last executing test programs: 21m55.245873008s ago: executing program 32 (id=38): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000)={0x6, 0x0, 0x6, 0x691}, 0x10) sendto$inet6(r1, &(0x7f0000000200)='x', 0x1, 0x4000000, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000006c0)={0x0, 0x2}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000640), 0x8) 21m38.700705745s ago: executing program 33 (id=45): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000001400350076657468305f6d614176746170000000140035006d61637674617030020000000000000014003500677265300000000000000000000000001400350076657468305f746f5f626174616476001400350001657468315f6d6163767461700000001400350067726530000000000000000000000000140035006261746164765f736c6176655f31000008000f"], 0xe8}}, 0x0) close(r0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, 0x0) ioperm(0x800000000, 0x10001, 0x7) 21m25.977881593s ago: executing program 34 (id=80): r0 = io_uring_setup(0x68f7, &(0x7f00000002c0)={0x0, 0x48c7, 0x80, 0x0, 0x8100016b}) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r1, 0x0, 0xc) close(0x3) close_range(r0, 0xffffffffffffffff, 0x0) 21m17.712593719s ago: executing program 35 (id=140): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x3, 0x2, 0x6], [0x6, 0x7, 0x1, 0x5, 0x80000000008002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0xffffffffffffffff, 0xfffffffffffffff4, 0x4a, 0x5, 0x2a3b, 0xc, 0xdd, 0x5, 0x1, 0x2a6, 0x2000000003, 0xc3d, 0x8000003, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x2, 0x800000000000001, 0x7, 0xfffffffffffffffb, 0x81, 0x100, 0x5, 0x931, 0x101, 0x3, 0xf, 0x8000000000000000, 0x7, 0x1, 0x8, 0x7, 0x6a8, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x3, 0x8000000000000000, 0x5, 0x9, 0x80008000, 0x8000000000000000, 0x40000000000004, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5bc, 0x1, 0x0, 0x4, 0x8000, 0xc9, 0x7, 0x6, 0x9, 0x82c, 0x8000, 0xe000000000000, 0x8f, 0x11, 0x0, 0x8, 0x26, 0xffffffffffffffff, 0x7, 0xbfa, 0x8000000000000000, 0x2000000009, 0x8, 0x0, 0x6, 0x6, 0x7, 0x100000002, 0x4, 0x4, 0x7, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x1, 0x300000003, 0x5, 0x7, 0x406, 0x3, 0x6, 0x5, 0xbf4, 0x3, 0x10000, 0x7fffffff, 0x7, 0x3, 0x1]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084) r0 = io_uring_setup(0x897, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 20m27.831717283s ago: executing program 36 (id=358): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000640)='./file0\x00', 0x400808, &(0x7f0000000900)={[{@nojournal_checksum}, {@nolazytime}, {@inlinecrypt}, {@jqfmt_vfsv0}, {@min_batch_time={'min_batch_time', 0x3d, 0x9}}, {@grpjquota}, {@test_dummy_encryption}]}, 0x3, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 20m15.638154131s ago: executing program 37 (id=385): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000063c0)="6b08bd694cd73315497c044f6282e4886cb9eac5d9a1ee3fea1026f5c5639d935c13fd6993521609846271e668356c7adb67edfbd934b26f5a09c3b1fad40939926e23f26026401224267b5d3d2bd0562a8e84c1f3b255e6a8153ef6d8811e5a97d21a1977d1f643a0e1e6da36f81e6f568b67e548c8f30babc385c48cec91ee871661492cf6b3097af13e61ecc78a648e86cd6149da25185acb128266e9bc49573247e6be64c6960d85453c5a5d3a037613f40f9756cfd7a1485fb0a518b40843714c848071050fe0a2b1933df929345c63d5764a350540f2ef3ca96a5422714240985a2fecc4596e57922db204a68085c64d8dcebbee96b97c22f12146a1014d06ef9064137bbe2b3450b0c82e4a806cdcaf99341ee2f9c1bc475a4b798cbd616906f27be31d06d75dafc57318e90bfee500c7534cf3b77f1ced5a23e219e5e4865091cb7455a635f37c60f1254206af064fa6bf4a0d23e43b8e8d57bb52284515fb73ce016b9b2ba3b86f1f193837fd0209f2f2abef2359ae34e67277918b93a82a70c05397b91be761e7b6c516afa978e3dbc18071e0488bfed15582000e05731b8527bf797de299a54d3fb01b4f54b497502925fef74ca6c3f16be2ca428cea7c6c453c75bd6bf6e48341ecca87fad1d478461a64c05c165172d6893ab1c12a0be785743ec3d4409976b96d0cd59a78e887dc5311407b8fe1ee3b6d9da6057cdf7751c37823885482bf596fe6b273bbdaf50903bb3b70cec447c6ec5f05f2bdd5ccedf737bb53adcd52cbb2f2adedb32af313d97f2c25519bfd718265f1d9e52a0d3937a800d93033149b0a83779f568cf76cfd30011cc634531703e0ad0f6d6f9b7df360579fe88bf10f3c44bfe230dad514bc4156ab51997dd3bcad954bfa6c9d4509b57385cb959d1cdff16cf280a404a572c2f2c3de985bbcc0fea81ecd6a430202939507c4e93bfc25d82a9d8a340f377ca62193218f7ecf5d0ab3216fcd0e221f699fd93381faea8a5120cef4d0c43539482180f0bb7070d3db519d5c1a006efa23deb19b773d3961edc8388f8c54c1ab8c988fe6c2ff5f75b66307e15ea7eca3ea1ec5c0cb3c4b767014bafa8b76cd209a1a6be80428d80d782a23c0405b670f129bdd22620141ef21bb69c7342002f2382aab8f5638a7ee2435ed850d5adfd733ed84b87f4d021703ebb72673f9c928cd617cfc21545a3d0bd07e8ee6f10be7bb5c366d76fc8161844d8abe06a3b960ec2114e742d66a9cfaa629e92356b932c219b35b170c96bcc8ab7a4cc1c0ea39c035907325b87f35c4d5f343126f79fa19f8e63f3f8a80fec7aeae6e742a8e0f2577d1955140f74f4e1e3f99fd0211a317d2c44b91af97089508b62b62c0ba1142c34d0e1af4717b15e5c8f9649018ccf36408e2d87136868385ca8137dc81dfdb6b6aaf6cccbf3970f33b5315b3143b286f32353402b07bc40b179f3288cceb9a37c589b2371e16b9fdfe3667d1b343dd06104f6b4515a29572fbf8388775cbd06fb22f94398a7ba0e2e674aeb99440b60c6a450610a5b3c3bfadd60de9adf017ae7c66a7bbba9fbe0867979dc5bc414b56b5ffbb7ac441ef7f8c5984f0f4c7222c2bfab53ce9e067770a608bf49bf11c3fcfe2390e895d49e75953dc362f385ee76b4e59888ffcaea291a55afbf792399a66c387c1c203ac642c7f3b7e6ca9fc36be1a92578d61acd61b1e09f11dee67c55f5c87617d3c0f304e1a6e12be52fac3245dc9646c449de10322c8a8c97085c88ee2ab36d363e808666cfd0a03dabfb642a13d9432342ea15335c439de1574e23053eb69f298640d7d6f624d30ba5cbb90c2b30460bb2ee67ae5ae54a8368a746a46839dc1703687f1cefa9c0afc645ef6cbc0dc18f0f433ce16f9a68198aa810b2a6cce9a7744d87272c9706521d945f22d4466855c16cba10c7df98c980fdd6f48a2f3322ab37803f30e6be5575cb63eb92793883c6c133fcdb4ec000763004e8dfbf62b0a9cd13f3e818ee6d31cc7cf261ae0fcae92366c67adbb0d6225e3a0eb9b5ba092e766c8049e2323c5f3b6968718e2feced42bf312704665280632a3341713b912ae379521c2c35209107cada232f2fe77e3381971702744806cad1e3b6a602034f0172dc4e2b2e189a6153bb49b2b6b9839db4c78dc77051cd3a5f6822bbe93f9e3dd0fc75f5349048c45788294e3b940b6a4a67b7273f0478c210721724b0cf6c3e411dca66865ebf9d882843af519d755ff81565e1269fe606d40cf3df6629b75beb405f27a855c04143177f72c080a6a802b8725ddab8e900c7a2730f4e14a672e6ad3944ae427cfd467227fc109eb27b2ae6ac4c1afc35d6c05aaff3c361dae680c775429b7d077152fe3c78672cbed8245eef816ce9ce0870cd536c094c06d400d7a505bac2411a24948a656fb5e9b4ffd66c95a656e1ca9b55102dc24ee4d60847703650e8855312d597000f42089b99821155db56e49df5ee6b0bc4f485e3c8cf6a7a05fa368d8fc77c4f95ccfd781bc88c0da451b240cd8c3755e2e18fd655b87f64820015391c088dab91f40cffefb19b97d41b0c9eca1ffe41120c87104be158d30c6eb0bb07fd086de90aad7c607da856fd9eab387bb2dbb0e5901dfbb6c7f6062ed29b4a30e7e646f2b913dc8f4793fd190f93f34671de1e9c46c18e8f08ed45597084921ce2e2b90af0f30e11418273c806f9b3a1aebbf403140731980a907cfbe13225337c586172d2a507d7e051dd6c26152823f9cb161feb6a45ff40f5e5e37a8e2d2b4513bbb1caa8b0e4c8a73ddf3bb0281eaeb3bd981aed79e430bd2afb1c1245b63dce58a1890028c2e3964036c7188a3bf284f9b0a90f1c8f819affc31d136190679c7ad6ae27fcba339b2b402858609c398d3648c44359f865babe3a038d1ba93f0a6742d0244f078cbce5c702634f7c5d79c93cbce776420bddd0b87522c768fd4f1e28803018a762f3cd2b1339829ecea30a71380c2058bea8d66f97f00ef3c575826a693dd2c3448f6657fc0ceab26393cf8680e6f4d9053cc88d51d3fb7b7fb019b2a7b10bf636202c59d242950434079388673f441beba818d277a481ebf55e0d8178740f46fdfbc71ce1e80632374bce9b3a2e904837180a233c67684fa37c8b96c6937d0e61aec0aecc8b45dfae5461d0683d9f5e1e0d45805c39069a369ac45c4a961860908cd81730e2d2a0662191ca8c7f80e0482631bd4e486b88786afc167f71237b6f02f7d99115943ee3c395c6dd8238c45f4955ed91428d0516aeecec3279432064fb51151bce2870c96cdca627a63c8687b31dce5c558615036d791b455870f85351b937ad0328b5d4090412ae7408d801dd09c75190b94a1b0e48d76ea017f8d4bc4d2821d8cd8b3b1b5873fa3f838b42a911767d2528f3300f25b38370c6a6749d00e399f09e0b79b0c21649b80cfd4f192c9b0a8d4a921c91f09e25d39fc1b432a5a78db02034b7a633adaf743ac73cf41aa9a82c18fe187e3e77bf16bdd7ec243109c72fbdda1dc208d268551275ebb6f841336ea838c2575f62c3665ed0e091d54c8a1fdaa5463aade8538c2e23011d78b95956265f08d7a4647f94477142158257d2666c65439e7ad780b570647154f67257ce40d952af85607f8e66f16b9d2881adb9512bb8d436f7d9bc5d73ed9ff67d376174564f221e65b65079102cc7e9d4d6d69178aa0d2e221a61d7f2934324c65b1e9380425edfb24a9b3e4c733d2d222fc23ce2d741570d1ab8a87da392e650b54d820c95925e289839470048287023e9cca1866d094bd2aaf9c2c2844555860661699b4a97e95246526f6ff11c343fd49d2c0935170328aa463c5e6a8aa24da78cb3e5aa4a10acdb72477f56a35c16b692de8c81e804bf5ea3efc314a4b192ddb2ab3d9a2774a093744b58961810da83d862dc3065dfb69217723a8909744cf10bfbc00353cc265c62c31c2ec82a5aa16f986daac762de930fec8e995c48becf3aa60fe1df35417afdb3e2033203b30d9dadef2db48fedae0eec84fea12d84cab45397c68d20819de21cfe00c5a727500a01ea77d0ec9ad54730c1465e85281d426f19d3a623ada34ddd47058b2cb5dbef4d8743e815bd34736f9d95c91ace74acc74391b42d99766de90d78f4a8021eddbe4b69723885dec4cfcec355f6cc896fe1b4e3e614812b1bf216243d8cf2893f274d945eaa97d64f2a714cfae395d08de737177dee61d8c23f010ab7b2c4266517ef0102ce0adc5f0d8a186819d93bdf861e8ba7ab8830155a545025885b837bce14ee5c3dbe6890719a61b2a31b57ce6a7f7e30f3f59a31d9367d3eb0f1fd1140b37636f16baa972a00104971d286ca5da0ebd93f21e550e7c8a2da561fee7d14c3c1eaa19d968d73af990b733711a5c660468d175343fcefdd26d3fdb794955999c27475840dbc051e0b898f008d86691ab21c355c3f2cb882d6d8b6679e89b7a2b85e7db45323a24eabfc0d74742cc89036c958854bab64cb3abe5ac887c5d88027c8bc0745d3e1d69d7f61df639323fd6d77d7eed657e4ec96ad2adda32ad88bb212182ee3031e85694903d8112cbf69ac7400f533049b9dae7a2d03680d70be886e7b092a714fd2a3f1086801a861bd715f3b5644236f45b2888bf3a5ed65f327d78a4671f2d7eea9a5ab8ebcfd0708bcd7be8400c80062a6a5f277a883d79f968169ae4bc68043c12f8c688eb0f6fb0d86d3ccede20680a36c5028656546ef98e0988dd5d513fc6d646d33d289aaaeeb369b3501e1e609b7a9d5f70f848206c61643b96ac63778e6ab10eec390656cfd8e9ad1e6d0d833e635d4206015e403d224fac86c1bbb51df2f97759234899971edafe8b21705b580afbf0b12220bf654b6b6f6943830636c5843157cdb5d9f1d484a49e962c1e29c44a6c1e9757d9bce5a12bd3617192b4b1bd548200234bc21d5bfcb6cc05a2400860eefc76eb40351b221357892922156c93891b02f510262b607f167138ec8d74bf32735cff3db2fb9e50a2b13f2229bb9450553879249e93c58b5626418fc2c36a834cdd43aab67676f84d33b394d6d9a3bd3059fbaef1d74e332608ad79afb73e3a2cda69ff7fdcb91b02beb7c2ee8bd458c07fb83d2973468d89330396411e5bff0bf90ae990b28f503d5737c57cc6ac53dc57a03f047ca1bddeb43fca4a797ad1df00443eb93eefa356910e0e87d68086aeacdc6cfed1146e02943d45e3c353f75f2b6f85b84237b467625b6aec103e6c0b0e88242737c09fae3841557375a1fd7bad675101382dc5805fe70dd6c1b45344852802fb803b641e9fea9fff3f17373c1e7a4ed0aaf9a12ef1f1f06201e0a830c800efadcaa476ce0dd5dccefa181b06788bf78db2ebd4dc548ea2c38492b66ba59bd6152f7a8cb62000088dfc686e8203c03446bf16b4bc870e97245200ec9617d4dd71f685ca2996ec8d7b79a9d93d0864e435d987e1db3a05d7b8c03ebf55b3f5411572911d5d39b212eb774a0eb696deeabaa117adadb7b1ee319bd747cfdc6a95b70b