ? trace_irq_disable+0x3b/0x150 [ 107.296247][ T5820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.296261][ T5820] ? clear_bhb_loop+0x40/0x90 [ 107.296280][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.296294][ T5820] RIP: 0033:0x7f069619d9d7 [ 107.296329][ T5820] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 107.296341][ T5820] RSP: 002b:00007ffef7716af8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 107.296359][ T5820] RAX: 0000000000000000 RBX: 00007f0696231f90 RCX: 00007f069619d9d7 [ 107.296369][ T5820] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef7716bb0 [ 107.296380][ T5820] RBP: 00007ffef7716bb0 R08: 00007ffef7717bb0 R09: 00000000ffffffff [ 107.296392][ T5820] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef7717c40 [ 107.296402][ T5820] R13: 00007f0696231f90 R14: 000000000001a27b R15: 00007ffef7717c80 [ 107.296431][ T5820] [ 107.296438][ T5820] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 107.407470][ T6358] F2FS-fs (loop0): invalid crc value [ 107.544152][ T6372] loop2: detected capacity change from 0 to 32768 [ 107.771346][ T6372] ocfs2: Slot 0 on device (7,2) was already allocated to this node! [ 107.817160][ T6372] JBD2: Ignoring recovery information on journal [ 107.832672][ T6389] loop4: detected capacity change from 0 to 4096 [ 107.907347][ T6358] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 107.937651][ T6358] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 107.966947][ T6372] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 108.098357][ T29] audit: type=1804 audit(1772463316.577:5): pid=6358 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.141" name="/newroot/24/file0/file1" dev="loop0" ino=10 res=1 errno=0 [ 108.148806][ T6372] ocfs2: Unmounting device (7,2) on (node local) [ 108.162798][ T5818] syz-executor: attempt to access beyond end of device [ 108.162798][ T5818] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 108.212601][ T5818] CPU: 0 UID: 0 PID: 5818 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 108.212622][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 108.212629][ T5818] Call Trace: [ 108.212635][ T5818] [ 108.212641][ T5818] dump_stack_lvl+0xe8/0x150 [ 108.212665][ T5818] f2fs_handle_critical_error+0x37c/0x540 [ 108.212692][ T5818] f2fs_write_end_io+0xcdb/0xff0 [ 108.212724][ T5818] __submit_merged_bio+0x256/0x700 [ 108.212749][ T5818] __submit_merged_write_cond+0x3c9/0x4e0 [ 108.212775][ T5818] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 108.212814][ T5818] f2fs_write_data_pages+0x2975/0x35e0 [ 108.212860][ T5818] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 108.212888][ T5818] ? css_rstat_updated+0x23a/0x530 [ 108.212924][ T5818] ? rcu_is_watching+0x15/0xb0 [ 108.212943][ T5818] ? mod_memcg_lruvec_state+0x1b8/0x360 [ 108.212966][ T5818] ? __lock_acquire+0x6b5/0x2cf0 [ 108.212996][ T5818] ? __lock_acquire+0x6b5/0x2cf0 [ 108.213016][ T5818] ? do_raw_spin_lock+0x12b/0x2f0 [ 108.213040][ T5818] ? do_raw_spin_unlock+0xf5/0x210 [ 108.213056][ T5818] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 108.213073][ T5818] do_writepages+0x32e/0x550 [ 108.213102][ T5818] ? do_raw_spin_unlock+0xf5/0x210 [ 108.213120][ T5818] filemap_fdatawrite+0x1e9/0x2f0 [ 108.213143][ T5818] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 108.213203][ T5818] ? do_raw_spin_unlock+0xf5/0x210 [ 108.213231][ T5818] f2fs_sync_dirty_inodes+0x30e/0x860 [ 108.213261][ T5818] f2fs_write_checkpoint+0x9df/0x26a0 [ 108.213307][ T5818] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 108.213372][ T5818] kill_f2fs_super+0x314/0x720 [ 108.213397][ T5818] ? __pfx_kill_f2fs_super+0x10/0x10 [ 108.213431][ T5818] ? lockdep_hardirqs_on+0x7a/0x110 [ 108.213460][ T5818] deactivate_locked_super+0xbc/0x130 [ 108.213487][ T5818] cleanup_mnt+0x437/0x4d0 [ 108.213506][ T5818] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.213530][ T5818] task_work_run+0x1d9/0x270 [ 108.213553][ T5818] ? __pfx_task_work_run+0x10/0x10 [ 108.213580][ T5818] exit_to_user_mode_loop+0xed/0x480 [ 108.213598][ T5818] ? rcu_is_watching+0x15/0xb0 [ 108.213626][ T5818] do_syscall_64+0x32d/0xf80 [ 108.213644][ T5818] ? trace_irq_disable+0x3b/0x150 [ 108.213659][ T5818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.213677][ T5818] ? clear_bhb_loop+0x40/0x90 [ 108.213699][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.213716][ T5818] RIP: 0033:0x7f85bb39d9d7 [ 108.213734][ T5818] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 108.213747][ T5818] RSP: 002b:00007fffb0a1ff48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 108.213765][ T5818] RAX: 0000000000000000 RBX: 00007f85bb431f90 RCX: 00007f85bb39d9d7 [ 108.213776][ T5818] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb0a20000 [ 108.213786][ T5818] RBP: 00007fffb0a20000 R08: 00007fffb0a21000 R09: 00000000ffffffff [ 108.213797][ T5818] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffb0a21090 [ 108.213808][ T5818] R13: 00007f85bb431f90 R14: 000000000001a63c R15: 00007fffb0a210d0 [ 108.213838][ T5818] [ 108.618239][ T5818] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 108.670537][ T29] audit: type=1326 audit(1772463317.147:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6393 comm="syz.1.149" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f069619c799 code=0x0 [ 109.063527][ T5913] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 109.229086][ T5913] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 109.232837][ T6410] loop0: detected capacity change from 0 to 128 [ 109.239890][ T5913] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 109.282386][ T5913] usb 3-1: Product: syz [ 109.312769][ T5913] usb 3-1: Manufacturer: syz [ 109.324851][ T5913] usb 3-1: SerialNumber: syz [ 109.336215][ T6406] loop3: detected capacity change from 0 to 8192 [ 109.347993][ T5913] usb 3-1: config 0 descriptor?? [ 109.362215][ T5913] ch341 3-1:0.0: ch341-uart converter detected [ 109.756770][ T6418] loop3: detected capacity change from 0 to 4096 [ 109.829466][ T6418] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 109.874702][ T24] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 109.885077][ T6418] ntfs3(loop3): Failed to load $Extend (-22). [ 109.904419][ T6418] ntfs3(loop3): Failed to initialize $Extend. [ 110.045436][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 110.074658][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.097004][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.133590][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 110.165775][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.198955][ T24] usb 2-1: config 0 descriptor?? [ 110.216963][ T24] hub 2-1:0.0: USB hub found [ 110.253850][ T6414] loop0: detected capacity change from 0 to 40427 [ 110.281373][ T6414] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 110.292291][ T6414] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 110.315476][ T6414] F2FS-fs (loop0): invalid crc value [ 110.380374][ T5913] ch341-uart ttyUSB0: failed to read break control: -71 [ 110.392142][ T5913] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 110.442011][ T5913] usb 3-1: USB disconnect, device number 3 [ 110.453727][ T24] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 110.453772][ T6424] loop3: detected capacity change from 0 to 4096 [ 110.498131][ T5913] ch341 3-1:0.0: device disconnected [ 110.542590][ T6424] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 110.562125][ T6422] loop4: detected capacity change from 0 to 40427 [ 110.573785][ T6422] F2FS-fs (loop4): Invalid Fs Meta Ino: node(0) meta(2) root(0) [ 110.584233][ T6422] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 110.614284][ T6414] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 110.637418][ T6422] F2FS-fs (loop4): invalid crc value [ 110.655596][ T6414] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 110.676386][ T6414] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 110.699916][ T5828] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 110.835878][ T6414] syz.0.160: attempt to access beyond end of device [ 110.835878][ T6414] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 110.845081][ T6422] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 110.875615][ T24] hid-generic 0003:046D:C31C.0002: unknown main item tag 0x0 [ 110.889367][ T6422] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 110.905765][ T6422] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 110.943907][ T24] hid-generic 0003:046D:C31C.0002: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 111.030059][ T6431] f2fs_ckpt-7:4: attempt to access beyond end of device [ 111.030059][ T6431] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 111.099242][ T6431] CPU: 0 UID: 0 PID: 6431 Comm: f2fs_ckpt-7:4 Not tainted syzkaller #0 PREEMPT(full) [ 111.099268][ T6431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 111.099278][ T6431] Call Trace: [ 111.099285][ T6431] [ 111.099292][ T6431] dump_stack_lvl+0xe8/0x150 [ 111.099322][ T6431] f2fs_handle_critical_error+0x37c/0x540 [ 111.099354][ T6431] f2fs_write_end_io+0xcdb/0xff0 [ 111.099390][ T6431] __submit_merged_bio+0x256/0x700 [ 111.099422][ T6431] __submit_merged_write_cond+0x3c9/0x4e0 [ 111.099456][ T6431] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 111.099503][ T6431] f2fs_write_data_pages+0x2975/0x35e0 [ 111.099521][ T6431] ? unwind_next_frame+0xa5/0x23c0 [ 111.099577][ T6431] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 111.099609][ T6431] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.099650][ T6431] ? check_noncircular+0xda/0x150 [ 111.099682][ T6431] ? lockdep_unlock+0x5d/0xd0 [ 111.099699][ T6431] ? __lock_acquire+0x146e/0x2cf0 [ 111.099743][ T6431] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.099770][ T6431] ? do_raw_spin_unlock+0xf5/0x210 [ 111.099788][ T6431] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 111.099808][ T6431] do_writepages+0x32e/0x550 [ 111.099844][ T6431] ? do_raw_spin_unlock+0xf5/0x210 [ 111.099867][ T6431] filemap_fdatawrite+0x1e9/0x2f0 [ 111.099895][ T6431] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 111.099964][ T6431] ? do_raw_spin_unlock+0xf5/0x210 [ 111.099986][ T6431] f2fs_sync_dirty_inodes+0x30e/0x860 [ 111.100016][ T6431] f2fs_write_checkpoint+0x9df/0x26a0 [ 111.100067][ T6431] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 111.100122][ T6431] ? down_write+0x16d/0x200 [ 111.100141][ T6431] ? __pfx_down_write+0x10/0x10 [ 111.100156][ T6431] ? uplift_priority+0xdb/0x730 [ 111.100169][ T6431] ? trace_sched_exit_tp+0x3a/0x150 [ 111.100192][ T6431] __write_checkpoint_sync+0x124/0x2b0 [ 111.100210][ T6431] ? __lock_acquire+0x6b5/0x2cf0 [ 111.100234][ T6431] ? __pfx___write_checkpoint_sync+0x10/0x10 [ 111.100269][ T6431] ? __pfx___schedule+0x10/0x10 [ 111.100297][ T6431] __checkpoint_and_complete_reqs+0x53/0x2d0 [ 111.100321][ T6431] issue_checkpoint_thread+0xd6/0x280 [ 111.100339][ T6431] ? __pfx_issue_checkpoint_thread+0x10/0x10 [ 111.100355][ T6431] ? __pfx_autoremove_wake_function+0x10/0x10 [ 111.100372][ T6431] ? __kthread_parkme+0x7a/0x1f0 [ 111.100401][ T6431] kthread+0x388/0x470 [ 111.100417][ T6431] ? __pfx_issue_checkpoint_thread+0x10/0x10 [ 111.100432][ T6431] ? __pfx_kthread+0x10/0x10 [ 111.100448][ T6431] ret_from_fork+0x51e/0xb90 [ 111.100470][ T6431] ? __pfx_ret_from_fork+0x10/0x10 [ 111.100489][ T6431] ? __switch_to+0xc7d/0x1450 [ 111.100509][ T6431] ? __pfx_kthread+0x10/0x10 [ 111.100523][ T6431] ret_from_fork_asm+0x1a/0x30 [ 111.100548][ T6431] [ 111.100554][ T6431] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 111.128933][ T5818] syz-executor: attempt to access beyond end of device [ 111.128933][ T5818] loop0: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 111.385948][ T5892] usb 2-1: USB disconnect, device number 3 [ 111.389210][ T5818] CPU: 1 UID: 0 PID: 5818 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 111.389236][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 111.389245][ T5818] Call Trace: [ 111.389253][ T5818] [ 111.389260][ T5818] dump_stack_lvl+0xe8/0x150 [ 111.389291][ T5818] f2fs_handle_critical_error+0x37c/0x540 [ 111.389325][ T5818] f2fs_write_end_io+0xcdb/0xff0 [ 111.389365][ T5818] __submit_merged_bio+0x256/0x700 [ 111.389397][ T5818] f2fs_submit_merged_write+0x284/0x390 [ 111.389429][ T5818] ? __pfx_f2fs_submit_merged_write+0x10/0x10 [ 111.389470][ T5818] f2fs_sync_node_pages+0x14bf/0x1680 [ 111.389516][ T5818] ? __pfx_f2fs_sync_node_pages+0x10/0x10 [ 111.389588][ T5818] f2fs_write_checkpoint+0xeb8/0x26a0 [ 111.389645][ T5818] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 111.389723][ T5818] kill_f2fs_super+0x314/0x720 [ 111.389749][ T5818] ? __pfx_kill_f2fs_super+0x10/0x10 [ 111.389783][ T5818] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.389810][ T5818] deactivate_locked_super+0xbc/0x130 [ 111.389838][ T5818] cleanup_mnt+0x437/0x4d0 [ 111.389857][ T5818] ? _raw_spin_unlock_irq+0x23/0x50 [ 111.389885][ T5818] task_work_run+0x1d9/0x270 [ 111.389918][ T5818] ? __pfx_task_work_run+0x10/0x10 [ 111.389949][ T5818] exit_to_user_mode_loop+0xed/0x480 [ 111.389968][ T5818] ? rcu_is_watching+0x15/0xb0 [ 111.389996][ T5818] do_syscall_64+0x32d/0xf80 [ 111.390013][ T5818] ? trace_irq_disable+0x3b/0x150 [ 111.390027][ T5818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.390044][ T5818] ? clear_bhb_loop+0x40/0x90 [ 111.390066][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.390083][ T5818] RIP: 0033:0x7f85bb39d9d7 [ 111.390100][ T5818] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 111.390113][ T5818] RSP: 002b:00007fffb0a1ff48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 111.390130][ T5818] RAX: 0000000000000000 RBX: 00007f85bb431f90 RCX: 00007f85bb39d9d7 [ 111.390142][ T5818] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb0a20000 [ 111.390151][ T5818] RBP: 00007fffb0a20000 R08: 00007fffb0a21000 R09: 00000000ffffffff [ 111.390162][ T5818] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffb0a21090 [ 111.390172][ T5818] R13: 00007f85bb431f90 R14: 000000000001b166 R15: 00007fffb0a210d0 [ 111.390203][ T5818] [ 111.390210][ T5818] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 111.918342][ T6446] loop3: detected