9bcf5cbd5e622fdcee27db19d199a71a16867a47b87cdc423f02bcef70f416277bbd8276f918454cd806dd031ad6fa0859f1cb53d3041b29979020fad55e3922f588d286c2f7e58a70af64542ff4868b72574b11afcfbf25848d368203362aeae54b328de226703403bb55a2c566244a2dc126d9540791f8b7715a85b8116caba984c29e4d4afb5df292ca5187653b18390eba51140ca2522c70e9bc527ccc12578a6a0973b7670df0b14dc37f58bcb65b4dee27b2b4ba4b50eb6fa64e8352a1bbcd81c2294fa08540fd6281580af9930adc5352b902f90f03c5dc33198b0f95589e521426934c77f2b11c54f0a83cb4c334ce9c5cdccd7fc7a04630bb7c7e7f2d6dd4ee4773b19c1f23241286200b2e04e9030f51353cd3991e80d7c8c271f64e3c8e28c068331b7d6cdc26eeefd0cf427e7c3938e8a419a59985964043494095e325cfea15227729a2892ae46510c87233e00a4c3ebd91dd4c06059434712749510b8bdcfa4839f7638e7bc0bd75198e3bdd419c69fcf0bbb268310ec43739b82f55631e37cae5f0169dca0a7054a45f11e61e083a5a39c9fda15275af9cfbb7e846fba688824350a71e500d53b5f9d8d8e9521749781c60353676c67bd8f71b79ecd8c6b2f4d2828d09e9f41f2e4b42e9bf73b28b51802d71c5627005d59e0ad9ea292f87fd122b093d682aa73dfa6a35f3e0b7ea17df2d5e57b72b05d8b7407954cea5ead836ee4aa30765013c9434e9f5e3866cc6b288b53bf9f0f71791f82d7fef9dcdafe5add727e4bbfd9cf8d82a779400792871dbd21fd267046262eda0b82f4b235fef275b306481fae561ee429bd6bd1cb1fabef87ff4c09b71ac98cef03f6d7b1aabb9b966d89e3c4e87aec499c407b93d883cb452ff6fd7e4f0d610b2d759e1b5d5f798b5820709cc912b848229673a6162751011722844934a2c3298a815edc4cae92e52d047fc3b0f5303faf6ca66ae06d187292286383e9a450a65cc78877e7cd8b6d7fcddeac505b8415241df58abab44dd13c1fb61cad8cf05880dbdade94313f7c24dc7ab1d0facc52aff36d1d9298214c58fe5f7b99585d53f66981ef708917b22d70fe7bc33042ea007835f3529215ef0f18bb7a3f762b5ab1f3326f106afeb369303ea8b226d4c8039f296ddb2ab8a0a4070cb93f4962a3f9d274df01b23f727107aa3b82696bc3c140b19a3278f6e8cebe1ff7a12cfc331e24a6eb8d01ee30b0514ccc976959bde4274a94fb4ca3a902e9a0f329dc43ced592c3bd4baf419da41ef3fa7276f524aeabffefa5b6e7d2ff5c65149617550536d3e8ab28a04ff3bf5d8390c067d0c3ce4e7d37fa217f033e604b92485605f8ed6f013a0a56a6002eae0fb51cdd6224c02367578392f40e7e6c015247e340ea57179aa3d9bc2e1a71e324f0629e9b623904717e6b341b44a38fd64a7d5f7f3c0d188b81529d1a164d3e39af0916d6f2756b0113b583dc7f2e852e8ded8acf10767ba7732b8b62b47e510b903e5e121295dab85a71e78754da798d98896fb5876afc0efa808bce8f235e7aec5fd2a890bf6873e2c1e7a7aaf5216535af99feb8be1fee35092723275f1ed1d94aefcc4a6b74e102141855adcfbfd2c5dc1a4158b7b10248ffd8bf21f4c2c36080bc83bd0edd255acb08d14ec414651a194c72782960e1fee22b69fe1b0efabb238a410271189ef85708384f3fc904ae5a4d46d4caa60027f395b7dc8d2225340d24af923958f2e9cdd59bd5f71c1c4ec27de88faa5e3ec4a6fd2e4c3eff08ca64f03b7370dacda0cb3acd354d062c699325b815f397e0ce2d0e1938592343873fbd8f1e98b3836bfe7b0fbc3eb0b2135369cd33ba0de2e8d130e15c4cfd318ed9719ff32e6c065237695caec4347da91d3eb692ee60b94c8bb163ac21553b6e8355b2558ac809a192b1c8178d82ca1434bd26af0a3157f46bd9a9c52bf39d2865f2840f20f41340c72f0632401a99015f664a8e3dade3f17d12cbcede0e6884ecb0e244e7d12edd63a8796328f17bf2b9f3507d9f73bc371d0a7b52567e4ff783851043b8dafb2477d90438ac2af69be81fbd5f2718042c0a4538e8908c859c07b40b3b0c153afb64a73ecac63e255f1050e375350d164e891f733ff4eb168ec5b7a2873baa4dd47b9ed01da894139ee1ca0572575975e6511b2e7c82c096fcc173f9865460dfeaefac0157a8a4b58bed45a67c8da9fd8db2947b2e5a3e65cee0b58e8d572165668bd53f6fc84e4f79622a5bf70ab91fd00e6573de81f924d047b890efa76fef1470a6f6172c07afb8bdf291cf6e06596c3ebcd81555b721d33b1bafac0a0b451d884858c84a4a718ab33502fa8ac8773ecc39d384834baac76f7188d068f5f865e8f467a6486b96f1f492384d30f6dbbf692237acb1a3dddbd562941fe613667e2eb4b57073bba3ff81723dde63a700044b9b0063478df4318bb46a28d4181a18445fe308a8734251b6490cb2fc0e5e3ac423c9238d99aea60b941df2526a57e1476a6e37445a053fdb482fcbe81da9200fe58ceb2ca35f371922cc768ae651dcfe895a6e35977ef14a1848b42c6498c370a7888e89cdd8c2a08cd7efd57083cb635e6a724a768d384cc93538eb95f60c63aa117e6ec118b479adadccc1d869eb0acb9ab0d4be52c8060fde8487982e1c2299ef4f3a7f9edf664d113a72e16247d74e6916c617da753cf85f69b9fcf4264e799495c57bc94afc53283166812aaea828d8a7b900f4c80616047731123284174c90990b73ca1a47a6e7b3054a987e612149b52f8bc802890c019e414e17d257d879d16410e419e205815ec286e7c72351dd407dd09f53a7c632a7c6c819873b102ec10701082f02989df4941adbb1e34d86f214f99c68996c11bd760e9164ebc2bcb4a5945188b4eb8be8a6e3421109141e3916134f4756d681f38e9f125c122771fafacb2376b5454344c9675ffd7abf724ebcaf1cf92393f21cecebcf1cdad68e5f6d50f552efff5060d3397a61ab43c7ca02726ffa7e7f2ff52637bebaf639482d817bab143c0f8632f567731db823f187e3fffb7c151cb99ed4707f14dc527cc3552bd6cb3acb85b68b1f637ffb8de95ce404f53b75484a32ea765129041bf76a90ede14c80a705bbd72036a32b0d63cc90ab3c881ce96655b96eb6c72b39469f7c416ef32e28a81ba9965ba01ab090c42bd5ab974ef5000c2739b5b3f0f6d6509c28a7fec520a6ab9dcf2df27b92b6672cadf2fcb14ae5deeb7fca44e41aea48a5e2c571cb2d7bf7c0dc7cc019913330705983d30ae2b9ef8fa6e78dbc097765c71a54cafbb0ff660ba8b766bbf5202a7e3d1ce9cfb2083f5327a2242133d2ffe85b45289d3186547734cd0677490dd2b96290c09b1fcb388e7c597a57282ee46d61b9792d4af5aaeb8814ad4450a78db4f07ce53c84b3b2978e2af3c530a27b45ccc2ac08fcfc8f1f683bd26346c4b739d25423946ff4614c711bd72a1cfc481dfcc96ee913150c0b44516bf4aedcdc28f3b5e74c5f2b9d44053c594d0a5cae4c2f7a92c53e13e9472ba68e1594500ca756c69beb7d9262089dccaa19bf56564fe52097ea7726669d41e85ddcd99e9f6190e0be14d9a7d7cdc043454f1c2bc1eaf6c84a93a90deb2973fe3b662dd009d46df55e7ddccbcd45e8bed49893729751546375e88c417c66776e0aef8949e546566e0c913e58c62e252fe276eab6373b766c2f725db69c5a3ed98571a835e7f974b3ee84aeeefc5318a9a8c933fdb3670afb45bc1708622bc09d528e65613507aca9004fbf3e7449fde426d4c65b9248d877223a7fd98d19f78ba5a3378f6f1a62b5e6400b09d96ade7516a8f19622182f354422e4d0d7aab6e2c71af1e70eca7de747ee09084b43ca0f57a54ccc5e47c417f1e6c28220f4c722e48d3e9230ae47ab9fbf7edce859c63082d08257a5388e21f16761342d716c0dc837f30c3a6b352095e024ba10dcee7aec79d4443f8d42dd71552a858f07f4737e52a2e8cc6d177ee5240a0ec759d04b2974acbd5c5b3351238725e865639188d99539579e6cfcebb27af89878b62c2b6f01c5e9e61dfe55233d37d9e6855c17ab753d41e2e53e632d6a583c921c1473bda06be0dbdacee68f1c00a6bfd8dfd8c34a0c646e0cfaddf63876069819035e596c05db285f6c7794c14f154a2cf154901c04e0d9df55c236e432bf3ca4cc2bace9763767ca6f8b4327c65f811e27e4fc5fb6c44f94a8ffc063fe2d5f53f43139ef49d6446083f71482d3b3e3d3587753b84cca815ec4b94486aa8529af2fbaf8253fa9d80d60e3a49cac0dec4095a8a3c9a54981879cb1b6616bd270ae9d3337e5244b2a2724a409a90530b5653e5a7f9b56a06d33333a19c070c7d984345db088af5124fbe7ba441347f345e2f06e50bdc4b964b321df3ca11987f0f3304ba288eb9fa7839d84d629915f25ca9e89f848a0555b770eac79fcd51f97b6d89166c7a0ff3cd9ad7906d6784356060a5fe9eb7065b539d01d645bd7ddeca887a47156bc93b5c26070c68289f27d0f871e3dd2b5fb117ebd6918d32a05336f5cd3db7ad24c1c403b8544949acf196b8e419d551f6e20ec8e4e1ff216c2a299b7d0be205d6a3b4a9ffebbe76c60492fe156bfaf507eedf1198446c3b157fde1b77f5c1a13ef0369c5e6e3c45037af113ac56e3fa49ec44ac35733afa68568cac5bc41955fd761b0bcd0e4ab32338d3781544e29cc3315a81e6c9212b150748f6495ffbc67a4f8315b2510ec52a1cc90b728daef1aefff6c978769c2e0204d1c13733ee30569e1f2d51336add536f95d00f873959515fadca42374fad3b23c14458b03dc8cefd29e447ff1a48254179c2a46f419b07d6c445882ad10d53f9d264123c496a8ccc0f88af3948a444d418e216149aabe4b00b2ae12ebbf1b02a8a92af62003cc9c090fd3e09640ad008a9f86f85918ccb5214ab368ffacc12ceb2ddf4be1f945eb48efd30d5a20a8d6ab72727b1aba94cb672628862731edf4795c7e3ac2b57a78de4a78ae5585e8fb74ff46579b50faedbe692bfccb26838cec6b4ce7bed4671c6923d6168f0a0f279390bfb20c0869af7c0ab07d34d2d891978168cb43880010a3999f22ff75c69523dd06b84e4c76e903bcfa9fabcb617c40ec5bbf4e0a88f2fd50504c1415c0dc70e2b4c73ce42c86e17ea49b84a28045e5969038ed97e0bf3d2f80bddc7a3b99177a6eb5165a7cea1315c86e30726c5be85be9dadfa36ad569440e9ca5e5042b129d84a1d189400d8ff2c7c7a4ae12354071c9c3ea254a55ce9e47744c8d1e40cd3723233ec069181307ac4ded7b6044c76320edc00a17f98ecec3ca3f67e01732e57db927626efb2518fd376931fe957f2326e3d1d74e5a8dd7a6ff18b1246af3f07abc1d78a09bf78bb381717f8b2c5ac1d311d27d9d172df9fe609155f59cf86aacea3cce4297f8e771f60895cca1c15b616dd2596294fa0bf96c64a14321c178d8286a9406ee11bd2de5f6a0ddc486db5c52d2522b8a42c993ee640bf3009d8bb1b9eee2a95d4db0b783fbca9b29a7369ef66c9cbb8e479e5f9946c6e60d8d76eaee62b9daf6674b9c22d08dcaa0287c006e618e0f751b6e4ae94a931428ecaf74c4c9fa836a4200cb685f961551373610c384e6e3320055160e7579e51b82417a3d698f3b353272c1bc7f103f4a5502c226ffbbb04bb657779de26fdf77d0e1ba25077077744de75170db04a78d4d8419424fc03f3ff3b01c91c1ad7f3013a084609e90125f0d3bfa92be33b3dd042ee69acfea14b99bcb6c59d22e8015bbd1ca2c3a9f22be61e152ee0d6282d0cac7a69ed372b98b77dbe4cc16a17c681443d67c187724d9cb229220ae5295bc7e4fb3aaede51ce5389a6b737bdf9c42b3cd22f7b3dd3fe9f36ec66f04e798df7bda63608e460f127113c7369dfaf22eba56e8ab0ec64c3798f81b946c1f587d8ee6322e7662ca7e8ff67e8b989722fe8d2f344eaae8670322060de6a4bc1f6515385ec2d", 0x2000, &(0x7f000000d280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x238, 0x0, 0xffffff0000000000, [{{0x3, 0x2, 0x10, 0x3, 0x80, 0x2, {0x6, 0x4, 0x9, 0x7, 0x2, 0x10001, 0x5, 0x9, 0x8001, 0xc000, 0x2, r2, r3, 0x7ff, 0x5}}, {0x0, 0xbaa, 0x3, 0x3, ')(['}}, {{0x3, 0x2, 0x70000000000, 0x5, 0x7, 0x400, {0x4, 0x3, 0x2, 0xf, 0x129ad5b, 0x5, 0x10001, 0x4df7, 0xffff, 0x6000, 0xd, r2, r3, 0x56a, 0x4}}, {0x6, 0xfffffffffffffff1, 0xec, 0x4, 'f\xcb\x00\x00\x00#^\xffs\xa2t\xbfm\'\x8d\xa46;$p\xdc5\xc4\x01i\xeam\x11p\xeb\xf4KS\xc2\xd8\xe6k\x84\xc6\xcda\n\xb2g\x9fR\x16\x94\xc1\xe3\xf4\x8d(%\xc6?]\xeebI7\xb9\xd6f\"\xad\xef\x10^\xeay\xd8\x98S+\xc6\xe0FUao\xb5Vscj\x11YG\xe9%2\x0e74~\xc2;Rg\xec/\xcdK:\xfb\xe7U\xc7&\x8b\xffP\xceloH\xf3\xc5-5\xa6>g\xc8@\xee*\xee\xad\x8e\xab\xe1\xbf3\xec\xd3\xf9\xee9Td8\x9dNm\x03\xc9]\xcd\xad\x9a\xc0\xa8E\x1b4\x93\x88\x9a\b5\xdd\xe9\xe9\x1dM]|\x94\xac2{\x15^\x0e-\x1f\xb7\xc4 \xa1IL7\xba|5\xcb\xd4\xf5\xe5m\xfb;$\x16\xaey\x85\x8e\x12\xd7\x84\xc4o\x1dz\xf6p\x8d0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0xb, 0x4004, @fd, 0xf8, 0x0, 0x0, 0x11, 0x1, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) 6m34.776267857s ago: executing program 1 (id=3788): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$kcm(0x29, 0x5, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3e, 0x0) r3 = eventfd2(0x4f9e1aa, 0x80000) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x40, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r3}}) 6m33.185064919s ago: executing program 1 (id=3791): timer_create(0x0, &(0x7f00000003c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r1, 0x0) ftruncate(r1, 0x51a9497) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x309}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f000050a000/0x13000)=nil, 0x13000}, 0x1}) readv(r2, &(0x7f00000002c0)=[{&(0x7f0000000400)=""/224, 0x20}], 0x1000000000000108) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x18) 6m32.259516235s ago: executing program 1 (id=3793): syz_mount_image$udf(&(0x7f0000000180), &(0x7f0000000100)='./bus\x00', 0x1014494, &(0x7f00000002c0)={[{@iocharset={'iocharset', 0x3d, 'iso8859-4'}}, {@partition={'partition', 0x3d, 0x6}}, {@gid_forget}, {@session={'session', 0x3d, 0xfe8}}, {@noadinicb}, {@anchor}, {@uid_forget}]}, 0xfe, 0xc24, &(0x7f0000001480)="$eJzs3UFsHNd9B+D/Gy5Fym4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmFoSJNXIRtrQvfTQQ4Ci6CEnAq1RIEUDoymCHtnWBZKLD0VOPREtbARFD2wRIKeAxcy+lZY0ZcmmSFH299nUbznz3ux7b5YzkqA3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAiN976cKpZ9ODbgUAcJAuTX311Gn3fwD4RLnsz/8AAAAAAAAAAAAAAHDYpSjisUixeGkzzVTfdw1fbHdu3Jwen9i92tFU1Ryoypdfw8+ePnP2S8+NnevlB9e/356IV6YuX6i/uHB9cam1vNyaq0932rMLc617PsJe6+80Wg1A/fqrN+auXl2un37mzLbdN0feG3r0+Mj5sadOPtkrOz0+MTHVV6Y2+JHf/X3uNMPjSBRxMlI8/b2fpGZEFLH3sbjLZ2e/Ha06MVp1Ynp8ourIfLvZWSl3TvYGooio91Vq9MboAM7FnjQiVsvmlw0eLbs3tdhcal6Zb9Unm0sr7ZX2QmcydVtb9qceRZxLEWsRsTH0/sMNRhG1SPGdY5vpSkQM9Mbhi9XE4Du3o9jHPt6Dsp31wYi14iE4Z4fYUBTxcqT46dtFzJZjlr/iCxEvl/mDiDfLfCEilR+MsxHv7vI54uFUiyL+vDz/5zfTXHU96F1XLn6t/pXO1YW+sr3rykN/fzhIh/zaNBxFNKsr/mb66L/ZAQAAAAAAAAAAAAAAAOB+OxpFPBEpXvr3P6rmFUc1L/3Y+bHfH/nF/jnjj9/lOGXZZyJitbi3OblH8hTiyTSZ0gOeS/xJNhxF/HGe//fGg24MAAAAAAAAAAAAAAAAAADAJ9yPI8Xz75xIa9G/pni7c61+uXllvrsqbG/t396a6VtbW1v11M1GzpmcqznXcq7n3MgZRa6fs5FzJudqzrWc6zk3csZArp+zkXMm52rOtZzrOTdyRi3Xz9nIOZNzNedazvWcGznjkKzdCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwcVJEET+PFN/+xmaKFBGNiJno5vpQrwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8CANpSK+Hynqf9C4ta0WEan6v+tE+cvZaBwp89PRGCvzhWhcyNmsstZ44wG0n70ZTEX8KFIMDb9164Tn8z/Y/e7WxyDe/Obt736l1s2B3s6R94YePX7s/NjErz1+p9dptwaMXmx3btysT49PTEz1ba7ld/9037aR/L7F/ek6EbH82uuvNufnW0ufmBdFHIpmPKgXte6LWhyS9hzUi3y9il12FYfhp6BxWAaq9+IBX5g4EOX9/91I8dvv/Efvht+7//9C97tbd/j42Z/cvv8/v/NA+3T/f6xv2/P5dyODtYjhleuLg8cjhpdfe/1k+3rzWutaq3P21Kkvj419+cypwSMRw1fb862+V3seKgAAAAAAAAAAAAAAAICDlYr43UjR/NFmqkfEzWq+1sj5sadOPjkQA9V8q23ztl6Zunyh/uLC9cWl1vJya64+3WnPLsy17vXthqvpXtPjE/vSmbs6us/tPzr84sLia0vta3+4suv+R4YvXFleWWrO7r47jkYR0ejfMlo1eHp8omr0fLvZqapO7jqZ7sMbTEX8Z6SYPVs/0tuW5//tnOG/bf7/6s4D7dP8v0/1bSvfM6UifhYpfusvHo/PV+18JN43Zrnc30SK0XOfy+XiSFmu14bucwW6MwPLsv8bKf7h59vL9uZDPna77LP3Oq4Pi/L8H4sU3/+z78av523bn/+w+/l/ZOeB9un8f6Zv2yPbnlew566Tz//JSPHCY2/Fb+RtH/T8jyK2tra+FXEiF771fI59Ov+f7ds2Et33/c37130AAAAAAAAAAICH1mAq4m8jxZMTtfRc3nYv//5vbueB9unff/1y37a5A1qvaM+DCgAAAACHxGAq4seR4trKW7fmUG+f/903//N3bq+9Pp527K3+nu+XqucG3M+//+s3kt93Zu/dBgAAAAAAAAAAAAAAAAAAgEMlpSKey+upz9xlPfX1SPHSfz+dy6XjZbneOvAj1a/DlxY6Jy/Mzy/MNleaV+Zb9anF5myrrPuZSLH515/LdYtqffXP57rdNd6Ht3prsS9Fiom/65XtrsXeW5u8ux54dy32suynIsV//f32sr11rD97u+zpsuxfRYqv/9PuZY/fLnumLPvdSPHDr9d7ZR8py/aej9p9JulwLeZbz8wuzL/vUagAAAAAAAAAAAAAAAAAAADwYQ2mIv40UvzP9bVYrab9v3FrV85ab8Ob3+xb73+Hm9U6/yPV+v93ev1R1v8fuS+9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAh0uKIl6PFIuXNtP6UPl91/DFdufGzenxid2rHU1VzYGqfPk1/OzpM2e/9NzYuV5+cP377Yl4ZeryhfqLC9cXl1rLy625+nSnPbsw17rnI+y1/u2h6xqtBqB+/dUbc1evLtdPP3Nm2+6bI+8NPXp85PzYUyef7JWdHp+YmOorUxv8EO/+oRp325Eo4i8jxdPf+0n656GIIvY+Fnf57Oy3o1UnRqtOTI9PVB2Zbzc7K+XOyd5AFBH1vkqN3hgdwLnYk0bEatn8ssGjZfemFptLzSvzrfpkc2mlvdJe6EymbmvL/tSjiHMpYi0iNob6D3QkZxGvRorvHNtM/zIUMdAbhy9emvrqqdN3bkexr728i29V7awPRqwVD8E5O8SGooh/jBQ/fftE/OtQRC26X/GFiJfL/EHEm2W+EJHKD8bZiHeHHnSruV9qUcT/lef//GZ6eyii+pGprisXv1b/SufqQl/Z3nVl5/1hKyIeqvvDQTrk16bhKOKH1RV/M/2bn2sAAAAAAAAAAAAAAACAQ6SIX40Uz79zIlXzg2/NKW53rtUvN6/Md6f19eb+9eZMb21tbdVTNxs5Z3Ku5lzLuZ5zI2cUuX7ORs6ZnKs513Ku59zIGQO5fs5GzpmcqznXcq7n3MgZtVw/ZyPnTM7VnGs513Nu5IxDMncPAAAAAAAAAAAAAAAAAAD4eCmq/1J8+xubaWuou770THRz3XqgH3v/HwAA//9wn/vk") ftruncate(0xffffffffffffffff, 0x2007ffc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='100', 0x3) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001200)='./cgroup.net/syz1\x00', 0x1ff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}}, 0x0) 6m30.475948298s ago: executing program 1 (id=3800): mkdir(&(0x7f0000000000)='./my_config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./my_config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000800)='./my_proc\x00', 0x1ff) mount(&(0x7f0000000900)=@filename='none\x00', &(0x7f0000000a00)='./my_proc\x00', &(0x7f0000000b00)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_proc/self/make-it-fail\x00', 0x1, 0x0) write(r0, &(0x7f0000001100)='1\x00', 0x2) mkdir(&(0x7f0000001200)='./my_config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000001300)='./my_config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000001400)='./my_config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) symlink(&(0x7f0000001500)='./my_config/usb_gadget/g1/functions/acm.usb0\x00', &(0x7f0000001600)='./my_config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./my_config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000001800)='dummy_udc.0', 0xb) 6m28.215663769s ago: executing program 1 (id=3807): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0881) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write$sndseq(r1, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff}) get_robust_list(r0, 0x0, 0x0) 6m27.105414723s ago: executing program 47 (id=3807): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0881) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write$sndseq(r1, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff}) get_robust_list(r0, 0x0, 0x0) 5m37.935272211s ago: executing program 0 (id=3937): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x4) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) r4 = accept$packet(r2, 0x0, 0x0) write(r4, &(0x7f0000000280)="89", 0x1) recvfrom$inet_nvme(r1, 0x0, 0x0, 0x40000002, 0x0, 0x0) 5m36.173685108s ago: executing program 0 (id=3941): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000001600)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000002600020007ffffffbd0310000000000095002000000000006916000000000000bf6700000000000004070000b964b01a4607feff00200000540700000ee61e00bf150000000000000f5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f1d5af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916fcecc8158f0200000000c8fb735fd552bdc268694aeb0743e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3738270b315d362ed834f2af97787f696649a462e7e090000000000000045eac1f2014f720e83b7838e3eede14308d582685e1becd6f35154bcb4000000000000000000000000000000bc3af2b170ad3e2b26539cebca8f4ddc211bc3"], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000340), 0x7ff, r0}, 0x38) 5m34.73451374s ago: executing program 0 (id=3943): syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x3b, 0x3000}, 0x0) splice(r0, 0x0, r2, 0x0, 0x725e65a6, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="900099a453001f", 0x7, 0x20004080, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='\'\x00\x00\x00!', 0x5, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xe}, {0x3}, {0xfff3}}}, 0x24}}, 0x0) 5m30.087196015s ago: executing program 0 (id=3959): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x380000c, &(0x7f0000000200)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@debug}, {@nodioread_nolock}]}, 0x1, 0x437, &(0x7f0000000900)="$eJzs289PHFUcAPDv7EKR/hBs6o/Sqmg1En9AobX24EWjiQdNTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddrdAF7a6n08y8N7MW9777szbfW8eE0DPGk1/JBH7I+L3iBiqZusLjFZ/3Vpdnvl7dXkmiXL5rb+SSrmbq8szedH8dfvyTF9E4bMkjjSpd/HylfPTpdLcpSw/sXTh/YnFy1eem78wfW7u3NzFqdOnT56YfOHU1PMdiTON6+bIRwtHD7/2zrU3Zs5ce/fnb5M8/oY4OmS03cEny+UOV9ddB2rSSV8XG8KWFKvdNPor/X8oirF+8obi1U+72jhgR5XL5fIDrQ+vlIH/sSS63QKgO/Iv+nT+m2+7NPS4K9x4qToBSuO+lW3VI31RyMr0N8xvO2k0Is6s/PNVusXO3IcAAKjzfTr+ebbZ+K8QtfeF7s3WUIYj4r6IOBgRpyLiUETcH1Ep+2BEPNSskqR1/Y2LJBvHP4Xr2w5uE9Lx34vZ2lb9+C8f/cVwMcsdqMTfn5ydL80dz96TsegfSPOTber44ZXfvmh1rHb8l25p/flYMGvH9b6B+tfMTi9N30nMtW58EjHS1yz+ZG0lID19hyNiZJt1zD/9zdFWx24ffxsdWGcqfx3xVPX8r0RD/Lmk/frkxD1Rmjs+kV8VG/3y69U3W9V/R/F3QHr+9za9/tfiH05q12sXt17H1T8+bzmn2e71vyd5u27fh9NLS5cmI/Ykr1cbXbt/qqHc1Hr5NP6xY837/8FYfyeORER6ET8cEY9ExKNZ2x+LiMcj4lib+H96+Yn3thf/QJu/2hlp/LNbOv/riT3RuKd5onj+x+/qKh3ebPyRnf+TldRYtmczn3+badf2rmYAAAD47ylExP5ICuNr6UJhfLz6P/yHYm+htLC49MzZhQ8uzlafERiO/kJ+p2uo5n7oZDatz/NTDfkT2X3jL4uDlfz4zEJpttvBQ4/b16L/p/4sdrt1wI7zvBb0Lv0fepf+D71L/4fe1aT/D3ajHcDua/b9/3EX2gHsvob+b9kPeoj5P/Qu/R96l/4PPWlxMG7/kLyExIZEFO6KZkjsUKLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8W8AAAD//zpS5t0=") mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) r2 = syz_clone(0x80001100, &(0x7f0000000100), 0x0, &(0x7f0000000200), &(0x7f00000002c0), &(0x7f0000000300)="821736baac0c4ebd9e8c81fb0934b877eaf116a4eb105e0706e79a8d86aad4cb4fbb75b7468b249ea4f9321f5055e8d925b8d7b61763cdd6edbfaf7b1438b1c0b6752e319e0a3c7144ecdd") ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x3, 0x8000, 0x10, r2}) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="140000000000000001000000010000009f719cf27a8b8bff3b21e850754935a97f5395e82955586b1448a1f1a9f6b2f674b0f2c288771f4e6554a676af283c5b3a9bc649cb7adc94b067bc6ec624946dbfd6ee0ecea2d002c4d58a5aab66e9d58894ce1525e9fa999408c110019e551c5cae4e6c39e17fb56ec33e16de2d58441de66b8eb65a8f29fb9fa501aa98714bc6a3159cae4ea64ce3cb8b285c4d868b437164d601e2d3c7f82a9e3c72b6ce2f01b17b1dd27070a9614a891b31e558d89390a6f179875f7f22aa66abfa75c0241c612d79", @ANYRES32=r3], 0x18, 0x800}, 0xc084) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) 5m26.761243032s ago: executing program 0 (id=3972): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000140)={@mcast2, 0x0, 0x2, 0x0, 0xa, 0x7, 0xffff}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@dev}, 0x14) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote, 0x0, 0x0, 0x0, 0x0, 0xfff, 0xc}, 0x20) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x3, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_connect(0x5, 0x4a, 0x0, 0x0) r4 = syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000003200)='./file1\x00', 0x2204206, &(0x7f0000003240)=ANY=[], 0x1, 0x346, &(0x7f00000001c0)="$eJzs3M9rK1UUwPGTn03yeJ0sRFGQXnSjm6GNrsUg74EY8NHXiK0gTNuJhoxJyYRKith25VbcuxJclC67K6j/QDfudOPGXTeiC7uojsxkJplMMm1aU1ub7wcec3PuPZP5cfM4M3Tm9P0vP2nUbL1mdCSZU5IQETkTKUpSAgl/mRQ5dxxHwvbk1Qd//PTi09W1d8qVyqNlpR6XV14rKaXmF7779LO8P+x4Tk6KH57+Vvr15NmT50//Xvm4bqu6rZqtjjLUeuuXjrFumWqzbjd0pZ5YpmGbqt60zXavv9Xrr1mtra2uMpqbDwtbbdO2ldHsqobZVZ2W6rS7yvjIqDeVruvqYUFwmerB8rJRvmbyxpQ3BlMwNybWbpeNlIjkR3qqB//JRgEAgDslWv8n3ZI+vv6XhGTD6Unp1/8y79X/7uBB/X/40g+dB+8dzfv1/3F2XP3/+s+9lQ3V/zkRuU79/7Vcof4frYhmy7+q/3E3LGRHQomhT279X/B/v579Dw4XvQb1PwAAAAAAAAAAAAAAAAAAAAAA/wdnjqM5jqMFy+Df4BEC/zPupbjzPyciOffsO5z/++zp6prkvAf3HE3S1hfb1e2qiLt0e/9yesSURdHk3JsPQUwcJ3jySLmK8r216+fvbldTXk+5JnWxxJQl0aQYzXecx29XHi2pHj+//5hSIZxfEk2eGZ9fGs73vz8rr7wcytdFkx83pCWWbHrzepD/+ZJSb71bieTnvXEAAAAAANwHuuobe/2u63H9vbeMlGvebaKY+wO96+vFsdfnae2F9G3vPQAAAAAAs8Hu7jQMyzLbXuP3oGGFG3mJRqbZSE82OBuJZC4anArt4aTbk/VuZIjEjUlFjlgmZs3fjBzVCRrBH1IMdeX84PUOb7D/Uztfe+FIUibISkc3fsENqCt++76/I/1IcNsoG3Oc5cnoepIXzITM1Obzc199++f0fiBvHAUz4PLB+6FI3Mwc28hFZ53XyNzk/zkAAAAAbseg6A8ib4a7E7eyUQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzBi7u5O4uXf7Db9ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJh1/wQAAP//LbL8/w==") ioctl$FICLONERANGE(r4, 