capacity change from 0 to 32768 [ 112.024159][ T6446] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 112.083209][ T6446] XFS (loop3): Ending clean mount [ 112.120967][ T6446] XFS (loop3): Quotacheck needed: Please wait. [ 112.207534][ T6446] XFS (loop3): Quotacheck: Done. [ 112.410316][ T5828] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 112.432238][ T5830] IPVS: starting estimator thread 0... [ 112.483971][ T5892] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 112.553130][ T6464] IPVS: using max 41 ests per chain, 98400 per kthread [ 112.566352][ T6467] loop2: detected capacity change from 0 to 128 [ 112.592317][ T6467] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 112.682250][ T5892] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 112.753513][ T5892] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 112.800710][ T5892] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 112.818094][ T58] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 112.827757][ T5892] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 112.860416][ T5892] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.913579][ T5892] usb 5-1: Product: syz [ 112.918630][ T5892] usb 5-1: Manufacturer: syz [ 112.950224][ T5892] usb 5-1: SerialNumber: syz [ 112.977641][ T5892] usb 5-1: config 0 descriptor?? [ 112.995242][ T6458] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 113.190135][ T6484] loop0: detected capacity change from 0 to 512 [ 113.215380][ T6484] EXT4-fs: Ignoring removed bh option [ 113.239693][ T6458] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 113.275599][ T6484] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 113.356632][ T6484] EXT4-fs (loop0): 1 truncate cleaned up [ 113.390653][ T6484] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.438444][ T6478] loop1: detected capacity change from 0 to 32768 [ 113.459089][ T6478] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.181 (6478) [ 113.479880][ T6489] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 113.568249][ T5892] usb 5-1: USB disconnect, device number 3 [ 113.574272][ T6478] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 113.619534][ T6478] BTRFS info (device loop1): using sha256 checksum algorithm [ 113.640633][ T5818] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.757630][ T6478] BTRFS info (device loop1): rebuilding free space tree [ 113.817359][ T6478] BTRFS info (device loop1): disabling free space tree [ 113.842580][ T6478] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 113.882609][ T6478] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 113.949999][ T6478] BTRFS info (device loop1): setting nodatasum [ 113.960699][ T6478] BTRFS info (device loop1): setting nodatacow [ 113.974205][ T6478] BTRFS info (device loop1): force clearing of disk cache [ 114.173286][ T6512] netlink: 4 bytes leftover after parsing attributes in process `syz.3.188'. [ 114.271580][ T5830] IPVS: starting estimator thread 0... [ 114.313297][ T5820] BTRFS info (device loop1): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 114.349489][ T6512] hsr_slave_1 (unregistering): left promiscuous mode [ 114.383999][ T6518] IPVS: using max 40 ests per chain, 96000 per kthread [ 114.469180][ T6522] loop0: detected capacity change from 0 to 256 [ 114.505687][ T6522] exfat: Deprecated parameter 'namecase' [ 114.515829][ T6520] input: syz0 as /devices/virtual/input/input8 [ 114.522866][ T6520] input: failed to attach handler leds to device input8, error: -6 [ 114.592673][ T6522] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d) [ 115.340904][ T6527] loop3: detected capacity change from 0 to 32768 [ 115.870448][ T5830] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 115.929753][ T29] audit: type=1326 audit(1772463324.407:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 115.962684][ T29] audit: type=1326 audit(1772463324.407:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.023826][ T5830] usb 3-1: Using ep0 maxpacket: 8 [ 116.035893][ T29] audit: type=1326 audit(1772463324.437:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.069119][ T5830] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 116.087191][ T5830] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 116.115897][ T5830] usb 3-1: config 0 has no interface number 0 [ 116.128251][ T29] audit: type=1326 audit(1772463324.437:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.137034][ T5830] usb 3-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 116.209187][ T5830] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 116.210127][ T29] audit: type=1326 audit(1772463324.437:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.234024][ T5830] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 116.277376][ T6537] loop4: detected capacity change from 0 to 32768 [ 116.292709][ T29] audit: type=1326 audit(1772463324.437:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f85bb35cfce code=0x7ffc0000 [ 116.307510][ T5830] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 116.325520][ T29] audit: type=1326 audit(1772463324.437:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.329755][ T6537] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.198 (6537) [ 116.403778][ T5830] usb 3-1: New USB device strings: Mfr=31, Product=1, SerialNumber=0 [ 116.438046][ T5830] usb 3-1: Product: syz [ 116.441152][ T29] audit: type=1326 audit(1772463324.437:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.454000][ T5830] usb 3-1: Manufacturer: syz [ 116.491832][ T6537] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 116.513526][ T6537] BTRFS info (device loop4): using crc32c checksum algorithm [ 116.521493][ T6537] BTRFS warning (device loop4): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 116.553559][ T29] audit: type=1326 audit(1772463324.437:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.581684][ T5830] usb 3-1: config 0 descriptor?? [ 116.633957][ T29] audit: type=1326 audit(1772463324.437:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6552 comm="syz.0.204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85bb39c799 code=0x7ffc0000 [ 116.794745][ T6580] loop3: detected capacity change from 0 to 512 [ 116.855886][ T6537] BTRFS info (device loop4): rebuilding free space tree [ 116.889756][ T6537] BTRFS info (device loop4): disabling free space tree [ 116.893903][ T6580] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 116.913630][ T6537] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 116.943999][ T6537] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 116.971927][ T6537] BTRFS info (device loop4): enabling ssd optimizations [ 116.993577][ T6537] BTRFS info (device loop4): enabling disk space caching [ 117.013179][ T6580] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 117.052090][ T6537] BTRFS info (device loop4): force clearing of disk cache [ 117.072302][ T6537] BTRFS info (device loop4): force zstd compression, level 3 [ 117.100757][ T6580] ext4 filesystem being mounted at /39/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 117.148259][ T6555] loop1: detected capacity change from 0 to 32768 [ 117.256107][ T6555] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 117.270396][ T5830] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.21/input/input9 [ 117.336336][ T5830] input: failed to attach handler kbd to device input9, error: -5 [ 117.368339][ T6585] loop0: detected capacity change from 0 to 32768 [ 117.390208][ T6555] XFS (loop1): Ending clean mount [ 117.415171][ T6585] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.211 (6585) [ 117.449702][ T5817] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 117.484880][ T5828] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.524846][ T5954] usb 3-1: USB disconnect, device number 4 [ 117.543334][ T6585] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 117.593621][ T6585] BTRFS info (device loop0): using sha256 checksum algorithm [ 117.623662][ T6585] BTRFS warning (device loop0): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 117.690930][ T5820] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 117.855107][ T6585] BTRFS info (device loop0): rebuilding free space tree [ 117.989874][ T6585] BTRFS info (device loop0): disabling free space tree [ 118.032830][ T6585] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 118.093656][ T6585] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 118.174065][ T6585] BTRFS info (device loop0): enabling ssd optimizations [ 118.181645][ T6585] BTRFS info (device loop0): turning on async discard [ 118.220765][ T6585] BTRFS info (device loop0): enabling disk space caching [ 118.236406][ T5892] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 118.273776][ T6585] BTRFS info (device loop0): force clearing of disk cache [ 118.281602][ T6585] BTRFS info (device loop0): enabling auto defrag [ 118.332094][ T6585] BTRFS info (device loop0): force zstd compression, level 3 [ 118.392883][ T6585] BTRFS info (device loop0): max_inline set to 0 [ 118.434276][ T5892] usb 4-1: Using ep0 maxpacket: 8 [ 118.464880][ T5892] usb 4-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 118.496222][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 118.515500][ T5892] usb 4-1: Product: syz [ 118.530135][ T5892] usb 4-1: Manufacturer: syz [ 118.535499][ T5892] usb 4-1: SerialNumber: syz [ 118.634748][ T5892] usb 4-1: config 0 descriptor?? [ 118.857129][ T35] BTRFS info (device loop0): qgroup scan completed (inconsistency flag cleared) [ 118.958439][ T5818] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 119.055676][ T6635] loop2: detected capacity change from 0 to 32768 [ 119.070194][ T5892] gspca_main: sq905-2.14.0 probing 2770:9120 [ 119.116647][ T6635] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 119.127186][ T6635] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 119.233927][ T6635] gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms [ 119.250677][ T5913] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 119.279216][ T5913] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 119.301149][ T6625] loop4: detected capacity change from 0 to 32768 [ 119.452739][ T6625] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 119.477423][ T5913] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 198ms [ 119.500574][ T5913] gfs2: fsid=syz:syz.0: jid=0: Done [ 119.508033][ T6635] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 119.775031][ T6635] gfs2: fsid=syz:syz.0: found 1 quota changes [ 119.838174][ T5892] gspca_sq905: sq905_read_data: usb_control_msg failed (-71) [ 119.883924][ T6625] XFS (loop4): Ending clean mount [ 119.890710][ T5892] sq905 4-1:0.0: probe with driver sq905 failed with error -71 [ 119.928151][ T5892] usb 4-1: USB disconnect, device number 3 [ 119.943043][ T6625] XFS (loop4): Quotacheck needed: Please wait. [ 120.081281][ T6625] XFS (loop4): Quotacheck: Done. [ 120.232372][ T5817] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 120.368930][ T6661] loop1: detected capacity change from 0 to 32768 [ 120.381022][ T6649] loop0: detected capacity change from 0 to 32768 [ 120.443979][ T6649] JBD2: Ignoring recovery information on journal [ 120.615649][ T6649] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 120.862078][ T5818] ocfs2: Unmounting device (7,0) on (node local) [ 120.871830][ T6673] netlink: 8 bytes leftover after parsing attributes in process `syz.2.228'. [ 121.115776][ T6677] loop2: detected capacity change from 0 to 256 [ 121.155305][ T6677] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 121.292984][ T6683] loop4: detected capacity change from 0 to 1024 [ 121.446567][ T6683] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 121.509573][ T6689] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 121.529756][ T6683] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4222: comm syz.4.232: Allocating blocks 497-513 which overlap fs metadata [ 121.538767][ T6690] loop1: detected capacity change from 0 to 512 [ 121.557841][ T6683] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4222: comm syz.4.232: Allocating blocks 497-513 which overlap fs metadata [ 121.653029][ T6690] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 121.784773][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 121.784790][ T29] audit: type=1800 audit(1772463330.267:18): pid=6690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.227" name="bus" dev="loop1" ino=18 res=0 errno=0 [ 121.806264][ T6682] EXT4-fs (loop4): pa ffff888077a260e8: logic 48, phys. 177, len 21 [ 121.823978][ T6682] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5465: group 0, free 0, pa_free 1 [ 121.997655][ T6694] loop0: detected capacity change from 0 to 32768 [ 122.017975][ T5817] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.034481][ T6694] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.234 (6694) [ 122.068729][ T5820] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.135498][ T6694] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 122.184868][ T6681] loop3: detected capacity change from 0 to 32768 [ 122.193731][ T6694] BTRFS info (device loop0): using sha256 checksum algorithm [ 122.233256][ T6681] BTRFS info: device /dev/loop3 (7:3) using temp-fsid b4801bf5-efad-4a51-842e-cad5128e037c [ 122.318449][ T6681] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.231 (6681) [ 122.409987][ T6709] tmpfs: Bad value for 'mpol' [ 122.419281][ T6716] input: syz0 as /devices/virtual/input/input10 [ 122.443625][ T6716] input: failed to attach handler leds to device input10, error: -6 [ 122.501949][ T6681] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 122.534239][ T6694] BTRFS info (device loop0): enabling ssd optimizations [ 122.534275][ T6697] loop2: detected capacity change from 0 to 32768 [ 122.558967][ T6694] BTRFS info (device loop0): turning on async discard [ 122.567564][ T6681] BTRFS info (device loop3): using sha256 checksum algorithm [ 122.603525][ T6694] BTRFS info (device loop0): enabling free space tree [ 122.612630][ T6681] BTRFS warning (device loop3): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 122.674112][ T6697] XFS (loop2): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 122.868477][ T6681] BTRFS info (device loop3): rebuilding free space tree [ 122.915422][ T5818] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 122.978249][ T6681] BTRFS info (device loop3): disabling free space tree [ 123.006155][ T6697] XFS (loop2): Starting recovery (logdev: internal) [ 123.033296][ T6681] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 123.049906][ T6750] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 123.100741][ T6681] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 123.129119][ T6697] XFS (loop2): Ending recovery (logdev: internal) [ 123.147982][ T6750] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 123.183232][ T6681] BTRFS info (device loop3): enabling ssd optimizations [ 123.204385][ T6681] BTRFS info (device loop3): turning on async discard [ 123.211613][ T6681] BTRFS info (device loop3): enabling disk space caching [ 123.239111][ T6681] BTRFS info (device loop3): force clearing of disk cache [ 123.276366][ T6697] XFS (loop2): User initiated shutdown received. [ 123.295531][ T6697] XFS (loop2): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:462). Shutting down filesystem. [ 123.321918][ T6681] BTRFS info (device loop3): enabling auto defrag [ 123.325892][ T29] audit: type=1804 audit(1772463331.777:19): pid=6750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.243" name="/newroot/49/file0/trusted." dev="loop1" ino=1048621 res=1 errno=0 [ 123.359127][ T6681] BTRFS info (device loop3): force zstd compression, level 3 [ 123.390457][ T6697] XFS (loop2): Please unmount the filesystem and rectify the problem(s) [ 123.410332][ T6681] BTRFS info (device loop3): max_inline set to 0 [ 123.565305][ T5819] XFS (loop2): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 123.685711][ T58] BTRFS info (device loop3): qgroup scan completed (inconsistency flag cleared) [ 123.869187][ T5828] BTRFS info (device loop3): last unmount of filesystem b4801bf5-efad-4a51-842e-cad5128e037c [ 124.539335][ T6774] set_capacity_and_notify: 2 callbacks suppressed [ 124.539354][ T6774] loop2: detected capacity change from 0 to 8 [ 124.540422][ T6752] loop4: detected capacity change from 0 to 32768 [ 124.665299][ T6774] SQUASHFS error: Unable to read directory block [629:1f] [ 124.677432][ T6774] SQUASHFS error: Unable to read directory block [629:0] [ 124.685391][ T6752] gfs2: fsid=statfs_quantum: Trying to join cluster "lock_nolock", "statfs_quantum" [ 124.743743][ T6752] gfs2: fsid=statfs_quantum: Now mounting FS (format 1801)... [ 124.861670][ T6752] gfs2: fsid=statfs_quantum.s: journal 0 mapped with 18 extents in 0ms [ 125.108198][ T6752] gfs2: fsid=statfs_quantum.s: first mount done, others may mount [ 125.582977][ T6773] loop1: detected capacity change from 0 to 40427 [ 125.649464][ T6773] F2FS-fs (loop1): invalid crc value [ 125.843750][ T6796] loop4: detected capacity change from 0 to 512 [ 125.966391][ T6773] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 126.010950][ T6796] EXT4-fs error (device loop4): ext4_iget_extra_inode:5025: inode #15: comm syz.4.261: corrupted in-inode xattr: e_value size too large [ 126.041935][ T6773] F2FS-fs (loop1): Start checkpoint disabled! [ 126.082357][ T6773] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 126.095036][ T6796] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 126.103482][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 126.120082][ C1] EXT4-fs (loop4): initial error at time 1772463334: ext4_iget_extra_inode:5025: inode 15 [ 126.131119][ C1] EXT4-fs (loop4): last error at time 1772463334: ext4_iget_extra_inode:5025: inode 15 [ 126.147137][ T6773] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 126.153879][ T6796] EXT4-fs error (device loop4): ext4_orphan_get:1396: comm syz.4.261: couldn't read orphan inode 15 (err -117) [ 126.195620][ T6796] loop4: lost filesystem error report for type 5 error -117 [ 126.204848][ T6796] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 126.317852][ T6785] loop3: detected capacity change from 0 to 32768 [ 126.334749][ T35] kworker/u8:2: attempt to access beyond end of device [ 126.334749][ T35] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 126.357333][ T6785] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.257 (6785) [ 126.375698][ T35] CPU: 0 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) [ 126.375724][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 126.375735][ T35] Workqueue: writeback wb_workfn (flush-7:1) [ 126.375765][ T35] Call Trace: [ 126.375772][ T35] [ 126.375780][ T35] dump_stack_lvl+0xe8/0x150 [ 126.375807][ T35] f2fs_handle_critical_error+0x37c/0x540 [ 126.375842][ T35] f2fs_write_end_io+0xcdb/0xff0 [ 126.375883][ T35] __submit_merged_bio+0x256/0x700 [ 126.375917][ T35] __submit_merged_write_cond+0x3c9/0x4e0 [ 126.375953][ T35] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 126.376003][ T35] f2fs_write_data_pages+0x2975/0x35e0 [ 126.376063][ T35] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 126.376098][ T35] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 126.376156][ T35] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 126.376201][ T35] ? __lock_acquire+0x6b5/0x2cf0 [ 126.376239][ T35] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 126.376264][ T35] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 126.376285][ T35] do_writepages+0x32e/0x550 [ 126.376318][ T35] ? reacquire_held_locks+0x104/0x190 [ 126.376342][ T35] ? writeback_sb_inodes+0x477/0x1a20 [ 126.376371][ T35] __writeback_single_inode+0x133/0x11a0 [ 126.376396][ T35] ? do_raw_spin_unlock+0xf5/0x210 [ 126.376419][ T35] writeback_sb_inodes+0x992/0x1a20 [ 126.376466][ T35] ? __lock_acquire+0x6b5/0x2cf0 [ 126.376494][ T35] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 126.376516][ T35] ? do_raw_spin_lock+0x12b/0x2f0 [ 126.376577][ T35] ? rcu_is_watching+0x15/0xb0 [ 126.376612][ T35] wb_writeback+0x456/0xb70 [ 126.376640][ T35] ? queue_io+0x261/0x4a0 [ 126.376678][ T35] ? __pfx_wb_writeback+0x10/0x10 [ 126.376699][ T35] ? do_raw_spin_lock+0x12b/0x2f0 [ 126.376735][ T35] wb_workfn+0x414/0xf50 [ 126.376759][ T35] ? look_up_lock_class+0x57/0x110 [ 126.376794][ T35] ? __pfx_wb_workfn+0x10/0x10 [ 126.376818][ T35] ? do_raw_spin_lock+0x12b/0x2f0 [ 126.376838][ T35] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 126.376880][ T35] ? process_one_work+0x87c/0x1650 [ 126.376902][ T35] process_one_work+0x949/0x1650 [ 126.376949][ T35] ? __pfx_process_one_work+0x10/0x10 [ 126.376969][ T35] ? do_raw_spin_lock+0x12b/0x2f0 [ 126.377007][ T35] worker_thread+0xb46/0x1140 [ 126.377060][ T35] kthread+0x388/0x470 [ 126.377079][ T35] ? __pfx_worker_thread+0x10/0x10 [ 126.377100][ T35] ? __pfx_kthread+0x10/0x10 [ 126.377125][ T35] ret_from_fork+0x51e/0xb90 [ 126.377152][ T35] ? __pfx_ret_from_fork+0x10/0x10 [ 126.377172][ T35] ? __switch_to+0xc7d/0x1450 [ 126.377198][ T35] ? __pfx_kthread+0x10/0x10 [ 126.377217][ T35] ret_from_fork_asm+0x1a/0x30 [ 126.377254][ T35] [ 126.377261][ T35] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 126.455534][ T6785] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 126.773576][ T6785] BTRFS info (device loop3): using sha256 checksum algorithm [ 126.833621][ T5817] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 127.067789][ T6803] loop2: detected capacity change from 0 to 32768 [ 127.139668][ T6803] XFS (loop2): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 127.177169][ T6785] BTRFS info (device loop3): rebuilding free space tree [ 127.228741][ T6785] BTRFS info (device loop3): turning off barriers [ 127.239288][ T6785] BTRFS info (device loop3): turning on sync discard [ 127.249882][ T6803] XFS (loop2): Ending clean mount [ 127.261707][ T6785] BTRFS info (device loop3): enabling free space tree [ 127.286200][ T6803] XFS (loop2): Quotacheck needed: Please wait. [ 127.294613][ T6785] BTRFS info (device loop3): force clearing of disk cache [ 127.302381][ T6785] BTRFS info (device loop3): enabling auto defrag [ 127.357641][ T6803] XFS (loop2): Quotacheck: Done. [ 127.589974][ T5828] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 127.629728][ T5819] XFS (loop2): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 127.713052][ T6852] netlink: 104 bytes leftover after parsing attributes in process `syz.4.278'. [ 127.760213][ T6853] syz_tun: entered allmulticast mode [ 127.770403][ T6850] syz_tun: left allmulticast mode [ 127.811504][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 127.878994][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 127.906931][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 127.935789][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 127.986605][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 128.025310][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 128.068129][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 128.105790][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 128.144289][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 128.181555][ T5892] hid-generic 0080:0008:0000.0003: unknown main item tag 0x0 [ 128.240723][ T5892] hid-generic 0080:0008:0000.0003: hidraw0: HID v0.00 Device [syz0] on syz0 [ 128.261723][ T6865] vivid-002: disconnect [ 128.292382][ T6864] vivid-002: reconnect [ 128.437497][ T6867] fido_id[6867]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 128.723163][ T6879] loop0: detected capacity change from 0 to 64 [ 128.849862][ T6879] hfs: request for non-existent node 131072 in B*Tree [ 128.890983][ T6879] hfs: request for non-existent node 131072 in B*Tree [ 129.102190][ T6870] loop4: detected capacity change from 0 to 32768 [ 129.151841][ T6870] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.283 (6870) [ 129.225314][ T6870] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 129.272018][ T6870] BTRFS info (device loop4): using sha256 checksum algorithm [ 129.508296][ T6870] BTRFS info (device loop4): rebuilding free space tree [ 129.656529][ T6870] BTRFS info (device loop4): disabling free space tree [ 129.719767][ T6870] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 129.788111][ T6870] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 129.819623][ T6914] netlink: 36 bytes leftover after parsing attributes in process `syz.1.296'. [ 129.825793][ T6870] BTRFS info (device loop4): enabling ssd optimizations [ 129.868750][ T6870] BTRFS info (device loop4): turning on async discard [ 129.888156][ T6870] BTRFS info (device loop4): force clearing of disk cache [ 129.912255][ T6870] BTRFS info (device loop4): enabling auto defrag [ 129.951184][ T6870] BTRFS info (device loop4): max_inline set to 4096 [ 130.124633][ T6921] loop1: detected capacity change from 0 to 1024 [ 130.159464][ T6921] EXT4-fs: Ignoring removed mblk_io_submit option [ 130.184778][ T5913] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 130.238892][ T6921] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 130.355329][ T5817] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 130.394975][ T29] audit: type=1800 audit(1772463338.867:20): pid=6921 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.300" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 130.424677][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.457261][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.496401][ T5913] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 130.548437][ T6921] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4222: comm syz.1.300: Allocating blocks 497-513 which overlap fs metadata [ 130.567656][ T5913] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 130.622473][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.672864][ T5913] usb 4-1: config 0 descriptor?? [ 130.736393][ T6925] EXT4-fs (loop1): pa ffff888037127d98: logic 48, phys. 177, len 21 [ 130.746655][ T6925] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5465: group 0, free 0, pa_free 1 [ 130.753532][ T6915] loop0: detected capacity change from 0 to 32768 [ 130.802750][ T6915] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.297 (6915) [ 130.902317][ T6915] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 130.929407][ T6927] loop4: detected capacity change from 0 to 128 [ 130.943948][ T6915] BTRFS info (device loop0): using crc32c checksum algorithm [ 131.016180][ T6927] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 131.029569][ T5820] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 131.048077][ T6927] ext4 filesystem being mounted at /59/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 131.127970][ T29] audit: type=1804 audit(1772463339.607:21): pid=6927 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.301" name="/newroot/59/file0/bus" dev="loop4" ino=12 res=1 errno=0 [ 131.182224][ T5913] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 131.251705][ T6915] BTRFS info (device loop0): enabling ssd optimizations [ 131.263657][ T6915] BTRFS info (device loop0): turning on flush-on-commit [ 131.281497][ T6915] BTRFS info (device loop0): enabling free space tree [ 131.282187][ T29] audit: type=1800 audit(1772463339.607:22): pid=6927 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.301" name="bus" dev="loop4" ino=12 res=0 errno=0 [ 131.333999][ T6915] BTRFS info (device loop0): enabling auto defrag [ 131.340683][ T6915] BTRFS info (device loop0): use lzo compression, level 1 [ 131.371501][ T5817] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 131.403499][ T6915] BTRFS info (device loop0): max_inline set to 4096 [ 131.423721][ T5954] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 131.437493][ T5913] usb 4-1: USB disconnect, device number 4 [ 131.600043][ T5954] usb 2-1: Using ep0 maxpacket: 8 [ 131.629661][ T5954] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 131.651343][ T5954] usb 2-1: config 0 has no interface number 0 [ 131.658604][ T5954] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 131.673233][ T5954] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 131.687480][ T5954] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 131.700552][ T5954] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 131.754114][ T5954] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 131.766331][ T5818] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 131.778399][ T5954] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.798799][ T5954] usb 2-1: config 0 descriptor?? [ 131.829783][ T5954] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 132.506477][ T6948] loop4: detected capacity change from 0 to 32768 [ 132.542911][ T6948] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.303 (6948) [ 132.609824][ T6948] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 132.666607][ T6948] BTRFS info (device loop4): using sha256 checksum algorithm [ 132.781626][ T6948] BTRFS info (device loop4): enabling ssd optimizations [ 132.794428][ T6948] BTRFS info (device loop4): turning on async discard [ 132.801782][ T6948] BTRFS info (device loop4): enabling free space tree [ 133.032097][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.042090][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.067289][ T5817] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 133.084356][ T6980] loop2: detected capacity change from 0 to 164 [ 133.321618][ T6952] loop0: detected capacity change from 0 to 32768 [ 133.326421][ T6980] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 133.441577][ T6952] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 133.676277][ T6952] XFS (loop0): Ending clean mount [ 133.726340][ T6952] XFS (loop0): Quotacheck needed: Please wait. [ 133.835383][ T6952] XFS (loop0): Quotacheck: Done. [ 133.907057][ T29] audit: type=1800 audit(1772463342.367:23): pid=6952 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.304" name="file1" dev="loop0" ino=9286 res=0 errno=0 [ 134.113168][ T5954] usb 2-1: USB disconnect, device number 4 [ 134.137203][ T5818] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 134.175416][ T5954] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 134.361458][ T7002] loop4: detected capacity change from 0 to 4096 [ 134.535052][ T7008] loop3: detected capacity change from 0 to 256 [ 134.605243][ T7008] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 134.943746][ T5954] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 135.000709][ T7018] loop4: detected capacity change from 0 to 128 [ 135.068621][ T7018] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 135.124914][ T5954] usb 3-1: Using ep0 maxpacket: 8 [ 135.137128][ T7018] ext4 filesystem being mounted at /64/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 135.184210][ T7022] loop0: detected capacity change from 0 to 2048 [ 135.211267][ T5954] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 135.260552][ T5954] usb 3-1: config 5 has 0 interfaces, different from the descriptor's value: 1 [ 135.283124][ T7026] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 135.338842][ T5954] usb 3-1: New USB device found, idVendor=0ac8, idProduct=3410, bcdDevice=86.9e [ 135.351954][ T29] audit: type=1800 audit(1772463343.817:24): pid=7022 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.325" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 135.391007][ T5954] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.404118][ T7022] NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=15) [ 135.432740][ T5817] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 135.447301][ T5954] usb 3-1: Product: syz [ 135.470943][ T5954] usb 3-1: Manufacturer: syz [ 135.473885][ T7022] Remounting filesystem read-only [ 135.480246][ T29] audit: type=1800 audit(1772463343.817:25): pid=7022 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.325" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 135.511701][ T5954] usb 3-1: SerialNumber: syz [ 135.593350][ T7030] loop1: detected capacity change from 0 to 512 [ 135.662070][ T5818] NILFS (loop0): disposed unprocessed dirty file(s) when detaching log writer [ 135.692668][ T7030] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 135.737073][ T5954] usb 3-1: USB disconnect, device number 5 [ 135.837748][ T5820] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.394308][ T7052] netlink: 'syz.2.337': attribute type 10 has an invalid length. [ 136.438039][ T7058] netlink: 'syz.2.337': attribute type 10 has an invalid length. [ 136.461178][ T7044] loop1: detected capacity change from 0 to 32768 [ 136.515901][ T7044] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 136.560680][ T7044] XFS (loop1): Ending clean mount [ 136.593916][ T7044] XFS (loop1): Quotacheck needed: Please wait. [ 136.624173][ T7052] team0: Port device dummy0 added [ 136.663603][ T5954] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 136.690337][ T7058] team0: Port device dummy0 removed [ 136.708098][ T7044] XFS (loop1): Quotacheck: Done. [ 136.739737][ T7058] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 136.772759][ T5820] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 136.831024][ T5954] usb 1-1: Using ep0 maxpacket: 32 [ 136.862886][ T5954] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 136.882139][ T5954] usb 1-1: config 0 has no interface number 0 [ 136.892355][ T5954] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 136.913547][ T5954] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.922087][ T5954] usb 1-1: Product: syz [ 136.931119][ T5954] usb 1-1: Manufacturer: syz [ 136.936109][ T5954] usb 1-1: SerialNumber: syz [ 136.946987][ T5954] usb 1-1: config 0 descriptor?? [ 136.973550][ T5954] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 137.186940][ T5954] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 137.253030][ T5954] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 137.583743][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 137.607252][ T5954] usb 1-1: USB disconnect, device number 4 [ 137.628366][ T5954] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 137.652334][ T7072] loop2: detected capacity change from 0 to 32768 [ 137.653710][ T5954] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 137.681791][ T7072] BTRFS: device fsid 3a492a15-ac49-4ce6-945e-cef7a687c6c9 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.342 (7072) [ 137.696430][ T5954] quatech2 1-1:0.51: device disconnected [ 137.737845][ T7072] BTRFS info (device loop2): first mount of filesystem 3a492a15-ac49-4ce6-945e-cef7a687c6c9 [ 137.771538][ T7072] BTRFS info (device loop2): using crc32c checksum algorithm [ 137.872072][ T7102] warning: `syz.3.353' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 137.928384][ T7072] BTRFS info (device loop2): enabling ssd optimizations [ 137.938050][ T7072] BTRFS info (device loop2): turning on async discard [ 137.957299][ T7072] BTRFS info (device loop2): enabling free space tree [ 138.110494][ T5819] BTRFS info (device loop2): last unmount of filesystem 3a492a15-ac49-4ce6-945e-cef7a687c6c9 [ 138.356405][ T5954] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 138.534561][ T5954] usb 4-1: Using ep0 maxpacket: 8 [ 138.590875][ T5954] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 138.627224][ T5954] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 138.640418][ T7120] loop0: detected capacity change from 0 to 1024 [ 138.670315][ T7120] EXT4-fs: Ignoring removed oldalloc option [ 138.683993][ T5954] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 138.712286][ T7120] EXT4-fs: Ignoring removed bh option [ 138.744771][ T5954] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 138.788746][ T5954] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 138.829514][ T5954] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.901515][ T7120] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 138.962877][ T5818] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.070535][ T5954] usb 4-1: GET_CAPABILITIES returned 0 [ 139.077532][ T5954] usbtmc 4-1:16.0: can't read capabilities [ 139.284184][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.320810][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.330585][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.339794][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.412272][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.421960][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.433511][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.559204][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.569067][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.578904][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.588330][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.682700][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.692772][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.702123][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.711505][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 139.786814][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -2 [ 139.818481][ T5954] usb 4-1: USB disconnect, device number 5 [ 140.021425][ T7116] loop1: detected capacity change from 0 to 262144 [ 140.034128][ T7116] BTRFS: device fsid 7e32c2af-f87a-45a1-bcba-64dea7c56a53 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.355 (7116) [ 140.059328][ T7116] BTRFS info (device loop1): first mount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53 [ 140.079393][ T7116] BTRFS info (device loop1): using xxhash64 checksum algorithm [ 140.254540][ T7116] BTRFS info (device loop1): deleted orphan free space tree entries [ 140.262905][ T7116] BTRFS info (device loop1): checking UUID tree [ 140.274478][ T7116] BTRFS info (device loop1): enabling ssd optimizations [ 140.281564][ T7116] BTRFS info (device loop1): turning on async discard [ 140.288670][ T7116] BTRFS info (device loop1): enabling free space tree [ 140.323843][ T29] audit: type=1800 audit(1772463348.797:26): pid=7116 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.355" name="file2" dev="loop1" ino=261 res=0 errno=0 [ 140.331783][ T7150] ref_ctr_offset mismatch. inode: 0x179 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x2 [ 140.530752][ T5820] BTRFS info (device loop1): last unmount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53 [ 140.803816][ T24] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 140.860604][ T7136] loop2: detected capacity change from 0 to 32768 [ 140.955727][ T7136] XFS (loop2): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 140.983578][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 140.991205][ T24] usb 4-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 141.050906][ T24] usb 4-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 141.127237][ T24] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 141.155240][ T7136] XFS (loop2): Ending clean mount [ 141.191801][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.336801][ T5819] XFS (loop2): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 141.550378][ T7172] binder: 7169:7172 ioctl c0306201 200000001a80 returned -14 [ 141.791795][ T7181] loop1: detected capacity change from 0 to 128 [ 142.172237][ T7183] loop1: detected capacity change from 0 to 4096 [ 142.378301][ T7179] loop0: detected capacity change from 0 to 131072 [ 142.397012][ T24] mcp2221 0003:04D8:00DD.0005: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 142.453544][ T7179] F2FS-fs (loop0): Test dummy encryption mode enabled [ 142.539570][ T7179] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 142.552232][ T7179] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 142.618015][ T24] usb 4-1: USB disconnect, device number 6 [ 143.039945][ T7191] loop2: detected capacity change from 0 to 128 [ 143.095177][ T7191] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 143.189546][ T7191] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 143.429150][ T86] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 143.756454][ T7206] binder: 7205:7206 ioctl c0306201 2000000003c0 returned -14 [ 144.408929][ T7200] loop3: detected capacity change from 0 to 32768 [ 144.494033][ T7200] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 144.520541][ T7236] loop1: detected capacity change from 0 to 1024 [ 144.543059][ T7236] EXT4-fs: Ignoring removed oldalloc option [ 144.578407][ T7200] XFS (loop3): Ending clean mount [ 144.588314][ T7200] XFS (loop3): Quotacheck needed: Please wait. [ 144.721151][ T7200] XFS (loop3): Quotacheck: Done. [ 144.740779][ T7236] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 144.813893][ T7236] ext4 filesystem being mounted at /86/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 144.834636][ T7200] capability: warning: `syz.3.381' uses deprecated v2 capabilities in a way that may be insecure [ 144.836542][ T7236] EXT4-fs error (device loop1): ext4_map_blocks:818: inode #15: comm syz.1.393: lblock 0 mapped to illegal pblock 0 (length 1) [ 144.859975][ T29] audit: type=1800 audit(1772463353.317:27): pid=7236 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.393" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 144.905037][ T7236] EXT4-fs (loop1): Remounting filesystem read-only [ 144.906362][ T7242] loop4: detected capacity change from 0 to 4096 [ 144.922830][ T7242] EXT4-fs: inline encryption not supported [ 144.978373][ T7242] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 145.024226][ T7242] System zones: 0-5 [ 145.068980][ T7242] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.114632][ T5828] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 145.138364][ T5820] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 145.479344][ T7245] loop0: detected capacity change from 0 to 32768 [ 145.560287][ T7245] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.394 (7245) [ 145.751595][ T7257] loop1: detected capacity change from 0 to 32768 [ 145.758402][ T5817] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.787402][ T7245] BTRFS info (device loop0): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 145.789154][ T7257] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 145.808178][ T7257] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 145.816763][ T7245] BTRFS info (device loop0): using sha256 checksum algorithm [ 145.865289][ T7257] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 145.885260][ T10] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 145.892610][ T10] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 146.050741][ T10] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 158ms [ 