0x4020940d, &(0x7f0000000180)={{}, 0x9, 0x9, 0xc5d800}) 5m25.952625635s ago: executing program 0 (id=3975): socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 5m22.395110938s ago: executing program 48 (id=3975): socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 4m32.47458269s ago: executing program 4 (id=4106): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000c, 0x28011, r2, 0x0) ftruncate(r2, 0x80796c) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) 4m25.835531933s ago: executing program 4 (id=4130): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x9721, 0x1, 0x1, 0x80}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000000)={r7, 0x1, 0x6, @multicast}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r8, 0x3}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_WRITEV={0x2, 0x40, 0x2007, @fd=r4, 0x1, 0x0, 0x0, 0x4, 0x0, {0x2, 0x0, 0x3, '\x00', 0x0, 0xb07}}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 4m24.52127105s ago: executing program 4 (id=4133): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x89}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000013c0)=@mpls_getnetconf={0x14, 0x52, 0xd03, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8000800}, 0x8014) 4m22.97113815s ago: executing program 4 (id=4122): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x5) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x14985, 0x3, 0x3}, 0x18, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f0000003000)=@file={0x1, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) landlock_restrict_self(r2, 0x1) connect$unix(r3, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) 4m21.20724865s ago: executing program 4 (id=4128): openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x800}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf980000000000000d08000000000000850000001b000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 4m20.938765904s ago: executing program 4 (id=4132): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, r4, 0x303, 0x0, 0x25dfdbfd, {0x3d}}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x4000000) 4m4.585611235s ago: executing program 49 (id=4132): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, r4, 0x303, 0x0, 0x25dfdbfd, {0x3d}}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x4000000) 1m17.858847747s ago: executing program 6 (id=4508): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x80001, 0x0) r3 = msgget(0x2, 0xb) msgctl$MSG_INFO(r3, 0xc, &(0x7f00000000c0)=""/71) 1m16.330799956s ago: executing program 6 (id=4511): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x8, 0x0, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x0, 0x0) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="61636c2c757365725f78617474722c6e6f61636c2c63616368655f73747261746567793d64697361626c65642c6e6f757365725f78617474722c6e6f61636c2c00d4a87b439fa421753f060fe37a330d2dfca47c4e52e78d71fc65b972e2bb306bb4a29b1fe3019842462c5fee84a2e6eb90d57b8725e3a2eff0b0b471dac5c01bee53cd8d"], 0xfe, 0x17d, &(0x7f0000000340)="$eJzslM9K80AUxc9M+rX0Q1fuBHFhwbpomqQqbkSKL1DwH+6MNpZqaksbwdaVuPUB3Lr1FboRfBF1JUKXriPJTJuptFUELeL9LW7OZO7c3LmBA4Ig/ixPj68PVy/tcw3ABFJIyPfPWpTDlfzTQnJ/KrN+276+v1yrzVQH1fT9z38/BuAur8Hrne0/nZLPTfCe3gLHgtQ7YNCl3gPHttQOGHalPlJ0NcjX9cOy6+gHVbcYCCMIZhCsIOTe99e5YCgq/TFlv9FsHduu69S/UXw0v06eY1XpT/1f3dkYyvxMcJhS58CwIfUKEt3ZiJEo95+ORfW1H74/CRIkfpuI/Mm/YZhX/Cmm+EfWq9SyjWYrU67YJafknFhWbtlYNIwlKxsakYgj/C8Z+tN/pf6/IblxFseZ7Xl1U8Te2hJxkOPy0P840nNiHXh/fGg3Yp/JcyxUaW1EOkEQxNiYBYNv+wqT0kX7sArjbpQgCIIgCIIgCIIgiC/zFgAA///dqHHL") syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffa003e45c, 0x700000000000000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file0\x00', 0x801, &(0x7f0000000d80)=ANY=[], 0x1, 0x373, &(0x7f0000001480)="$eJzs3U9rXFUUAPDT2EzSaDpZiKAiXupGN0MSv0CDtCAGlNiR6kJ4NRMd8poJM0Nkimh3bv0cxaU7QfwCWejenbtsXHZR+mTmzTR/GuMizTwrvx+Ee/LuPcl9c+dd7uZxDm7/cHd7q9fYyvoxcz3FTETMPIxYGkWlS+N2ZhTX4qj78U799h9vfPzpZx+sra/f2Ejp5tqtd1dTSlff/OXrb3689mv/xU9+uvrzXOwvfX7w1+qf+6/sv3rw+NZX7V5q99JOp5+ydKfT6Wd38lbabPe2Gyl9lLeyXiu1d3qt7rH+rbyzuztI2c7m4sJut9XrpWxnkLZbg9TvpH53kLIvs/ZOajQaaXEh+DfNBxsb2VoZz58x7vq0JsQF6HbXsuEzPPdUT/NBJRMCACp13vN/7Zme/2fD+X+ajp7/+b8anv9r4+f3OOd/AAAAAAAAAAAAAAB4HjwsinpRFPVJW0xeEh7/XvH0uGBPrf+Jn6rnx8U6fHGvNh+Rf7/X3GuW7XgjmB0PXI56PBpuCxNlfPP99RvLaWQpFu9+N8q/9ltELJV5W9GOPFqxEvXhpdPyV8r89CQ/hu1sLETE2iR/Nerx8un5q6fm1+Ltt47kN6Iev38Rnchjc7S9HeZ/u5LSex+un8ifG46brWxhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJiqRpp4Pcq693vNiCux13yh7D8csHS8Pn6Z/6S+/nLU49Hp9fmXT63Pfzleu1ztvQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADARG9wbzvL81Z3WsGk5v/oSm0S/HPWpXL4/RNdV2KKc87z1syz+oOPi6K4qKnOT3cpzxPMRpy1gsX4W3L+//VSRJwxZi4iqv80/otBVTsSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVOew6HfVMwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBKvcG97SzPW90LDKq+RwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgOfJ3wEAAP//mF8PGg==") 1m15.930996998s ago: executing program 6 (id=4513): connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPVS_CMD_SET_INFO(r0, 0x0, 0x4000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000240)=r2}, 0x20) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="05003300000000000000060088a8", 0x0, 0xb7a2, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50) 1m13.809932636s ago: executing program 6 (id=4517): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xf, 0x0, 0x100000}, 0x20) 1m12.031047393s ago: executing program 6 (id=4523): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40), 0x20341, 0x0) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x12) dup(r1) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000145802, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x103381) ptrace$cont(0x21, 0x0, 0x8, 0xffff) r3 = dup(r2) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r3, 0x0, 0xffffffdb) setpriority(0x2, 0x0, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x64) 1m11.58999144s ago: executing program 6 (id=4528): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0) sigaltstack(&(0x7f0000000000)={&(0x7f0000000280)=""/4124, 0x80000001, 0x101c}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) 1m7.115727889s ago: executing program 5 (id=4535): mknod$loop(0x0, 0xfff, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1205848, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) 1m5.751401305s ago: executing program 5 (id=4539): socket$kcm(0x2, 0x200000000000001, 0x106) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x6c, 0x2, 0x6, 0x301, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4840}, 0x0) 1m3.309860304s ago: executing program 5 (id=4542): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r1, 0x26, 0x0) unshare(0x22020400) fcntl$lock(r1, 0x7, &(0x7f00000000c0)={0x1, 0x2, 0x8, 0x73e9}) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) 58.949534944s ago: executing program 5 (id=4562): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x19}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x90}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) 55.962110939s ago: executing program 5 (id=4553): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x2, &(0x7f0000000000)=0x80000000000003) r3 = fanotify_init(0x40, 0x101000) fanotify_mark(r3, 0x1, 0x8000039, 0xffffffffffffffff, 0x0) io_setup(0x9, &(0x7f0000000180)) 51.028186719s ago: executing program 5 (id=4557): syz_mount_image$squashfs(&(0x7f00000006c0), &(0x7f0000000240)='./file1\x00', 0x5, &(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRESHEX, @ANYRES64=0x0, @ANYRES32, @ANYRESDEC, @ANYRES64], 0x9f, 0x19a, &(0x7f0000000040)="$eJzs0cFrE0EUx/Hvm9nsJsFWt3qqhy4YWFeQbIpePOVoIQteRYIuNZrSBLTJwRaF9CCCVPs3eNKjCHoSseC5eBA8aETwJuYQPIhCWNlk8ld0PjA7+2aG3+7bbffu9jxgMr6/Tp2pAot89AQHWJHZmlKz+Y3ALvDTrO8DAQimRijm0wtTlwfCbC+4FBTNmc2002ltBejx7wD/O73tnc20s4s5ORLqyOexXk/lRpJHd9XNBL/BuSfoJkRPWXYWOHUdTRbusaayTMLGv+x4td+9U+1t75zf6F677ZrHxRfi+OJq9dZGpxW/RqLHovLW8uEllKIHFJo8PHTK5E1GbTXUUgK3yf6hPnvm2AgV/SJDeB+O8L467UWTjD/Jsuyk8AydUGlMM3Ot+DJyRb2SmvPJ+VNQFAfabF1V+q/rzQMKYY10LX9JWGZpcsCjIZUhJzTPh86Pb6zIW0qwZ76nM8ivL011ugy43Ev7/a2aCx8kTFjNhw8LLHGASuqVBj68k/kPmvkyv7Esy7Isy7Isy7KOgP8BAAD//6GOVz4=") semget$private(0x0, 0x2, 0x410) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r0, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='bbr', 0x3) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x404a3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 35.57651689s ago: executing program 50 (id=4557): syz_mount_image$squashfs(&(0x7f00000006c0), &(0x7f0000000240)='./file1\x00', 0x5, &(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRESHEX, @ANYRES64=0x0, @ANYRES32, @ANYRESDEC, @ANYRES64], 0x9f, 0x19a, &(0x7f0000000040)="$eJzs0cFrE0EUx/Hvm9nsJsFWt3qqhy4YWFeQbIpePOVoIQteRYIuNZrSBLTJwRaF9CCCVPs3eNKjCHoSseC5eBA8aETwJuYQPIhCWNlk8ld0PjA7+2aG3+7bbffu9jxgMr6/Tp2pAot89AQHWJHZmlKz+Y3ALvDTrO8DAQimRijm0wtTlwfCbC+4FBTNmc2002ltBejx7wD/O73tnc20s4s5ORLqyOexXk/lRpJHd9XNBL/BuSfoJkRPWXYWOHUdTRbusaayTMLGv+x4td+9U+1t75zf6F677ZrHxRfi+OJq9dZGpxW/RqLHovLW8uEllKIHFJo8PHTK5E1GbTXUUgK3yf6hPnvm2AgV/SJDeB+O8L467UWTjD/Jsuyk8AydUGlMM3Ot+DJyRb2SmvPJ+VNQFAfabF1V+q/rzQMKYY10LX9JWGZpcsCjIZUhJzTPh86Pb6zIW0qwZ76nM8ivL011ugy43Ev7/a2aCx8kTFjNhw8LLHGASuqVBj68k/kPmvkyv7Esy7Isy7Isy7KOgP8BAAD//6GOVz4=") semget$private(0x0, 0x2, 0x410) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r0, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='bbr', 0x3) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x404a3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 28.555803779s ago: executing program 3 (id=4596): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) 27.442503814s ago: executing program 3 (id=4600): socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00') fchdir(r0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='./file0\x00', 0x80000006) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x31, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r2, &(0x7f0000000540)=[{&(0x7f0000000440)=""/108, 0x6c}], 0x1) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r3, 0xffffffffffffffff, 0x0) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 24.110525434s ago: executing program 3 (id=4604): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f5, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000140)={'erspan0\x00', r1, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f5, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000140)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x2c, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0xd}, @loopback}}}}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0x6, 0x100}, 0xc) ioctl$XFS_IOC_FSGEOMETRY_V1(r2, 0x80705864, &(0x7f0000000080)) 24.106024754s ago: executing program 8 (id=4605): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, 0x0, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000007880)=""/102400, 0x19000) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r2, 0xaa3a6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 23.09884096s ago: executing program 2 (id=4606): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r4, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) 21.097775917s ago: executing program 2 (id=4608): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) socket$inet6(0xa, 0x80002, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000240)={&(0x7f000046a000/0x2000)=nil, &(0x7f000012a000/0x3000)=nil, 0x2000, 0x3}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) socket$nl_generic(0x10, 0x3, 0x10) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 18.493004273s ago: executing program 7 (id=4609): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {}, {0x2, 0xb}, {0x9, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c061}, 0x200c000) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 18.098024773s ago: executing program 8 (id=4610): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r3, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r5, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1004) 16.706701057s ago: executing program 3 (id=4611): write$binfmt_aout(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x20) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x5fbd, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) recvmmsg(r1, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0xc, @mcast1}, 0x1c) 16.624117885s ago: executing program 2 (id=4612): close(0xffffffffffffffff) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="120000000400000004000000a4"], 0x48) writev(r1, &(0x7f0000002640)=[{&(0x7f00000001c0)="80", 0x1}], 0x1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r3, &(0x7f0000000940), &(0x7f00000002c0)=@tcp6=r2}, 0x20) recvmmsg$unix(r2, &(0x7f0000000c40), 0x40002ce, 0x80, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 16.508204255s ago: executing program 8 (id=4613): socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x800, 0x0, @dev={0xfe, 0x80, '\x00', 0x42}, 0x7}, 0x1c) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x1) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) renameat2(r2, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r1, &(0x7f0000000180)='./file1\x00', 0x4) 16.42694661s ago: executing program 7 (id=4614): r0 = socket(0x10, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 7.500746371s ago: executing program 9 (id=4581): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) io_setup(0x5, &(0x7f0000000140)=0x0) fadvise64(r0, 0x2fcc0000000, 0xa, 0x0) r2 = eventfd2(0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r4, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x9, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x0, 0x1, 0x25}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', r5, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r6, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000540)={&(0x7f0000000300)={0xa8, 0x3, 0x1, 0x5, 0x0, 0x0, {0x3, 0x0, 0x8}, [@CTA_SYNPROXY={0x54, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xfffffffb}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ISN={0x8}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x101}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xffff}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x3}, @CTA_ID={0x8}, @CTA_FILTER={0x1c, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x4}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x81d}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x501}]}, @CTA_SYNPROXY={0x4}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x6}]}, 0xa8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) io_submit(r1, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x8000, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r2}]) ppoll(&(0x7f0000000040)=[{r0, 0x35e5}, {r2, 0xd399}], 0x2, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 7.499457916s ago: executing program 7 (id=4626): setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000001c0)="0bced9d527472bdda546e51b223d21f6256e6e5f5a59968777", 0x19) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0xc0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x2, 0x2, &(0x7f0000000540)=ANY=[@ANYBLOB="b7881185", @ANYRESHEX], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x64, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffff1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0xfffffffe}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x67}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4a}]}, 0x64}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004000) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7.498755534s ago: executing program 3 (id=4627): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="4cfe538e2dbfa198aae0ec2a7179770fe5e65e4f6d16e558b94595c823899dfa2fae3c7f8b464d5baf20420d2d598fa388cec0cd0434cdcd27696875f7a70bb040a0ae324f89b55cbdf8bae15cdf4d2562136e6439cedb95891518cbd57b8f9142dcdc579953d658c21ff6325441248b747064e9c856bc76fc2e48a3a4cc7d5b4fbafde4949fb6842bf8ed1308f1d68e5af2400a44ad15c70a06c3578e4cb1aa30faf52664933720d844c937bf14f29690713368af106011cd38b41bb6cc816503317352b7927eb5aba2e1c8968eedb4571587fa0051687e13e3b294eea2d0e9685e802b75f510c6b645401c9f461f5288746f99827b93", 0xf7) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x50}}, 0x4008840) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="540000000206050000000000000000000700000005000100060000000d000300686173683a6e6574000000000900020073797a3100000000050005000200000005000400000000000c00078008001240"], 0x54}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, 0x0, 0x20000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000580)={0x28, 0x7, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x40808) 7.493255262s ago: executing program 2 (id=4628): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) 7.491332506s ago: executing program 8 (id=4629): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {}, {0x2, 0xb}, {0x9, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c061}, 0x200c000) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 5.595793469s ago: executing program 9 (id=4615): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) 5.377999393s ago: executing program 7 (id=4616): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x1c, r5, 0x303, 0x70bd28, 0x25dfdbfb, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x4080) 5.356831236s ago: executing program 2 (id=4617): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff00000007050102000200070581020002000705020200020007058202000200"], 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="90000a00"/64) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000400)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000600)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000500)="840100"/64) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000800)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000700)="880100"/64) (async) nanosleep(&(0x7f0000000c00)={0x1, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000d00)=@filename='none\x00', &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x0, 0x0) read(r1, &(0x7f0000001100)=""/64, 0x40) 4.140422719s ago: executing program 9 (id=4618): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000040)={0x2000003c, &(0x7f0000000280)}) bind$bt_hci(r4, &(0x7f0000000140)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r4, &(0x7f0000000040)=ANY=[], 0x6) 4.093553862s ago: executing program 7 (id=4619): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000340)={0x0, 0x0}, 0x0) r5 = fanotify_init(0x2, 0x0) fanotify_mark(r5, 0x1, 0x1009, r4, 0x0) setpgid(r3, r3) setpgid(0x0, r3) creat(&(0x7f0000000000)='./file0\x00', 0x16) 3.636410487s ago: executing program 8 (id=4620): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="6000000002060500000000000000000000000000140007800800064020000000080013400000000005000100060000000900020073797a32000000000500040000000000050005000a00000011000300686173683a6970"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 2.409360244s ago: executing program 9 (id=4621): syz_open_dev$usbfs(0x0, 0xf, 0x8041) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) rseq(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) symlink(0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1000, 0x0) close(r4) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x1100000000f336, 0x0) 1.259652966s ago: executing program 7 (id=4622): memfd_create(&(0x7f0000000440)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x187\xc2:}\xa3\x9bO\xdd\xdf\xdf\xaf\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9fWI\x17\x1eq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xbdc\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x98\x82\x94\x14\xe33\xb7H\xd4b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wL;\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfd\xf9\xa6\xdd\xf0\x1f\xed\xb3Q\x03\x03}Sb\x1b\x89\n?&\x11q^\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe3\x1b\x9f\xcf\x9e\xdf\x82)\xc7P\xa4\xcdi\xde\xb0\x14\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xc3p@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafTk\"\xfa\xc37\\8\xa7g\x0f!Y\x8e\\\xac\x01\x11R\x05p\x1a\"\r\xe9\x05\x00&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xeb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x95\xf4b:\x80^\xb7\x17@.