146.103057][ T7245] BTRFS info (device loop0): rebuilding free space tree [ 146.112941][ T7281] loop4: detected capacity change from 0 to 128 [ 146.123240][ T7245] BTRFS info (device loop0): disabling free space tree [ 146.133579][ T7245] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 146.145560][ T7245] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 146.158933][ T10] gfs2: fsid=syz:syz.0: jid=0: Done [ 146.174434][ T7257] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 146.175956][ T7281] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985 [ 146.186253][ T7245] BTRFS info (device loop0): enabling ssd optimizations [ 146.233626][ T7245] BTRFS info (device loop0): turning on async discard [ 146.245270][ T7281] ; already mounted read-only [ 146.297392][ T7281] hpfs: filesystem error: improperly stopped [ 146.307544][ T7245] BTRFS info (device loop0): force clearing of disk cache [ 146.335257][ T7257] gfs2: fsid=syz:syz.0: found 1 quota changes [ 146.337262][ T7281] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 146.358007][ T7245] BTRFS info (device loop0): enabling auto defrag [ 146.391292][ T7281] [ 146.413514][ T7281] hpfs: You really don't want any checks? You are crazy... [ 146.425378][ T7281] hpfs: hpfs_map_sector(): read error [ 146.431534][ T7281] hpfs: code page support is disabled [ 146.439500][ T7281] hpfs: hpfs_map_4sectors(): unaligned read [ 146.446025][ T7281] hpfs: hpfs_map_4sectors(): unaligned read [ 146.452558][ T7281] hpfs: filesystem error: unable to find root dir [ 146.474226][ T7245] BTRFS info (device loop0): max_inline set to 4096 [ 146.503306][ T5820] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error - inode = 11 2339, function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 402 [ 146.572911][ T5820] gfs2: fsid=syz:syz.0: G: s:EX n:2/923 f:aqonN t:EX d:EX/0 a:0 v:0 r:2 m:20 p:1 [ 146.612337][ T5820] gfs2: fsid=syz:syz.0: H: s:EX f:H e:0 p:5820 [syz-executor] gfs2_quota_sync+0x370/0x470 [ 146.653587][ T5820] gfs2: fsid=syz:syz.0: I: n:11/2339 t:0 f:0x00 d:0x00000000 s:0 p:0 [ 146.704998][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 146.705021][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 146.705029][ T5820] Call Trace: [ 146.705035][ T5820] [ 146.705042][ T5820] dump_stack_lvl+0xe8/0x150 [ 146.705069][ T5820] gfs2_withdraw+0xc3/0x1b0 [ 146.705099][ T5820] inode_go_instantiate+0xdd8/0x1220 [ 146.705123][ T5820] ? preempt_schedule_common+0x82/0xd0 [ 146.705157][ T5820] ? __pfx_inode_go_instantiate+0x10/0x10 [ 146.705189][ T5820] gfs2_instantiate+0x168/0x220 [ 146.705216][ T5820] gfs2_glock_wait+0x1d4/0x2a0 [ 146.705242][ T5820] do_sync+0x49a/0xcb0 [ 146.705259][ T5820] ? _raw_spin_unlock+0x28/0x50 [ 146.705280][ T5820] ? gfs2_quota_sync+0x370/0x470 [ 146.705306][ T5820] ? __pfx_do_sync+0x10/0x10 [ 146.705335][ T5820] ? gfs2_quota_sync+0x370/0x470 [ 146.705353][ T5820] ? do_raw_spin_unlock+0xf5/0x210 [ 146.705372][ T5820] gfs2_quota_sync+0x370/0x470 [ 146.705398][ T5820] gfs2_sync_fs+0x4c/0xb0 [ 146.705416][ T5820] sync_filesystem+0xee/0x230 [ 146.705439][ T5820] generic_shutdown_super+0x77/0x2d0 [ 146.705459][ T5820] kill_block_super+0x44/0x90 [ 146.705480][ T5820] deactivate_locked_super+0xbc/0x130 [ 146.705508][ T5820] cleanup_mnt+0x437/0x4d0 [ 146.705525][ T5820] ? _raw_spin_unlock_irq+0x23/0x50 [ 146.705551][ T5820] task_work_run+0x1d9/0x270 [ 146.705574][ T5820] ? __pfx_task_work_run+0x10/0x10 [ 146.705610][ T5820] exit_to_user_mode_loop+0xed/0x480 [ 146.705630][ T5820] ? rcu_is_watching+0x15/0xb0 [ 146.705659][ T5820] do_syscall_64+0x32d/0xf80 [ 146.705676][ T5820] ? trace_irq_disable+0x3b/0x150 [ 146.705691][ T5820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.705709][ T5820] ? clear_bhb_loop+0x40/0x90 [ 146.705730][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.705747][ T5820] RIP: 0033:0x7f069619d9d7 [ 146.705778][ T5820] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 146.705791][ T5820] RSP: 002b:00007ffef7716af8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 146.705810][ T5820] RAX: 0000000000000000 RBX: 00007f0696231f90 RCX: 00007f069619d9d7 [ 146.705820][ T5820] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef7716bb0 [ 146.705830][ T5820] RBP: 00007ffef7716bb0 R08: 00007ffef7717bb0 R09: 00000000ffffffff [ 146.705841][ T5820] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef7717c40 [ 146.705851][ T5820] R13: 00007f0696231f90 R14: 0000000000023bc2 R15: 00007ffef7717c80 [ 146.705893][ T5820] [ 146.705900][ T5820] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 147.162220][ T5818] BTRFS info (device loop0): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 147.567524][ T7310] loop4: detected capacity change from 0 to 4096 [ 147.623352][ T7312] loop2: detected capacity change from 0 to 512 [ 147.692125][ T7316] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 147.701648][ T7312] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 147.732045][ T7312] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e854e018, mo2=0003] [ 147.765717][ T7312] System zones: 0-1, 15-15, 18-18, 34-34 [ 147.792787][ T7312] EXT4-fs (loop2): orphan cleanup on readonly fs [ 147.849023][ T7312] Quota error (device loop2): v2_read_header: Failed header read: expected=8 got=0 [ 147.863124][ T7312] EXT4-fs warning (device loop2): ext4_enable_quotas:7236: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 147.881285][ T7312] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 147.891320][ T7312] EXT4-fs error (device loop2): ext4_orphan_get:1391: inode #16: comm syz.2.416: iget: bad extended attribute block 1 [ 147.923522][ T7312] loop2: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 147.933497][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 147.951385][ C0] EXT4-fs (loop2): initial error at time 1772463356: ext4_orphan_get:1391: inode 16 [ 147.962070][ C0] EXT4-fs (loop2): last error at time 1772463356: ext4_orphan_get:1391: inode 16 [ 148.208086][ T7312] EXT4-fs error (device loop2): ext4_orphan_get:1396: comm syz.2.416: couldn't read orphan inode 16 (err -117) [ 148.241944][ T7312] loop2: lost filesystem error report for type 5 error -117 [ 148.251417][ T7312] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 148.508197][ T7326] loop0: detected capacity change from 0 to 512 [ 148.540997][ T5819] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 148.573101][ T7326] EXT4-fs (loop0): Test dummy encryption mode enabled [ 148.604829][ T7326] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 148.679633][ T7326] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 148.765287][ T7326] EXT4-fs error (device loop0): ext4_orphan_get:1417: comm syz.0.421: bad orphan inode 131083 [ 148.789696][ T7326] loop0: lost filesystem error report for type 5 error -117 [ 148.791839][ T7326] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 148.821863][ T7326] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 148.837703][ T7321] loop3: detected capacity change from 0 to 131072 [ 148.848948][ T7321] F2FS-fs (loop3): Invalid Fs Meta Ino: node(1) meta(2048) root(3) [ 148.859585][ T7321] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 148.923515][ T7321] F2FS-fs (loop3): Test dummy encryption mode enabled [ 148.943153][ T7321] F2FS-fs (loop3): invalid crc value [ 148.974879][ T5818] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 149.034061][ T7321] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 149.055771][ T7321] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 149.066139][ T7321] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 149.085240][ T7321] fscrypt: AES-256-XTS using implementation "xts-aes-aesni-avx" [ 149.178851][ T7334] loop2: detected capacity change from 0 to 4096 [ 149.258287][ T7336] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 150.160890][ T7342] loop3: detected capacity change from 0 to 32768 [ 150.177787][ T7344] loop2: detected capacity change from 0 to 32768 [ 150.178743][ T7341] loop0: detected capacity change from 0 to 32768 [ 150.205148][ T7344] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.423 (7344) [ 150.221916][ T7341] btrfs: Deprecated parameter 'usebackuproot' [ 150.236655][ T7341] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 150.257355][ T7344] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 150.271867][ T7341] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.433 (7341) [ 150.307022][ T7344] BTRFS info (device loop2): using sha256 checksum algorithm [ 150.393326][ T7341] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 150.456336][ T7346] loop4: detected capacity change from 0 to 32768 [ 150.468287][ T7344] BTRFS info (device loop2): rebuilding free space tree [ 150.468496][ T7341] BTRFS info (device loop0): using crc32c checksum algorithm [ 150.525432][ T7344] BTRFS info (device loop2): disabling free space tree [ 150.532721][ T7344] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 150.598000][ T7344] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 150.680562][ T7346] XFS (loop4): Mounting V5 Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a [ 150.705494][ T7344] BTRFS info (device loop2): enabling ssd optimizations [ 150.739085][ T7344] BTRFS info (device loop2): turning on async discard [ 150.791937][ T7344] BTRFS info (device loop2): force clearing of disk cache [ 150.834996][ T7341] BTRFS info (device loop0): rebuilding free space tree [ 150.843567][ T7346] XFS (loop4): Ending clean mount [ 150.862261][ T7344] BTRFS info (device loop2): enabling auto defrag [ 150.931841][ T7344] BTRFS info (device loop2): max_inline set to 4096 [ 150.965802][ T7341] BTRFS info (device loop0): enabling ssd optimizations [ 150.984548][ T7341] BTRFS info (device loop0): using spread ssd allocation scheme [ 151.037454][ T7341] BTRFS info (device loop0): turning on flush-on-commit [ 151.095620][ T7341] BTRFS info (device loop0): enabling free space tree [ 151.104714][ T5817] XFS (loop4): Unmounting Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a [ 151.124130][ T7341] BTRFS info (device loop0): force clearing of disk cache [ 151.143841][ T7341] BTRFS info (device loop0): trying to use backup root at mount time [ 151.152343][ T7341] BTRFS info (device loop0): force zlib compression, level 3 [ 151.378440][ T5819] BTRFS info (device loop2): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 151.529005][ T5818] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 151.848980][ T7390] loop3: detected capacity change from 0 to 40427 [ 151.911924][ T7390] F2FS-fs (loop3): invalid crc value [ 152.092797][ T5820] gfs2: fsid=syz:syz.0: warning: assertion "gfs2_log_is_empty(sdp)" failed - function = gfs2_make_fs_ro, file = fs/gfs2/super.c, line = 566 [ 152.181146][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 152.181171][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 152.181181][ T5820] Call Trace: [ 152.181188][ T5820] [ 152.181196][ T5820] dump_stack_lvl+0xe8/0x150 [ 152.181226][ T5820] gfs2_assert_warn_i+0x194/0x2c0 [ 152.181259][ T5820] gfs2_make_fs_ro+0x30d/0x320 [ 152.181279][ T5820] ? __pfx_gfs2_make_fs_ro+0x10/0x10 [ 152.181294][ T5820] ? do_raw_spin_lock+0x12b/0x2f0 [ 152.181313][ T5820] ? __pfx_autoremove_wake_function+0x10/0x10 [ 152.181340][ T5820] ? do_raw_spin_unlock+0xf5/0x210 [ 152.181362][ T5820] gfs2_put_super+0x220/0x860 [ 152.181387][ T5820] ? __pfx_gfs2_put_super+0x10/0x10 [ 152.181403][ T5820] generic_shutdown_super+0x13d/0x2d0 [ 152.181424][ T5820] kill_block_super+0x44/0x90 [ 152.181445][ T5820] deactivate_locked_super+0xbc/0x130 [ 152.181472][ T5820] cleanup_mnt+0x437/0x4d0 [ 152.181491][ T5820] ? _raw_spin_unlock_irq+0x23/0x50 [ 152.181520][ T5820] task_work_run+0x1d9/0x270 [ 152.181543][ T5820] ? __pfx_task_work_run+0x10/0x10 [ 152.181571][ T5820] exit_to_user_mode_loop+0xed/0x480 [ 152.181591][ T5820] ? rcu_is_watching+0x15/0xb0 [ 152.181618][ T5820] do_syscall_64+0x32d/0xf80 [ 152.181636][ T5820] ? trace_irq_disable+0x3b/0x150 [ 152.181651][ T5820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.181668][ T5820] ? clear_bhb_loop+0x40/0x90 [ 152.181689][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.181703][ T5820] RIP: 0033:0x7f069619d9d7 [ 152.181719][ T5820] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 152.181732][ T5820] RSP: 002b:00007ffef7716af8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 152.181750][ T5820] RAX: 0000000000000000 RBX: 00007f0696231f90 RCX: 00007f069619d9d7 [ 152.181761][ T5820] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef7716bb0 [ 152.181771][ T5820] RBP: 00007ffef7716bb0 R08: 00007ffef7717bb0 R09: 00000000ffffffff [ 152.181782][ T5820] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef7717c40 [ 152.181792][ T5820] R13: 00007f0696231f90 R14: 0000000000023bc2 R15: 00007ffef7717c80 [ 152.181819][ T5820] [ 152.724547][ T7394] loop4: detected capacity change from 0 to 131072 [ 152.786308][ T7394] F2FS-fs (loop4): Test dummy encryption mode enabled [ 152.797270][ T7394] F2FS-fs (loop4): invalid crc value [ 152.862588][ T7390] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 152.955640][ T7394] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 152.970640][ T5820] gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5 [ 152.978326][ T7394] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 153.066733][ T7390] F2FS-fs (loop3): Start checkpoint disabled! [ 153.093590][ T29] audit: type=1800 audit(1772463361.487:28): pid=7394 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.430" name="file1" dev="loop4" ino=10 res=0 errno=0 [ 153.146181][ T7390] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0 [ 153.174014][ T7390] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 153.240533][ T29] audit: type=1804 audit(1772463361.717:29): pid=7390 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.429" name="/newroot/81/file0/file0" dev="loop3" ino=10 res=1 errno=0 [ 153.408490][ T58] kworker/u8:4: attempt to access beyond end of device [ 153.408490][ T58] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 153.492125][ T58] CPU: 1 UID: 0 PID: 58 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) [ 153.492152][ T58] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 153.492163][ T58] Workqueue: writeback wb_workfn (flush-7:3) [ 153.492193][ T58] Call Trace: [ 153.492201][ T58] [ 153.492208][ T58] dump_stack_lvl+0xe8/0x150 [ 153.492235][ T58] f2fs_handle_critical_error+0x37c/0x540 [ 153.492268][ T58] f2fs_write_end_io+0xcdb/0xff0 [ 153.492301][ T58] __submit_merged_bio+0x256/0x700 [ 153.492333][ T58] __submit_merged_write_cond+0x3c9/0x4e0 [ 153.492367][ T58] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 153.492432][ T58] f2fs_write_data_pages+0x2975/0x35e0 [ 153.492564][ T58] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 153.492592][ T58] ? cfg80211_inform_single_bss_data+0x13c6/0x1b70 [ 153.492659][ T58] ? __lock_acquire+0x6b5/0x2cf0 [ 153.492699][ T58] ? unwind_next_frame+0xa5/0x23c0 [ 153.493047][ T58] ? unwind_next_frame+0xa5/0x23c0 [ 153.493073][ T58] ? unwind_next_frame+0x1aaf/0x23c0 [ 153.493100][ T58] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 153.493124][ T58] do_writepages+0x32e/0x550 [ 153.493158][ T58] ? reacquire_held_locks+0x104/0x190 [ 153.493183][ T58] ? writeback_sb_inodes+0x477/0x1a20 [ 153.493214][ T58] __writeback_single_inode+0x133/0x11a0 [ 153.493239][ T58] ? do_raw_spin_unlock+0xf5/0x210 [ 153.493267][ T58] writeback_sb_inodes+0x992/0x1a20 [ 153.493392][ T58] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 153.493431][ T58] ? do_raw_spin_lock+0x12b/0x2f0 [ 153.493481][ T58] ? rcu_is_watching+0x15/0xb0 [ 153.493514][ T58] wb_writeback+0x456/0xb70 [ 153.493541][ T58] ? queue_io+0x261/0x4a0 [ 153.493571][ T58] ? __pfx_wb_writeback+0x10/0x10 [ 153.493592][ T58] ? do_raw_spin_lock+0x12b/0x2f0 [ 153.493627][ T58] wb_workfn+0x414/0xf50 [ 153.493650][ T58] ? look_up_lock_class+0x57/0x110 [ 153.493682][ T58] ? __pfx_wb_workfn+0x10/0x10 [ 153.493828][ T58] ? do_raw_spin_lock+0x12b/0x2f0 [ 153.493855][ T58] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 153.493896][ T58] ? process_one_work+0x87c/0x1650 [ 153.493918][ T58] process_one_work+0x949/0x1650 [ 153.493962][ T58] ? __pfx_process_one_work+0x10/0x10 [ 153.493982][ T58] ? do_raw_spin_lock+0x12b/0x2f0 [ 153.494012][ T58] worker_thread+0xb46/0x1140 [ 153.494039][ T58] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 153.494079][ T58] kthread+0x388/0x470 [ 153.494098][ T58] ? __pfx_worker_thread+0x10/0x10 [ 153.494118][ T58] ? __pfx_kthread+0x10/0x10 [ 153.494138][ T58] ret_from_fork+0x51e/0xb90 [ 153.494388][ T58] ? __pfx_ret_from_fork+0x10/0x10 [ 153.494419][ T58] ? __switch_to+0xc7d/0x1450 [ 153.494443][ T58] ? __pfx_kthread+0x10/0x10 [ 153.494464][ T58] ret_from_fork_asm+0x1a/0x30 [ 153.494498][ T58] [ 153.800692][ T7399] loop2: detected capacity change from 0 to 131072 [ 153.816140][ T7399] F2FS-fs (loop2): Wrong CP boundary, start(512) end(198144) blocks(1024) [ 153.825918][ T7399] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 153.887442][ T7399] F2FS-fs (loop2): invalid crc value [ 153.912615][ T58] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 153.992695][ T7399] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 154.043548][ T7399] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 154.051992][ T7399] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 154.754421][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 154.813563][ T5884] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 154.954449][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 155.035333][ T5884] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 155.984960][ T7422] loop3: detected capacity change from 0 to 131072 [ 156.004579][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 156.018873][ T5884] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 156.031945][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 156.121172][ T7422] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 156.134166][ T10] usb 1-1: SerialNumber: syz [ 156.139432][ T5884] usb 2-1: config 1 interface 0 has no altsetting 0 [ 156.147273][ T7422] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 156.149107][ T7412] loop4: detected capacity change from 0 to 32768 [ 156.161517][ T5884] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 156.192921][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.224229][ T5884] usb 2-1: Product: syz [ 156.231486][ T5884] usb 2-1: Manufacturer: syz [ 156.271692][ T7412] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.434 (7412) [ 156.294842][ T5884] usb 2-1: SerialNumber: syz [ 156.333909][ T7418] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 156.342156][ T7418] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 156.344433][ T7412] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 156.415993][ T7412] BTRFS info (device loop4): using blake2b checksum algorithm [ 156.562528][ T7412] BTRFS info (device loop4): enabling ssd optimizations [ 156.602304][ T7412] BTRFS info (device loop4): turning on async discard [ 156.672621][ T7412] BTRFS info (device loop4): enabling free space tree [ 156.914018][ T10] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 157.023121][ T5817] BTRFS info (device loop4): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 157.249010][ T5913] usb 1-1: USB disconnect, device number 5 [ 157.300200][ T5913] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 157.452678][ T5884] (unnamed net_device) (uninitialized): Assigned a random MAC address: ee:1a:97:6c:32:5c [ 157.561188][ T5884] rtl8150 2-1:1.0: eth1: rtl8150 is detected [ 157.638403][ T5884] usb 2-1: USB disconnect, device number 5 [ 158.091083][ T7468] loop0: detected capacity change from 0 to 1024 [ 158.114142][ T7468] EXT4-fs: Ignoring removed orlov option [ 158.209306][ T7468] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 158.721599][ T7481] loop4: detected capacity change from 0 to 8192 [ 158.736989][ T29] audit: type=1326 audit(1772463367.217:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.3.452" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c7399c799 code=0x0 [ 158.775093][ T5818] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 158.945994][ T7481] FAT-fs (loop4): error, clusters badly computed (2 != 1) [ 158.987747][ T7481] FAT-fs (loop4): Filesystem has been set read-only [ 159.492236][ T7509] pim6reg1: entered promiscuous mode [ 159.513233][ T7509] pim6reg1: entered allmulticast mode [ 159.871740][ T7524] loop0: detected capacity change from 0 to 1024 [ 159.901235][ T7524] EXT4-fs: inline encryption not supported [ 159.938666][ T7524] EXT4-fs: Ignoring removed nobh option [ 159.961601][ T7524] EXT4-fs: Ignoring removed bh option [ 160.042373][ T7524] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 160.130894][ T7524] EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:4222: comm syz.0.461: Allocating blocks 257-513 which overlap fs metadata [ 160.258007][ T5818] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.446897][ T7540] pim6reg1: entered promiscuous mode [ 160.463110][ T7540] pim6reg1: entered allmulticast mode [ 160.825570][ T7554] loop1: detected capacity change from 0 to 512 [ 160.891003][ T7554] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=e040c01c, mo2=0002] [ 160.956477][ T7554] System zones: 0-2, 18-18, 34-35 [ 160.987835][ T7558] loop0: detected capacity change from 0 to 1764 [ 161.001070][ T7554] EXT4-fs error (device loop1): ext4_quota_enable:7192: inode #4: comm syz.1.472: iget: bad i_size value: 5910974510929920 [ 161.071514][ T7554] loop1: lost file I/O error report for ino 4 type 5 pos 0x0 len 0x0 error -117 [ 161.071887][ T7554] EXT4-fs error (device loop1): ext4_quota_enable:7195: comm syz.1.472: Bad quota inode: 4, type: 1 [ 161.086419][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 161.086450][ C0] EXT4-fs (loop1): initial error at time 1772463369: ext4_quota_enable:7192: inode 4 [ 161.086476][ C0] EXT4-fs (loop1): last error at time 1772463369: ext4_quota_enable:7192: inode 4 [ 161.168953][ T7554] loop1: lost filesystem error report for type 5 error -117 [ 161.169199][ T7554] EXT4-fs warning (device loop1): ext4_enable_quotas:7236: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 161.226298][ T7554] EXT4-fs (loop1): mount failed [ 161.409901][ T7566] loop3: detected capacity change from 0 to 512 [ 161.454820][ T7566] EXT4-fs: quotafile must be on filesystem root [ 161.519868][ T7568] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.478'. [ 161.574857][ T5884] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 161.745900][ T7577] syzkaller1: entered promiscuous mode [ 161.763741][ T7577] syzkaller1: entered allmulticast mode [ 161.796258][ T5884] usb 2-1: Using ep0 maxpacket: 16 [ 161.820117][ T5884] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.847447][ T5884] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.871661][ T5884] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 161.927721][ T5884] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 161.955665][ T7587] netlink: 'syz.4.484': attribute type 9 has an invalid length. [ 161.956249][ T5884] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.967988][ T7587] netlink: 'syz.4.484': attribute type 11 has an invalid length. [ 162.005563][ T7587] netlink: 'syz.4.484': attribute type 12 has an invalid length. [ 162.016706][ T5884] usb 2-1: config 0 descriptor?? [ 162.023746][ T7587] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.484'. [ 162.352685][ T7595] loop4: detected capacity change from 0 to 4096 [ 162.431245][ T7595] ntfs3(loop4): ino=5, "/" mi_enum_attr [ 162.439650][ T5884] hid_parser_main: 33 callbacks suppressed [ 162.439673][ T5884] microsoft 0003:045E:07DA.0006: unknown main item tag 0x6 [ 162.442731][ T7595] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 162.466421][ T5884] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 162.503531][ T5884] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 162.522825][ T5884] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 162.541131][ T5884] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 162.600879][ T7593] loop3: detected capacity change from 0 to 32768 [ 162.636493][ T7593] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.487 (7593) [ 162.649990][ T5884] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0006/input/input12 [ 162.758812][ T7593] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 162.770955][ T5884] microsoft 0003:045E:07DA.0006: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 162.803115][ T7593] BTRFS info (device loop3): using sha256 checksum algorithm [ 162.976341][ T7593] BTRFS info (device loop3): rebuilding free space tree [ 162.981880][ T5884] usb 2-1: USB disconnect, device number 6 [ 163.033364][ T7593] BTRFS info (device loop3): disabling free space tree [ 163.042276][ T7593] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 163.052801][ T7593] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 163.094035][ T7593] BTRFS info (device loop3): enabling ssd optimizations [ 163.111494][ T7593] BTRFS info (device loop3): turning on async discard [ 163.123147][ T7593] BTRFS info (device loop3): force clearing of disk cache [ 163.140621][ T7593] BTRFS info (device loop3): enabling auto defrag [ 163.144160][ T7600] loop0: detected capacity change from 0 to 4096 [ 163.155192][ T7593] BTRFS info (device loop3): max_inline set to 4096 [ 163.643805][ T5828] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 163.890948][ T7641] Invalid ELF header magic: != ELF [ 164.713872][ T7664] kvm: apic: phys broadcast and lowest prio [ 164.720824][ T7664] kvm: Disabled LAPIC found during irq injection [ 165.036674][ T7670] loop2: detected capacity change from 0 to 128 [ 165.057347][ T7655] loop1: detected capacity change from 0 to 32768 [ 165.091124][ T7655] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.508 (7655) [ 165.152660][ T7670] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 165.211837][ T7644] loop4: detected capacity change from 0 to 40427 [ 165.232713][ T7655] BTRFS info (device loop1): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 165.262736][ T7670] ext4 filesystem being mounted at /111/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 165.304491][ T7644] f2fs: Unknown parameter 'ÿÿÿÿÿÿÿ' [ 165.317532][ T7665] loop3: detected capacity change from 0 to 32768 [ 165.360774][ T7655] BTRFS info (device loop1): using crc32c checksum algorithm [ 165.399336][ T7655] BTRFS warning (device loop1): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 165.425388][ T7665] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.512 (7665) [ 165.442420][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 165.557328][ T7665] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 165.605434][ T5819] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 165.623784][ T7665] BTRFS info (device loop3): using sha256 checksum algorithm [ 165.718179][ T7655] BTRFS info (device loop1): rebuilding free space tree [ 165.776812][ T7655] BTRFS info (device loop1): disabling free space tree [ 165.831866][ T7665] BTRFS info (device loop3): enabling ssd optimizations [ 165.839722][ T7665] BTRFS info (device loop3): turning on async discard [ 165.844697][ T7655] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 165.848219][ T7665] BTRFS info (device loop3): enabling free space tree [ 165.954784][ T7655] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 166.099646][ T7655] BTRFS info (device loop1): enabling ssd optimizations [ 166.155802][ T7655] BTRFS info (device loop1): turning on async discard [ 166.175964][ T7665] evm: overlay not supported [ 166.186343][ T7655] BTRFS info (device loop1): enabling disk space caching [ 166.212041][ T7655] BTRFS info (device loop1): force clearing of disk cache [ 166.283707][ T7655] BTRFS info (device loop1): use zstd compression, level 3 [ 166.484092][ T5828] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 166.505398][ T7716] sctp: [Deprecated]: syz.4.518 (pid 7716) Use of int in max_burst socket option. [ 166.505398][ T7716] Use struct sctp_assoc_value instead [ 166.653629][ T5820] BTRFS info (device loop1): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 166.788424][ T7725] netlink: 8 bytes leftover after parsing attributes in process `syz.4.523'. [ 166.834590][ T7725] netlink: 8 bytes leftover after parsing attributes