\x91\xf1\xd2\v\x8dn6\x1a\xa3\x12\xbf$\x11\'B\xec\xebC%\x86\xa2Q\xc3\x8e(\x00'/890, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) bind$packet(r1, &(0x7f0000000180)={0x11, 0x2, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockname$packet(r1, &(0x7f00000015c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000700)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000054000147880000000000000007008209", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32=r6, @ANYBLOB="00000000e000d1a7000100feffffff000000000008"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 952.630049ms ago: executing program 9 (id=4623): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000200)={@mcast2, 0x0, 0x0, 0x2, 0x3}, 0x5a76224c41b455c1) syz_mount_image$f2fs(&(0x7f0000000100), &(0x7f0000010600)='./file0\x00', 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="6163746976655f6c6f67733d342c66617374626f6f742c746573745f64756d6d795f656e6372797074696f6e2c6673796e635f6d6f64653d7374726963742c00200da779e57c52e33a83fdbd563a5b7c6b958cb6e49387a5ba5a89b0887c0292eb888cc8efa81040100d83ba748033542625bc334eaf793332891541000f3c63c0a5f0af254a5bd1f4b81d0c5188ddcadf07eff7b49004e0b243a8a4d93632fbe9ab868d88310829d8e04a3c0572143a3d3d1472cc5da6f72bb097f5f7b95a09e442c0a1463aaa90db7dcbc542dc5bced278eda11583f810469b706968e793db3230"], 0x1, 0x105d6, &(0x7f0000010640)="$eJzs3E1rY1UYB/AnU+fVcRxkXnTlBREaMKFpO0VBpOoMOmCH4svClaZJGjKT5JYmfXHWuho/gltBxJ2fwY1fY3AhiAvB3YiSe29lqrNwOmlT298Pbv/nnpz75JxLNie3JIBj62Ly+2+luBBnI2IqIs5HZO1ScWQW83g+Il6MiBMPHaWi/++OUxFxLiIujIrnNUvFSwt/3H/w9Qs3X7/37f1y7edvvprcqoFJezkiemt5e6uXZ9rO83bRX9/sZNmb3ywyf6F3pzhP89xqrWQVtuo74+pZzrXz8enaxmCUq916Y5TtzmrWv9bP33Cw2d6pk11wu76enTdbK1l2BmmW7bv5vLaLvDsY5nWaRb3PsvIxHO5k3t/abuXrWbuTZaM/LPrzummztT3KzSKLt4tG2m1m81jZ820+9N7r9De2k83W+qCT9pNr1dqr1dpCpbaeNlvD1nyl3msuzCfT7e5oWGXYqvcW22na7raqjbRXTqbbjUalVkumr7dWOvV+UqtV56ozlWvlovVK8s6tj5JuM5ke5Vud/saw0x0kq+l6kl9RTmarc6+Vk5dqyQdLy8ny+zduLC1/+Mn1j2+9uXTz7WLQv6aVTM/OzM5WajOV2Vr5cK7/VFF/jOufin1Yf+nJLue48wECeGz2/8Ak2P8/zv4/2fN9PuyOyP7/13vHe/17ZvvGE/EBAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4tn46+f27WeNifv500f9M0fVcRFyNiCsRcTki/nyEqTi1q+aliCgV7UeNP/mPOfxQiqzC6JrTxXEuIhaL48Gz+30XAAAA4Oj67sfPv4iYGjWzP29MekIcpOJLmzPjqpd95fPUuKpdyoptj6na5Z2SY3ElIk5e/GVM1a5GxInzn46p2n8ytSvOPBSlPE4c5GwAAICDsXsnMLbdGwAAAIfOl5OeAJORPa8t/he/eBZ8Oo/igeDZXWcAAADA/1Bp0hMAAAAA9l22//f7fwAAAHC05b//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwF/s3E+uEjEcB/Af4Aj4JxLDn6uwMi5ZcAiP4NID6G3ccQYTwjlw5xEMGDqVAOLmTXlM3vt8kplOJ/Bth4RFWygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAt/axWi++br9+a5uz2zZR5GgAAAOCabbVapItRXX+d77/Nt95HxCwiphExiYhrY/devDxJ7MQ4nWvXXl9d9OFHREo4vKefj1cR8TEfv9/d/nMAAACAp2qzni8jeofLdPpwvOIZyJM2g1J5acrnRam0cQr7Uiht8jeyiGlEVKNfhdJmEdF98ynX/vv9GxZq7qSRXAxOik5ddAs2BgAAtMT5SKDY6A0AAIDW+XzvDnAfab02/xY/rwX36yIvCA7PagAAAEB7Xf7b/qjzuP0AAAAA7iCN///Z/y/PCjx8/7+w/x8AAAC0SL3/HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALe0rVaLzXq+bJqz2zdT5mkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4w/68o0AIhEEY7F3fdxq8/7GkQVNTkyoQPv7GYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDe/+8v/ialxJpl7bSw9jyRrp8bWqbF3bhz9YXz9GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgYn/uTiAEgiAM9p3/OS3mH5Y0aAwiVMHCxwzzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX/S7X/5PTI0zydxpY+l4JFm7amxdNfYeNI4ejLd/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdife9uEgTCOw6+dRInbZIT0Fh8z0FAhGIEPCcmSZ2AAFqKhorVYBFYAAQctnSl4nub/0+mKOwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgPZ2e3viIiOzzkXnkw9Xf4XLwFfm6aQbf18w2x339c8vJdjdK+Rvj/yIiisha+A0AQPvK+6ZYLKt5J203bS9tP205ravZKx8NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwZucOWqJ4wwCAv7s6699/p44qRNChLrmpWQZeOgjeg6BuoptIa4XuQcWLnyDqtNe+Qt7qK/QFgg4leOjgoaBLEMXuzuq7pKIEM4P7+8Ez8+jCzPvuwrDPPO8sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAuBzvhUjcvhRBGB4/ylo/ftheP279/+Wm0G1/vv7sSH7N1iCSE8GSlXruV4VyKbn1z6+lCvV5bk/RDMpR+7EUZj6SwSXyVKOVzcQIA4EJJ0mh9u/yS7M63/leaDeH3m976/3qUh1Pq//3mSBKaI2P7zZGxXxsfGvG54vp/IrMZFsbQSS9UG6svquubWzdXVheWa8u1Z1NTk9N3pm/fuztZbd8rqbpjAgAAwL+ppBHX/+XZv/v//0d5OL3+H+vGw7nHj+JzDfR3/X+io6Zf3iMBAADob5ev/vh+3OrLUqUSNhYajbWJzvbw78nONoehnttQGnH9PzCb96gAAACALBzslHr6/0tRHs7Y/x9/u70XH3MghDCc9v/HF5/Xl7KbTqFl8Thx3nMEAAAgX8NpxP3/pL3+v3y45KEcQrhxrZOnPwN4pvr/8+sHPQ+tx+v/p7KbYiGVZzrvR3s/E8LgTN4jAgAA4CL7L41Wsb+X7M6v/Xw1V7H+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4w44dozQQRGEA3uxmtRIDVmrlBUQvELEQxMZDiILgCUQQDyC2lt7B0jukVrCxsEzhDeTN7qikCVjsKvk+mLxHGDIvkyb/AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNd0/7uv4mXU9GX73vPH1UnUl5ka3u/XN2NFP+hy6H9nr+8BAAAAWBBVzvdFUbzVj4dRy3HK/3XeE5n/YaXpc56fzf25Pt29buT8f328dfl10Kg5Jz707PzidKezb/j3rc7dMUw3n569VOkHKY9u1qZ1us/B7WRysJTa5S6mBQB+YzvXtsn/h6Lu9jkYAAtj2K7iR/6vxv3OBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCFzwAAAP//9JxdmQ==") syz_mount_image$ext4(&(0x7f0000000bc0)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x8000, &(0x7f00000000c0), 0x2, 0xbd1, &(0x7f0000001340)="$eJzs3M1rHOcZAPBnRquVbKtduZRS91KVUmwoXUsuMrUp1C4uvfRQaK8Fq/LKCK0/kFRcyTqskn8gX+dALoEkJiGH+OxLQnLNJbGvCTkETFCsBEJIFGY/pI2lleR4V6PIvx+8mvedd7TP8+ywO/PC7gbwxBrJ/qQRxyLiYhJRau5PI6JY7w1G1BrHra4sTX65sjSZxNravz5LIomIBytLk63HSprbI83BYES8/9ckfvb05rhzC4szE9VqZbY5Pjl/5frJuYXFP0xfmbhcuVy5Onb6T+Onxk+PnhnvWq1ffXTu9he/+fsnta9f/ebW58+/nMS5GGrOtdfRLSMxsv6ctCtExES3g+Wkr1lPe51JYYd/SnucFAAAHaVt93C/iFL0xcbNWyne/iDX5AAAAICuWOuLWAMAAAAOuMT6HwAAAA641ucAHqwsTbZavp9I2Fv3z0fEcKP+1WZrzBSiVt8ORn9EHH6QRPvXWpPGvz22kYj4+N6ZN7IWPfoe8nZqyxHxy63Of1Kvf7j+Le7N9acRMdqF+CMPjX9M9Z/rQvy86wfgyXTnfONCtvn6l67f/8QW17/CFteuHyLv61/r/m910/3fRv19He7//rnLGDdfefFGp7ms/j/f/tvrrZbFz7aPVdQjuL8c8avCVvUn6/UnHeq/uMsYpW9vVDrN5V3/2ksRx2Pr+luS7X+f6OTUdLUy2vi7ZYzl98Zf6xQ/7/qz83+4Q/2t33/qdP6v7zLGfy5ceHPTznsb3e3rTz8tJv+u94rNPf+fmJ+fHYsoJv/YvP/U9rm0jmk9Rlb/id9u//rfqv7sPaHWfB6ytcByc5uNn3oo5l9u3XyrUz6t9V+e5/9Sh/PfXv+7hc3n/5ldxvjdO8+d6DTXvv7NWha/tRYGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJY0IoYiScvr/TQtlyOORMTP43BavTY3//upa/+7eimbixiO/nRquloZjYhSY5xk47F6f2N86qHxHyPiaES8UDpUH5cnr1Uv5V08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA645ExFAkaTki0ohYLaVpuZx3VgAAAEDXDeedAAAAANBz1v8AAABw8Fn/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0GNHf33nbhIRtbOH6i1TbM7155oZ0Gtp3gkAuenLOwEgN4W8EwBy84hrfLcLcAAlO8wPdpwZ6HouAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOxfx4/duZtERO3soXrLFJtz/blmBvRa2tZPcswD2Ht9200W9i4PYO95icOTyxof2GntP7hxTO37MwM9ywkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/Weo3pK0HBHF5r5yOeInETEc/cnUdLUyGhE/jYgPS/0D2Xgs55wBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADovrmFxZmJarUym3XSaHbW9/Sg09eM3MMQvekkjbxr+yWfg90ZeHanY/4bjxmiGPui0n3ayfNdCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAvMwtLM5MVKuV2bm8MwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyNrewODNRrVZme9jJu0YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPLzXQAAAP//jAsGRw==") r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0xf6) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r3, 0x8004587d, &(0x7f0000000080)={@desc={0x1, 0x0, @desc2}}) removexattr(&(0x7f0000000040)='.\x00', &(0x7f0000000100)=@known='trusted.overlay.metacopy\x00') fsetxattr(r0, &(0x7f0000000040)=@random={'security.', '\x00'}, &(0x7f00000001c0)='\\$.:\x00', 0x5, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0xfffffffffffffef9, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYRESHEX=r2], 0x20}, 0x1, 0x0, 0x0, 0x6cc77746951e2c0d}, 0x0) pwrite64(r2, &(0x7f0000001f40)="77ba915a4b7a6e111f44498dc384ea150e2599bb43449484627b1717d4b9f21b4ed957ef7afe1429de1a2be6ceb245fc858d8cc608f7753fb93adfc5b7c32c1005e467c8111de368dfe532697523e7d9c914da8b69ce72dcfb1694d290353faa730c40683893b1fe7197e51abdfee163a3b44448ae1e92e6a36e2243158c445bdee7e6f11cd46e40009883c63f827d1cf296b4b828c198b940a086e150103db8cd7621f7d8c8bb5471e47e9a169f61c7e143a88e671fa7757d0e662c42aecdccec4c50654941a3ac6c391fcdfac109ae40991e836aaa134c439d08d32ff188dde382270a5aa5210d84c99549794787e1f08b5051da7858dd54ef46a11da5fa37fb834d2e8fa69eb7818af47337a6034c72dd5e876c262b4873948399e435bcdbf7d34b4a45698b300315eb337d5bc6276bc5920a15758b23b89bd3a1f298448c9e6da2efd714a128e08f1ddeec949f990efd886c316f163d385c0b0b2a64f9e06f0050e5b0a1a94c90d26121922f4ce554c7b65a6237ee18e1b626805f0ae7a3f99ad20e4bfb427a2d33ffb087a678d47ea12920a01803e6a24b271b57b736c0b052e88987a10241c0d6c0935a3e06ee1932b1f968bbf4f076a472e7157f4f045413bcab28a6ad87a1e92b256fadde3427f46cbdddb81ca6c8e71568daf7d19323d93281896b564b206c73f9795200a83f087ac3e3947b7e92bb7b2a41bf07df099691d236f3440b1ca2ba201b04c67ee48c4682e3cdffe20218ead87f22ab1c342df744ead35b32abc190b1b735d0ff5ad31bd0b997a293952d3eab8c401dc3b838b37fa3a8b61c21ada44b8ae368224c1055ec66a8a46a5971fbf98f8bee1754a057d4e6a080368182e9ce901579070509bb932a45260bc7a8e936db844a9bbeabb630597660cc320d9df532a5076c308560da05c13afcb50df9b773b4b67db8e56a3b3d8380e3cbd4b49d3e3e9000d58ade5258f97dfd5754a851c99ae87afb5a9ae98d1aba66885cbe30e6f7e2f2b8995c6acabb8c51f6c32d40b1b308bc1b0de589914cf91d3e4cad55ea5713c329d8915a42212596eca64ec309b70ace1f61ff538c9ee8ec62115592caa387e922b124f8f1dd69c11982cffdcee9d1b3cb35f190c3867a6b1b21e5e59988d0ecb552b161eefd1f9ecfb494bfa23f12b48281de7576daa4275c2b76b8f314220e4f09898df8fc860a0b674ec2f0841a63a6993fe592055f26f54ee5329f93d860f5b327c3fb12e8f4ca041bce034cf071db515301fcb6752a21b3db6792a1acb66151b6cca6e49a196706ae908e7732a5d9d37538efa7ea1b8bd3ebe64b134dc57b41529caa54c1b940d6e0de02371e000025708ff402450ecfb9763a8016803c41b1b5fd207b329c1daedd1e3ace9adb8c8ba7a7650c36ba84f573b4e62a88865e452d86a195329b686667050c2117c316116219fb4463e56dad3aa80110a52400d15b680f808e5f91d5f96b1219a8dcfddf5d4d9e9f650aab44a83eaaad1df9a738f2cf48e02d4253318ac0dc6b1cf4c6e8d33acd44493f0b42ad0e12a3e852bcfd45c10af15836e2d855b878fbf42ba4e0dbc0813d07a2acc68769c7b703fff0ed1b22b291e7623fe02664554bb00d8eecf71196564494b55bb6d303d34c4a45f7220d989f490b57605e68a8af6464ee14d159745c01bcc60c513974f69a7eb62fbfdce09312438c87cc7a72392ba265d215383c2b8a423b29a470f37c3f2409bcb99ad41a0e0cb7b9f051bfcbb23fe8f8e20f74814864a9baa410c4423acb61ed65ad69a009ebc77eace6689da7416cc9806b092279fe701d04a6439d22ed4ef464bb127942ba3a15fe0343ea8aa17e9bbae882c9e617bc5005e063f40c60755a4a27082bf15bcdd9855af1b36a39068dc1841b41fe6c8f01867417f02f45cd5742165bf3db36e55906b7c51d7108b3bb51d160f2debb48386a1f5bffe517ddc9d8cd9eeaff20247cc35652996bce34e17ddfa92cfd038324c6c0ed263865603f4ee50fb6f513484a1b58121687cfcc236c99e83cc6a536ce18517dcabdb46d78a2c955fb670c2314cf42be8e5a4117f51452e240ba079171b96c0e4a9a20568d96104b241f554757f7a8bde4ed1b765dbeb5504a442fbf922182f36b8113909ec488f40e9ab06b584a3288f6e7149fd726545453bb95beb364f8fab6622282be652bc0cadcb9d550fc06de629d2213be8458bd58871174b0507f19c327cc533498db64b46503c5996f40aefed099ec1d02af343fe57551408e6c847a3ac87e3413631a4edd66d2f70692962fb445572f703e5bbed848e3200208c76b4172d90e246051ef51709142a37c3903dce2f63b16776d03f4ab65cdba6e037092120627b1c5c0d66f51340ee5a32c091afe4e34791c2a59f50056f6592dfcfa6843cd11e5768b4173a87d8c86904c72f56294493823075d9d14d3ab7e96f9c18e4a2e3318c7e4caa2f9e8b8d60eb7be58290d4d9f2d668fb8d4b0fd2afb7b0a2e3312996b575499559c901efbc93258d0702861f839e5f5ca60bcbc91bf2922749e445eb407e86696481c8b2ed6322559c8f597f7a2564a0d17e379c1ef831e87a7dfcc595873cc653ecb65020f4bcb020fc435430d5cac190fbe6aa93382e9c9328751ca6b503d2badf3fe27f7092cbba692ffa01c86934c4d84d79e4a2fb81c033abbea83b79d79135ee22346f2520dc00d93f7a62a38060dc0962207714664513c41621fa25e5fc284ea27ac216da998a0c8accc07be43ff52bb82fc935b4fe755904bd50f068fdb5a5cad1e4a6d031cff1ee3466969fcbce0e8ace2903189d32b6d17d70d067ec2909702d02f648fc22cab12c1f4e1ce261eae79c434ef24b8685b33afe45ba3011ecb563d1202dafb577f3253941b3f8c6aa9707893ef0c3de9ca2b4e344c01ee758cff4f4e83648b9359b09647a36e28bad5f73c21cc46b0568ca842c675a0546fdb217fd3713afd059e81a9a3b7fb25d1ece7f57bcddf92ad89be371bf75c8467