in process `syz.4.523'. [ 166.852700][ T10] kernel read not supported for file /vcs (pid: 10 comm: kworker/0:1) [ 166.909608][ T7725] Zero length message leads to an empty skb [ 166.929145][ T7729] netlink: 8 bytes leftover after parsing attributes in process `syz.2.525'. [ 167.151404][ T7733] Invalid ELF header magic: != ELF [ 167.291952][ T7735] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 167.596417][ T7747] loop3: detected capacity change from 0 to 4096 [ 167.617748][ T7747] ntfs3(loop3): Different NTFS sector size (4096) and media sector size (512). [ 167.629465][ T7744] loop2: detected capacity change from 0 to 4096 [ 167.681143][ T7744] EXT4-fs (loop2): Test dummy encryption mode enabled [ 167.725054][ T7744] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0103] [ 167.752098][ T7744] System zones: 0-5 [ 167.791685][ T7744] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 167.873745][ T7747] ntfs3(loop3): Inode r=19 is not in use! [ 167.903774][ T7747] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 167.985834][ T7747] ntfs3(loop3): Failed to initialize $Extend/$Reparse. [ 168.045586][ T5819] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 168.125199][ T7747] ntfs3(loop3): ino=1b, mi_enum_attr [ 168.173733][ T7747] ntfs3(loop3): ino=1b, mi_enum_attr [ 168.367750][ T7746] loop4: detected capacity change from 0 to 32768 [ 168.412041][ T7746] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.532 (7746) [ 168.485372][ T7746] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 168.522616][ T7746] BTRFS info (device loop4): using sha256 checksum algorithm [ 168.534540][ T7771] TCP: TCP_TX_DELAY enabled [ 168.697318][ T7746] BTRFS info (device loop4): enabling ssd optimizations [ 168.725585][ T7746] BTRFS info (device loop4): turning on async discard [ 168.756970][ T7746] BTRFS info (device loop4): enabling free space tree [ 168.788104][ T7746] BTRFS info (device loop4): enabling auto defrag [ 168.805233][ T7746] BTRFS info (device loop4): max_inline set to 4096 [ 168.961254][ T7798] loop1: detected capacity change from 0 to 1024 [ 169.042408][ T5817] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 169.061984][ T7798] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 169.650121][ T7794] loop2: detected capacity change from 0 to 32768 [ 169.713780][ T7794] XFS (loop2): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 169.882370][ T7794] XFS (loop2): Ending clean mount [ 169.911485][ T7794] XFS (loop2): Quotacheck needed: Please wait. [ 169.999369][ T7794] XFS (loop2): Quotacheck: Done. [ 170.108752][ T5819] XFS (loop2): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 170.199344][ T29] audit: type=1800 audit(1772463378.677:31): pid=7827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.553" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 170.757357][ T7840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.559'. [ 170.846882][ T7846] netlink: 4 bytes leftover after parsing attributes in process `syz.4.562'. [ 171.160272][ T7864] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 171.169133][ T7864] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 171.185705][ T7864] vhci_hcd vhci_hcd.0: Device attached [ 171.196828][ T5913] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 171.254055][ T7869] netlink: 8 bytes leftover after parsing attributes in process `syz.2.570'. [ 171.264927][ T7869] netlink: 4 bytes leftover after parsing attributes in process `syz.2.570'. [ 171.285083][ T13] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 171.285511][ T7869] netlink: 8 bytes leftover after parsing attributes in process `syz.2.570'. [ 171.297433][ T13] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 171.316217][ T13] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 171.316334][ T7869] netlink: 4 bytes leftover after parsing attributes in process `syz.2.570'. [ 171.326792][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 171.397640][ T5913] usb 4-1: config 150 has an invalid interface number: 204 but max is 1 [ 171.407805][ T5913] usb 4-1: config 150 has no interface number 0 [ 171.423529][ T5913] usb 4-1: config 150 interface 204 has no altsetting 0 [ 171.423760][ T10] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 171.443597][ T5884] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 171.464340][ T5913] usb 4-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 171.476802][ T7871] loop2: detected capacity change from 0 to 4096 [ 171.485664][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.512373][ T5913] usb 4-1: Product: syz [ 171.524855][ T5913] usb 4-1: Manufacturer: syz [ 171.547081][ T5913] usb 4-1: SerialNumber: syz [ 171.610833][ T5884] usb 5-1: config 0 has no interfaces? [ 171.619374][ T5884] usb 5-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 171.640349][ T5884] usb 5-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 171.660873][ T5884] usb 5-1: Manufacturer: syz [ 171.678890][ T5884] usb 5-1: config 0 descriptor?? [ 171.785403][ T5913] xr_serial 4-1:150.204: xr_serial converter detected [ 171.890481][ T7865] usb 41-1: recv xbuf, 0 [ 171.899783][ T5884] usb 5-1: USB disconnect, device number 4 [ 171.937493][ T86] vhci_hcd vhci_hcd.4: stop threads [ 171.952580][ T86] vhci_hcd vhci_hcd.4: release socket [ 171.965741][ T86] vhci_hcd vhci_hcd.4: disconnect device [ 172.013639][ T10] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 172.083037][ T7877] loop1: detected capacity change from 0 to 1024 [ 172.135475][ T5892] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 172.246140][ T86] hfsplus: b-tree write err: -5, ino 3 [ 172.295480][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 172.320837][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.332949][ T5892] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 172.343647][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.356395][ T5892] usb 1-1: config 0 descriptor?? [ 172.399033][ T5820] hfsplus: node 4:3 still has 1 user(s)! [ 172.601359][ T5913] xr_serial ttyUSB0: Failed to set reg 0x0e: -71 [ 172.618071][ T5913] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 172.649960][ T5913] usb 4-1: USB disconnect, device number 7 [ 172.677247][ T5913] xr_serial 4-1:150.204: device disconnected [ 172.833609][ T5884] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 172.876881][ T7884] block nbd1: shutting down sockets [ 172.974009][ T5892] usb 1-1: language id specifier not provided by device, defaulting to English [ 173.006340][ T5884] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 173.036947][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 173.057235][ T5884] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 173.080607][ T5884] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 173.092151][ T5884] usb 5-1: Manufacturer: syz [ 173.103128][ T5884] usb 5-1: config 0 descriptor?? [ 173.244181][ T5884] rc_core: IR keymap rc-hauppauge not found [ 173.262429][ T5884] Registered IR keymap rc-empty [ 173.285623][ T5884] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 173.310755][ T5884] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input13 [ 173.341379][ T7897] syzkaller1: entered promiscuous mode [ 173.358154][ T7897] syzkaller1: entered allmulticast mode [ 173.593385][ T5892] uclogic 0003:256C:006D.0007: failed retrieving string descriptor #100: -71 [ 173.626564][ T7906] Illegal XDP return value 128 on prog (id 26) dev syz_tun, expect packet loss! [ 173.627329][ T5892] uclogic 0003:256C:006D.0007: failed retrieving pen parameters: -71 [ 173.683545][ T5892] uclogic 0003:256C:006D.0007: failed probing pen v1 parameters: -71 [ 173.693379][ T5892] uclogic 0003:256C:006D.0007: failed probing parameters: -71 [ 173.702459][ T5892] uclogic 0003:256C:006D.0007: probe with driver uclogic failed with error -71 [ 173.744877][ T5892] usb 1-1: USB disconnect, device number 6 [ 173.862281][ T5913] usb 5-1: USB disconnect, device number 5 [ 174.129988][ T5892] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 174.320464][ T5892] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 174.352196][ T5892] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 174.372944][ T5892] usb 4-1: config 1 has no interface number 0 [ 174.390259][ T5892] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 174.417582][ T5892] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 174.435470][ T5892] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 174.496464][ T5892] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 174.524220][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.543939][ T5892] usb 4-1: Product: syz [ 174.567986][ T5892] usb 4-1: Manufacturer: syz [ 174.592337][ T5892] usb 4-1: SerialNumber: syz [ 174.625217][ T7913] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 175.043563][ T5830] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 175.084279][ T7913] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 175.134685][ T7948] kvm: MWAIT instruction emulated as NOP! [ 175.213951][ T5830] usb 5-1: Using ep0 maxpacket: 32 [ 175.230919][ T5830] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 175.251957][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.283785][ T5830] usb 5-1: config 0 descriptor?? [ 175.369600][ T7953] netlink: 'syz.2.606': attribute type 3 has an invalid length. [ 175.377787][ T7955] loop0: detected capacity change from 0 to 64 [ 175.427545][ T7955] overlayfs: upper fs needs to support d_type. [ 175.442471][ T7955] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 175.450811][ T7955] overlayfs: failed to set xattr on upper [ 175.459638][ T7955] overlayfs: ...falling back to redirect_dir=nofollow. [ 175.468059][ T7955] overlayfs: ...falling back to index=off. [ 175.474783][ T7955] overlayfs: ...falling back to uuid=null. [ 175.500701][ T5830] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 175.534051][ T5892] cdc_ncm 4-1:1.1: bind() failure [ 175.585639][ T5830] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 175.611135][ T5830] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 175.647535][ T5830] usb 5-1: media controller created [ 175.709492][ T5830] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 175.737980][ T24] usb 4-1: USB disconnect, device number 8 [ 175.853688][ T5830] az6027: usb out operation failed. (-71) [ 175.882024][ T5830] az6027: usb out operation failed. (-71) [ 175.905374][ T5830] stb0899_attach: Driver disabled by Kconfig [ 175.933804][ T5830] az6027: no front-end attached [ 175.933804][ T5830] [ 175.962063][ T5830] az6027: usb out operation failed. (-71) [ 175.972168][ T5830] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 176.007832][ T5830] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input14 [ 176.048085][ T5830] dvb-usb: schedule remote query interval to 400 msecs. [ 176.071109][ T5830] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 176.104757][ T5830] usb 5-1: USB disconnect, device number 6 [ 176.282855][ T5830] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 176.495025][ T7980] netlink: 104 bytes leftover after parsing attributes in process `syz.2.619'. [ 176.524862][ T7982] loop0: detected capacity change from 0 to 64 [ 176.596820][ T29] audit: type=1800 audit(1772463385.077:32): pid=7982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.620" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 176.745225][ T7960] loop1: detected capacity change from 0 to 32768 [ 176.777107][ T7960] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.610 (7960) [ 176.911475][ T7960] BTRFS info (device loop1): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 176.962842][ T7960] BTRFS info (device loop1): using crc32c checksum algorithm [ 176.988444][ T7960] BTRFS warning (device loop1): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 177.188700][ T7960] BTRFS info (device loop1): rebuilding free space tree [ 177.263954][ T10] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 177.296749][ T7960] BTRFS info (device loop1): disabling free space tree [ 177.320911][ T7960] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 177.366550][ T7960] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 177.444440][ T7960] BTRFS info (device loop1): enabling ssd optimizations [ 177.483214][ T7960] BTRFS info (device loop1): turning on async discard [ 177.492592][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 177.533552][ T7960] BTRFS info (device loop1): enabling disk space caching [ 177.533552][ T10] usb 4-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 177.533580][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.536153][ T10] usb 4-1: config 0 descriptor?? [ 177.583884][ T7960] BTRFS info (device loop1): force clearing of disk cache [ 177.601962][ T7960] BTRFS info (device loop1): use zstd compression, level 3 [ 177.660726][ T10] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 177.737539][ T8027] netlink: 'syz.4.629': attribute type 29 has an invalid length. [ 177.806582][ T8027] netlink: 'syz.4.629': attribute type 29 has an invalid length. [ 177.882128][ T5820] BTRFS info (device loop1): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 177.901342][ T8030] netlink: 500 bytes leftover after parsing attributes in process `syz.4.629'. [ 178.011379][ T29] audit: type=1804 audit(1772463386.477:33): pid=7982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.620" name="/newroot/115/file0/file1" dev="loop0" ino=22 res=1 errno=0 [ 178.093726][ T29] audit: type=1800 audit(1772463386.487:34): pid=7982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.620" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 178.125917][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 178.154959][ T8035] netlink: 'syz.4.632': attribute type 12 has an invalid length. [ 178.176018][ T8035] netlink: 'syz.4.632': attribute type 29 has an invalid length. [ 178.246247][ T8035] netlink: 148 bytes leftover after parsing attributes in process `syz.4.632'. [ 178.375188][ T10] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 178.410984][ T10] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 178.464846][ T10] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 178.517165][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.568882][ T8029] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 178.600455][ T10] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 178.721955][ T29] audit: type=1326 audit(1772463387.197:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8046 comm="syz.0.636" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f85bb39c799 code=0x0 [ 178.801546][ T5913] IPVS: starting estimator thread 0... [ 178.915315][ T8059] loop1: detected capacity change from 0 to 512 [ 178.933572][ T8056] IPVS: using max 34 ests per chain, 81600 per kthread [ 179.058758][ T10] usb 3-1: USB disconnect, device number 6 [ 179.310138][ T8072] loop1: detected capacity change from 0 to 16 [ 179.332494][ T8072] erofs (device loop1): mounted with root inode @ nid 36. [ 179.348417][ T29] audit: type=1800 audit(1772463387.827:36): pid=8072 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.641" name="file1" dev="loop1" ino=86 res=0 errno=0 [ 179.495505][ T8077] input: syz0 as /devices/virtual/input/input15 [ 179.805769][ T8088] loop2: detected capacity change from 0 to 512 [ 179.946469][ T8088] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 180.087328][ T5830] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 180.111271][ T10] usb 4-1: USB disconnect, device number 9 [ 180.118965][ T5830] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 180.862068][ T5819] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 181.101484][ T8104] loop3: detected capacity change from 0 to 32768 [ 181.169279][ T8104] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 181.171402][ T58] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 181.223960][ T8104] XFS (loop3): Ending clean mount [ 181.227271][ T58] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.268704][ T8104] XFS (loop3): Quotacheck needed: Please wait. [ 181.324626][ T5913] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 181.392193][ T8104] XFS (loop3): Quotacheck: Done. [ 181.412354][ T58] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 181.434757][ T58] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.533567][ T5913] usb 1-1: Using ep0 maxpacket: 8 [ 181.555548][ T5913] usb 1-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 181.571197][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 181.580871][ T5913] usb 1-1: Product: syz [ 181.586950][ T5913] usb 1-1: Manufacturer: syz [ 181.604748][ T5913] usb 1-1: SerialNumber: syz [ 181.623322][ T5913] usb 1-1: config 0 descriptor?? [ 181.657447][ T58] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 181.676143][ T5828] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 181.684132][ T58] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.686877][ T5913] gspca_main: sq905-2.14.0 probing 2770:9120 [ 181.715403][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 181.732908][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 181.748031][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 181.759439][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 181.769520][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 182.012633][ T58] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 182.039829][ T58] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.093693][ T8137] netlink: 'syz.1.664': attribute type 2 has an invalid length. [ 182.493962][ T5884] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 182.669311][ T5913] gspca_sq905: bulk read fail (-22) len 0/4 [ 182.685903][ T5884] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 182.713479][ T5884] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 182.787061][ T5884] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 182.842900][ T5884] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 182.896604][ T5884] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.997799][ T5884] usb 4-1: config 0 descriptor?? [ 183.190514][ T8133] chnl_net:caif_netlink_parms(): no params data found [ 183.535086][ T5884] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 183.625578][ T5913] sq905 1-1:0.0: probe with driver sq905 failed with error -5 [ 183.824043][ T5826] Bluetooth: hci2: command tx timeout [ 183.843663][ T58] bridge_slave_1: left allmulticast mode [ 183.875044][ T58] bridge_slave_1: left promiscuous mode [ 183.883854][ T58] bridge0: port 2(bridge_slave_1) entered disabled state [ 184.016371][ T58] bridge_slave_0: left allmulticast mode [ 184.023228][ T58] bridge_slave_0: left promiscuous mode [ 184.070488][ T58] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.596640][ T8157] loop4: detected capacity change from 0 to 262144 [ 184.612537][ T8157] BTRFS: device fsid 7e32c2af-f87a-45a1-bcba-64dea7c56a53 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.670 (8157) [ 184.638390][ T8157] BTRFS info (device loop4): first mount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53 [ 184.649846][ T8157] BTRFS info (device loop4): using xxhash64 checksum algorithm [ 184.674244][ T5913] usb 1-1: USB disconnect, device number 7 [ 184.899430][ T8157] BTRFS info (device loop4): deleted orphan free space tree entries [ 184.909382][ T8157] BTRFS info (device loop4): checking UUID tree [ 184.919988][ T8157] BTRFS info (device loop4): enabling ssd optimizations [ 184.930950][ T8157] BTRFS info (device loop4): turning on async discard [ 184.939407][ T8157] BTRFS info (device loop4): enabling free space tree [ 185.027582][ T8157] BTRFS info (device loop4): balance: start -dlimit=1..0,stripes=0..0 -mlimit=1..0,stripes=0..0 -slimit=1..0,stripes=0..0 [ 185.064040][ T8157] BTRFS info (device loop4): relocating block group 30408704 flags metadata|dup [ 185.157362][ T8157] BTRFS info (device loop4): found 3 extents, stage: move data extents [ 185.201828][ T8157] BTRFS info (device loop4): balance: canceled [ 185.253246][ T5817] BTRFS info (device loop4): last unmount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53 [ 185.378574][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 185.435576][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 185.516057][ T58] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 185.527591][ T5884] usb 4-1: USB disconnect, device number 10 [ 185.600668][ T58] bond0 (unregistering): Released all slaves [ 185.741925][ T8133] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.768294][ T8133] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.796342][ T8133] bridge_slave_0: entered allmulticast mode [ 185.839093][ T8133] bridge_slave_0: entered promiscuous mode [ 185.884755][ T8133] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.904126][ T5826] Bluetooth: hci2: command tx timeout [ 185.943365][ T8133] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.979658][ T8133] bridge_slave_1: entered allmulticast mode [ 186.006477][ T8133] bridge_slave_1: entered promiscuous mode [ 186.517328][ T8133] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.581214][ T8133] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.695949][ T8216] loop3: detected capacity change from 0 to 40427 [ 186.712845][ T8220] loop1: detected capacity change from 0 to 32768 [ 186.739895][ T8216] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 186.770074][ T8216] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 186.813483][ T29] audit: type=1800 audit(1772463395.287:37): pid=8220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.682" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 186.864946][ T8216] F2FS-fs (loop3): invalid crc value [ 187.042180][ T8220] ERROR: (device loop1): dbAlloc: the hint is outside the map [ 187.042180][ T8220] [ 187.139180][ T8133] team0: Port device team_slave_0 added [ 187.165835][ T8220] ERROR: (device loop1): remounting filesystem as read-only [ 187.181303][ T8133] team0: Port device team_slave_1 added [ 187.182702][ T8216] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 187.213717][ T8220] ialloc: diAlloc returned -5! [ 187.323579][ T8216] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 187.357884][ T8216] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 187.397949][ T8133] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 187.434070][ T8133] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 187.503757][ T8133] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 187.550935][ T58] hsr_slave_0: left promiscuous mode [ 187.571960][ T58] hsr_slave_1: left promiscuous mode [ 187.613765][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 187.664909][ T58] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 187.766168][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 187.791704][ T58] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 187.858986][ T58] veth1_macvtap: left promiscuous mode [ 187.895186][ T58] veth0_macvtap: left promiscuous mode [ 187.901281][ T58] veth1_vlan: left promiscuous mode [ 187.978969][ T58] veth0_vlan: left promiscuous mode [ 187.993535][ T51] Bluetooth: hci2: command tx timeout [ 188.199445][ T8257] loop0: detected capacity change from 0 to 256 [ 189.013020][ T8280] loop3: detected capacity change from 0 to 64 [ 189.090081][ T8283] netlink: 'syz.4.699': attribute type 21 has an invalid length. [ 189.134615][ T8283] netlink: 'syz.4.699': attribute type 22 has an invalid length. [ 189.158702][ T8283] netlink: 'syz.4.699': attribute type 23 has an invalid length. [ 189.189149][ T8283] netlink: 'syz.4.699': attribute type 25 has an invalid length. [ 189.220506][ T8283] netlink: 'syz.4.699': attribute type 26 has an invalid length. [ 189.252673][ T8283] netlink: 16 bytes leftover after parsing attributes in process `syz.4.699'. [ 189.274741][ T58] team0 (unregistering): Port device team_slave_1 removed [ 189.367407][ T58] team0 (unregistering): Port device team_slave_0 removed [ 189.462427][ T8290] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 189.854954][ T8295] netlink: 27 bytes leftover after parsing attributes in process `syz.1.704'. [ 190.063980][ T51] Bluetooth: hci2: command tx timeout [ 190.145587][ T8133] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.195978][ T8133] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.284385][ C1] list_del corruption, ffff8880591e2490->next is NULL [ 190.288106][ T8133] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 190.294031][ C1] ------------[ cut here ]------------ [ 190.311171][ C1] kernel BUG at lib/list_debug.c:53! [ 190.317638][ C1] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 190.326020][ C1] CPU: 1 UID: 0 PID: 23 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT(full) [ 190.339356][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 190.352525][ C1] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 [ 190.361349][ C1] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 52 5c f8 06 cc 48 c7 c7 a0 e8 27 8c 48 89 de e8 12 51 6e fc 90 <0f> 0b 48 c7 c7 00 e9 27 8c 48 89 de e8 00 51 6e fc 90 0f 0b 4c 89 [ 190.385958][ C1] RSP: 0018:ffffc900001d7af8 EFLAGS: 00010046 [ 190.394049][ C1] RAX: 0000000000000033 RBX: ffff8880591e2490 RCX: 10965ebf21b96d00 [ 190.403684][ C1] RDX: 0000000000000100 RSI: 0000000080000101 RDI: 0000000000000000 [ 190.413731][ C1] RBP: 0000000000000203 R08: ffffc900001d7887 R09: 1ffff9200003af10 [ 190.423227][ C1] R10: dffffc0000000000 R11: fffff5200003af11 R12: 1ffff1100b23c492 [ 190.433465][ C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 190.442943][ C1] FS: 0000000000000000(0000) GS:ffff888125557000(0000) knlGS:0000000000000000 [ 190.454732][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 190.464109][ C1] CR2: 00007f68bcd4da08 CR3: 000000007f38e000 CR4: 00000000003526f0 [ 190.474146][ C1] Call Trace: [ 190.479443][ C1] [ 190.483678][ C1] dst_destroy+0x202/0x5a0 [ 190.488556][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 190.496199][ C1] ? rcu_core+0x751/0x1070 [ 190.501088][ C1] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 190.506960][ C1] rcu_core+0x7cd/0x1070 [ 190.512502][ C1] ? __pfx_rcu_core+0x10/0x10 [ 190.517495][ C1] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 190.525492][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 190.530875][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 190.537056][ C1] handle_softirqs+0x22a/0x870 [ 190.541844][ C1] ? schedule+0x90/0x360 [ 190.546430][ C1] ? run_ksoftirqd+0x36/0x60 [ 190.551379][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 190.556591][ C1] run_ksoftirqd+0x36/0x60 [ 190.562176][ C1] smpboot_thread_fn+0x541/0xa50 [ 190.567205][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 190.572769][ C1] kthread+0x388/0x470 [ 190.577174][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 190.582899][ C1] ? __pfx_kthread+0x10/0x10 [ 190.588596][ C1] ret_from_fork+0x51e/0xb90 [ 190.593788][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 190.599255][ C1] ? __switch_to+0xc7d/0x1450 [ 190.604389][ C1] ? __pfx_kthread+0x10/0x10 [ 190.609276][ C1] ret_from_fork_asm+0x1a/0x30 [ 190.614381][ C1] [ 190.617758][ C1] Modules linked in: [ 190.621841][ C1] ---[ end trace 0000000000000000 ]--- [ 190.628175][ C1] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 [ 190.636795][ C1] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 52 5c f8 06 cc 48 c7 c7 a0 e8 27 8c 48 89 de e8 12 51 6e fc 90 <0f> 0b 48 c7 c7 00 e9 27 8c 48 89 de e8 00 51 6e fc 90 0f 0b 4c 89 [ 190.661938][ C1] RSP: 0018:ffffc900001d7af8 EFLAGS: 00010046 [ 190.669324][ C1] RAX: 0000000000000033 RBX: ffff8880591e2490 RCX: 10965ebf21b96d00 [ 190.677724][ C1] RDX: 0000000000000100 RSI: 0000000080000101 RDI: 0000000000000000 [ 190.686944][ C1] RBP: 0000000000000203 R08: ffffc900001d7887 R09: 1ffff9200003af10 [ 190.695911][ C1] R10: dffffc0000000000 R11: fffff5200003af11 R12: 1ffff1100b23c492 [ 190.705221][ C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 190.714145][ C1] FS: 0000000000000000(0000) GS:ffff888125557000(0000) knlGS:0000000000000000 [ 190.723894][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 190.731681][ C1] CR2: 00007f68bcd4da08 CR3: 000000007f38e000 CR4: 00000000003526f0 [ 190.739754][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 191.847340][ C1] Shutting down cpus with NMI [ 191.854181][ C1] Kernel Offset: disabled [ 191.859483][ C1] Rebooting in 86400 seconds..