099d31296afe680aada61ebe0cd2e96158f622ae6c4f3d65f82a60e7624d219e80de7daccddb30c1be13a8db3fafeec4ae613d0a191e60f4a66e5b5a8f3bcca730d7d10542e0506e3ef0965e88d4b1031256ab265c3628cdb32bc61ae52515f6594d192c48a1a617c6cfa694e84e72fb5d64758a8cdfdc2a237e3436bada8dfe8465e6e66c14800e42e484da02b1e38f4a050541c17795eadd71d298643203340351a5ce4fee72ede1785e09d95cf9f777f952387a46a70c3df6bd9408c3bc18f139bdea8952a08722ed32abd261d49af322f810dcce92beac219560ea9d56e091e4affa79f553fef6ba0ed27f4a50529ad69d8a02a44c9770f6d643f9548c43ccb6194d4b3d07f4a5c2a32ce6571941f9c8c6549d0842c7beb48f855454ee758f2e2848073445d55d9a81abf47a309b6070619b3475bbfc1a178674407e7a53c7bead090c29e39638b3cb07749ef937506359bbce7467a239a941d38a36c8af2b0960d7e103c8276dd0b25a6732a9ed94a37dd1494bdb61024a87440dfbad551fa357c8984ded7022caa86d3cc89b24218bd72c4bbe51c1706187e33ac536ceb6f72772eb5a175d96aa7991dc6385beb700e5001d37440338b7876498b5b756a59644c03b9746c5ef835f2791c4a4a5c4d3caee745c7d0d9ff9fb382994f16c9cc4525da09ffa3ed16e15762f10bb045955199f1f325eaf31a69e6a7581681ca9d7e9a064fdfccbc9c48af18285be35b3454909598927d21ff4f7f02ed5cda54049164ab8299c9b7855fc32f37c0fc46dcb4ff58eb78bd27da061f64b49ea0bbddf44d2d5327a597ec4bb3e70654f673bbc397ae89fd66c546fcfc264f80603d4828cc4b9377e154958674da6739720a54db7cc271f68c152ceb715a788d12acb12504bac790c9a74aa26c6f3fcc05cb65cae71e6f84293de7d2538a9096fcbfbf390190c9c2c8fb207c010b8ebc84824621d83a91328ca895dc45eb6f159de0cd02c2da1c34e0ad3de4b6fb30bb014bb1b21d0a017c26a4424b91a011fc3280aaaba3603f46bc0f224d4feea0d233c71a10514d53589d7afa40779a93245bf55ff24688d911f402790af78c66e78e015fc0f64e60b0a39c1875892b53f9daf6f7030d25bfa1049bf519fc951026fc0c8395af2184be848bc0db6e6cf4a5da0a91cc6c9ebe2b5818c8c72e1409c9c84e25a69467722c9eb4f5407b492fca91c1d550a84b8f0947c2ff79bb51a7e3900cb9ad72acdfbff3dcad8ddbca295e9274fce95bf016cf4c65bd37aac8fd823319a2cae84c0677527b2fb1e67456e50871b6465bb9ac98f7a46aa8599d7a340c02e55ae5f8d743f6639f3db4a47809af352853afe87713a969a3bb72b9160dfee818aa175787d2550555a23596b6061cfb812e3b91e8d87e434ed91f6e29c43e5b4e2d705f454b6dc227a070ec320dbda339914f06fec9320812935e3dc2ef0fdbf3aff419fd19557f7aff4482d7ec51e775abc4bfb2dd1fabd20aeea5759e46283395fa42fd907af42bb8ac95e436f0c841a96fa911289b9b7d284e5f78b4eb6f6c2bce5fb4991e7272bf7e762a9b9455ccbface4473ed93afda46893a51325d62675e640ddfc2b37026e8c98ae7237a49e1e5905469977892c60bd139b15956f29fc323778c3e7266bdcac6f67ae3e111deff83b63bc0f3ec6d398ecd94d68b4454de4d5b7135e3e9166cea91dea61542bb1968970c8a88bea14081bedfa040410951611ef0328d6452515fb4638baa00d2d54eee85179afa7b2116552bbd172b6684cab26021666259253aff52683fd844fbe4a121e468e3e28abffa8c69003c511dbd0497b71c7d4687ecd5360dfdcdec68a105eedc6836421ea854de92803a992a5c63bd97151e763bb0091a82ef0d3d7063999b99fad317ba75d6827fe0ae8a2e6c301aea395dbe4c2e173c4aa4b61a2b49771a89b977d7a4be55db8acf426c2fe1d94fadaf1a086cfbc8d800a1cd9239ba5e1e29820510f039ccfaa7ecb3a4d3fddb3cb2548548acdb1b96520372b968ae052d0ecbffd89e0b6292fec53b7b2576a680261048f322cc8b76b1f3e04ed9963defed65db85cb8768cbde71af1ae6e663964954619c5de316a806f00fd6c953cd12b68e60defee037d79425d7ae5696b564adc99519e36685a5b2d87c91221e9341da6710e8f2fddd4012979487a48958e0871d5cbe2dd13f957fbb85764fa42f3e2d52583572194db4258f876f62e01f2a3e32c2599c8908b5ad4b931d5249eaeaa1cb02b06d1d4d4d0036d1e44265b75077bb74db257e96b25cb37ac27a9d58c33a6c6293a1285d073a0adfb65bcb1b0c7280686c1fd13c1bf90229feb72a0eaa496ad0c8f2c455ad3a83db2d37699466cd6c3d90da4f7c3b062c064a9e650f65f569260a2da4676a4d48c52f9e63f8971436f7f6bf00b51cd85b9036496aea9413d6ea8e7d5c1dbed3135b3fb2e776ffa25e8cc34f566e8c46285295aa3a50fb0edb1b6d6d969470fef98fd2fa40df0b851c4b2aa5f45b1ab8a604d6320dd176589937cea8b0fb5b30f62d5ade7d8fc925c47d7dd284db83555453aeef3b95e36946be9d40ecb1e0d5c0c5d7d76d9462cc91a4a994267cd85e26615cbe516536c439ade470f1b5c6cdd9b217e805a90b51042528ea6d6fb58cd97bccc8e4869bb85b9efe9a1f0affb2990497807e3510dfb8b2ea80775f6a0407f7485761b9f874a8c3871473afcf9b349b545b1ae7a6c067e10b79fcdfd79c47c04c90d1042e60", 0x1000, 0x1) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r4, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4000ffe, 0x0) 822.208007ms ago: executing program 3 (id=4624): syz_usb_connect(0x5, 0x36, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r0, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00m'], 0x38}, 0x1, 0x300, 0x0, 0x8000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pwritev2(r2, &(0x7f0000000200)=[{0x0}], 0x1, 0x5, 0xffffffff, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) syz_emit_ethernet(0x76, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 2.556407ms ago: executing program 2 (id=4625): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, 0x0, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000007880)=""/102400, 0x19000) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r2, 0xaa3a6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 0s ago: executing program 8 (id=4641): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x800) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg$unix(r4, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) kernel console output (not intermixed with test programs): 92] bridge0: port 3(netdevsim0) entered blocking state [ 913.235217][T19592] bridge0: port 3(netdevsim0) entered forwarding state [ 913.264015][ T5281] 8021q: adding VLAN 0 to HW filter on device eth5 [ 913.468088][T19597] bridge0: port 2(bridge_slave_1) entered disabled state [ 913.475671][T19597] bridge0: port 1(bridge_slave_0) entered disabled state [ 913.636528][T19597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 913.665619][T19597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 913.890895][T19625] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3444'. [ 914.867725][ T6339] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.916210][ T6339] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.068133][ T6339] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.111001][ T6339] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.376328][T19638] loop0: detected capacity change from 0 to 1024 [ 915.557329][T19638] hfsplus: failed to load extents file [ 915.760538][T12721] IPVS: stop unused estimator thread 0... [ 915.824367][T19650] bridge0: port 1(syz_tun) entered blocking state [ 915.884651][T19650] bridge0: port 1(syz_tun) entered disabled state [ 915.949267][T19650] syz_tun: entered allmulticast mode [ 917.068089][T19650] syz_tun: entered promiscuous mode [ 917.093028][T19650] bridge0: port 1(syz_tun) entered blocking state [ 917.099617][T19650] bridge0: port 1(syz_tun) entered forwarding state [ 918.087866][T19682] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3458'. [ 920.131153][T19696] overlayfs: failed to clone upperpath [ 920.362155][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 920.675110][ T5281] 8021q: adding VLAN 0 to HW filter on device eth6 [ 920.689685][ T9] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 921.380221][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.396685][ T9] usb 4-1: config 0 descriptor?? [ 921.422422][ T9] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 921.958069][T19717] ffs_data_put(): freeing [ 922.445430][ T9] gspca_cpia1: usb_control_msg 05, error -110 [ 922.478955][ T9] gspca_cpia1: usb_control_msg 01, error -32 [ 922.513291][ T9] gspca_cpia1: usb_control_msg 01, error -32 [ 922.538754][ T9] gspca_cpia1: usb_control_msg 01, error -32 [ 922.566164][ T9] gspca_cpia1: usb_control_msg 01, error -32 [ 922.591092][ T9] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 923.435800][ T5281] 8021q: adding VLAN 0 to HW filter on device eth7 [ 923.736698][T19760] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3478'. [ 924.021167][T19765] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3477'. [ 924.925336][ T5785] usb 4-1: USB disconnect, device number 6 [ 925.169000][T19771] netlink: 'syz.4.3481': attribute type 10 has an invalid length. [ 925.201356][T19761] batadv_slave_1: entered promiscuous mode [ 925.237958][T19771] syz_tun: entered promiscuous mode [ 925.291103][T19771] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 925.932615][T19787] tipc: Enabling of bearer rejected, already enabled [ 927.876659][T19825] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3496'. [ 929.235614][ T5281] 8021q: adding VLAN 0 to HW filter on device eth8 [ 929.270340][T15817] Bluetooth: hci9: ACL packet for unknown connection handle 200 [ 929.299167][T15817] Bluetooth: hci9: ACL packet for unknown connection handle 200 [ 929.327179][T15817] Bluetooth: hci9: ACL packet for unknown connection handle 200 [ 929.335536][T15817] Bluetooth: hci9: ACL packet for unknown connection handle 200 [ 929.381666][T15817] Bluetooth: hci9: ACL packet for unknown connection handle 200 [ 930.482131][T19865] fuse: fd is not a fuse device [ 931.869886][T19888] loop0: detected capacity change from 0 to 256 [ 932.067374][T19895] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3515'. [ 932.099372][T19894] uprobe: syz.7.3516:19894 failed to unregister, leaking uprobe [ 933.859902][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 936.223980][T19950] ohci-platform serial8250: error -ENXIO: IRQ index 0 not found [ 937.311152][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 937.516198][T19968] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3534'. [ 938.303312][ T10] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 938.366838][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.456580][ T10] usb 2-1: config 0 descriptor?? [ 938.717252][ T10] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 940.133699][ T10] gspca_cpia1: usb_control_msg 05, error -110 [ 940.176953][ T10] gspca_cpia1: usb_control_msg 01, error -32 [ 940.201636][ T10] gspca_cpia1: usb_control_msg 01, error -32 [ 940.225702][ T10] gspca_cpia1: usb_control_msg 01, error -71 [ 940.248278][ T10] cpia1 2-1:0.0: only firmware version 1 is supported (got: 0) [ 940.312577][ T10] usb 2-1: USB disconnect, device number 7 [ 940.388150][T19991] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3539'. [ 940.433003][T19991] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3539'. [ 940.994085][T20013] netlink: 'syz.4.3547': attribute type 1 has an invalid length. [ 942.065826][T20013] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 942.082718][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 942.497082][T20026] syz.9.3549 (20026) used obsolete PPPIOCDETACH ioctl [ 942.550683][T20028] loop9: detected capacity change from 0 to 512 [ 943.036997][T20028] EXT4-fs (loop9): failed to open journal device unknown-block(0,0) -ENXIO [ 943.270956][ T30] audit: type=1326 audit(1785443900.330:643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f365b99e019 code=0x0 [ 943.308246][T20055] IPv6: NLM_F_REPLACE set, but no existing node found! [ 943.357095][ T30] audit: type=1326 audit(1785443900.460:644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f365b99e019 code=0x7ffc0000 [ 943.387572][ T30] audit: type=1326 audit(1785443900.490:645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 943.434970][ T30] audit: type=1326 audit(1785443900.490:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f365b99e019 code=0x7ffc0000 [ 943.548674][ T30] audit: type=1326 audit(1785443900.490:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 943.655282][T15817] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 943.766155][ T30] audit: type=1326 audit(1785443900.540:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 944.168764][ T30] audit: type=1326 audit(1785443900.540:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 944.471054][ T30] audit: type=1326 audit(1785443900.570:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 944.626099][ T30] audit: type=1326 audit(1785443900.570:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 944.674502][ T30] audit: type=1326 audit(1785443900.570:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20043 comm="syz.3.3555" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f365b95e84e code=0x7ffc0000 [ 945.389956][T20071] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3572'. [ 945.502668][T20073] loop9: detected capacity change from 0 to 512 [ 945.586964][T20073] EXT4-fs error (device loop9): ext4_orphan_get:1399: inode #15: comm syz.9.3559: inode has both inline data and extents flags [ 945.675735][T20073] loop9: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 945.680622][ C1] EXT4-fs (loop9): error count since last fsck: 1 [ 945.696380][ C1] EXT4-fs (loop9): initial error at time 1785443902: ext4_orphan_get:1399: inode 15 [ 945.705878][ C1] EXT4-fs (loop9): last error at time 1785443902: ext4_orphan_get:1399: inode 15 [ 945.742899][T20073] EXT4-fs error (device loop9): ext4_orphan_get:1402: comm syz.9.3559: couldn't read orphan inode 15 (err -117) [ 945.800219][T20073] loop9: lost filesystem error report for type 5 error -117 [ 945.818868][T20073] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 946.205977][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 946.212512][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 946.533945][T16605] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 946.881295][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3 [ 949.058543][T16620] ffs_data_put(): freeing [ 950.680522][T16622] Bluetooth: hci3: command 0x0406 tx timeout [ 951.978095][ T5281] 8021q: adding VLAN 0 to HW filter on device eth4 [ 952.088273][T20171] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3588'. [ 952.189244][T20173] bridge3: port 1(dummy0) entered blocking state [ 952.265325][T20173] bridge3: port 1(dummy0) entered disabled state [ 952.357606][T20171] netlink: 'syz.4.3588': attribute type 10 has an invalid length. [ 952.385566][T20173] dummy0: entered allmulticast mode [ 952.426790][T20171] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3588'. [ 952.434801][T20173] dummy0: entered promiscuous mode [ 952.590044][T20171] bridge3: port 1(dummy0) entered blocking state [ 952.596649][T20171] bridge3: port 1(dummy0) entered forwarding state [ 952.718516][T20171] dummy0: left allmulticast mode [ 952.743406][T20171] bridge3: port 1(dummy0) entered disabled state [ 958.925533][T20239] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3605'. [ 959.875030][T20244] bridge1: port 1(dummy0) entered blocking state [ 959.973742][T20239] netlink: 'syz.0.3605': attribute type 10 has an invalid length. [ 959.973760][T20244] bridge1: port 1(dummy0) entered disabled state [ 959.973979][T20244] dummy0: entered allmulticast mode [ 960.300210][T20239] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3605'. [ 961.161982][T20244] dummy0: entered promiscuous mode [ 961.276138][T20256] type mismatch for 100000,100000 old: write-back new: write-combining [ 961.286060][T20239] bridge1: port 1(dummy0) entered blocking state [ 961.292561][T20239] bridge1: port 1(dummy0) entered forwarding state [ 961.315255][T20256] type mismatch for 200000,100000 old: write-back new: write-combining [ 961.337935][T20239] dummy0: left allmulticast mode [ 961.377423][T20239] bridge1: port 1(dummy0) entered disabled state [ 961.382737][T20256] type mismatch for 300000,100000 old: write-back new: write-combining [ 961.435597][T20260] type mismatch for 400000,100000 old: write-back new: write-combining [ 961.494286][T20256] type mismatch for 500000,100000 old: write-back new: write-combining [ 961.555187][T20256] type mismatch for 600000,100000 old: write-back new: write-combining [ 961.625071][T20260] type mismatch for 700000,100000 old: write-back new: write-combining [ 961.695740][T20256] type mismatch for 800000,100000 old: write-back new: write-combining [ 961.759355][T20266] type mismatch for 0000,200000 old: write-back new: write-combining [ 961.854851][T20264] loop3: detected capacity change from 0 to 512 [ 961.915061][T20264] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 962.235461][T20277] ohci-platform serial8250: error -ENXIO: IRQ index 0 not found [ 962.336549][T20280] loop1: detected capacity change from 0 to 128 [ 962.411270][T20280] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 962.541752][T20280] ext4 filesystem being mounted at /121/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 962.554153][T20264] EXT4-fs error (device loop3): ext4_validate_block_bitmap:440: comm syz.3.3614: bg 0: block 393: padding at end of block bitmap is not set [ 962.610782][T20264] loop3: lost filesystem error report for type 5 error -117 [ 962.619657][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 962.633514][ C0] EXT4-fs (loop3): initial error at time 1785443919: ext4_validate_block_bitmap:440 [ 962.642977][ C0] EXT4-fs (loop3): last error at time 1785443919: ext4_validate_block_bitmap:440 [ 962.663344][T20280] syz.1.3616 (pid 20280) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 962.679486][T20264] EXT4-fs (loop3): Remounting filesystem read-only [ 962.729051][T20264] EXT4-fs (loop3): 2 truncates cleaned up [ 962.777062][T20264] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 962.966437][T16619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 962.980523][T20280] fscrypt: Adiantum using implementation "adiantum(xchacha12-lib,aes-lib)" [ 963.368935][T20280] overlayfs: failed to create directory ./bus/work (errno: 28); mounting read-only [ 964.475504][T16620] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 964.958694][T20326] netlink: 12 bytes leftover after parsing attributes in process `syz.9.3627'. [ 965.571810][T20333] netlink: 'syz.9.3627': attribute type 10 has an invalid length. [ 965.629939][T20333] netlink: 40 bytes leftover after parsing attributes in process `syz.9.3627'. [ 966.255930][T20355] loop1: detected capacity change from 0 to 128 [ 966.403945][T20355] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 966.431375][T20355] ext4 filesystem being mounted at /124/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 966.561799][T16620] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 966.728763][T20363] netdevsim netdevsim7: Firmware load for '../file0/file0' refused, path contains '..' component [ 967.215217][T20368] netlink: 'syz.1.3637': attribute type 1 has an invalid length. [ 967.341396][T20370] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3637'. [ 969.544922][T20334] batman_adv: batadv0: Interface deactivated: dummy0 [ 969.556268][T20334] batman_adv: batadv0: Removing interface: dummy0 [ 969.590564][T20333] dummy0: entered promiscuous mode [ 969.755575][T20379] overlayfs: failed to clone upperpath [ 970.010701][T20369] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 970.145522][T20370] 8021q: adding VLAN 0 to HW filter on device bond1 [ 972.652943][T20408] loop0: detected capacity change from 0 to 1024 [ 972.723526][T20408] hfsplus: Unknown parameter '&' [ 974.562460][T20421] loop1: detected capacity change from 0 to 4096 [ 974.987870][T20421] ntfs3(loop1): Failed to load $Extend (-22). [ 975.034306][T20421] ntfs3(loop1): Failed to initialize $Extend. [ 975.071268][T20439] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3657'. [ 975.167043][T20442] netlink: 'syz.3.3657': attribute type 10 has an invalid length. [ 975.255627][T20442] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3657'. [ 976.453685][T20442] dummy0: entered promiscuous mode [ 981.135826][T20494] bridge0: port 4(vxlan0) entered blocking state [ 981.162365][T20494] bridge0: port 4(vxlan0) entered disabled state [ 981.205748][T20494] vxlan0: entered allmulticast mode [ 981.228397][T20494] vxlan0: entered promiscuous mode [ 984.040072][T20520] binder: 20505:20520 ioctl c0306201 200000000c00 returned -22 [ 984.317745][T20510] loop1: detected capacity change from 0 to 8192 [ 985.238634][ C0] tipc: RX(1000001): key[1] is activated [ 985.811806][T20548] loop0: detected capacity change from 0 to 128 [ 986.001928][T20548] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 986.050440][T20548] ext4 filesystem being mounted at /144/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 987.512783][T20564] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3677'. [ 987.621702][T20572] batman_adv: batadv0: Interface deactivated: dummy0 [ 987.826368][T20573] netlink: 'syz.1.3677': attribute type 10 has an invalid length. [ 988.631013][T20573] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3677'. [ 988.662304][T20572] batman_adv: batadv0: Removing interface: dummy0 [ 988.810875][T20585] netlink: 'syz.3.3687': attribute type 1 has an invalid length. [ 988.855715][T20573] dummy0: entered promiscuous mode [ 988.985389][T20587] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3687'. [ 989.253595][T20583] bond1: (slave veth0_to_bond): making interface the new active one [ 989.301884][T16641] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 989.346483][T20583] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 989.410657][T20587] 8021q: adding VLAN 0 to HW filter on device bond1 [ 989.824844][T20600] binder: 20599:20600 unknown command 0 [ 989.859627][T20600] binder: 20599:20600 ioctl c0306201 2000000001c0 returned -22 [ 993.601576][T20624] xt_CT: You must specify a L4 protocol and not use inversions on it [ 997.067050][T20664] netlink: 'syz.4.3707': attribute type 1 has an invalid length. [ 997.338491][T20671] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3707'. [ 997.427172][T20675] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 997.434570][T20675] overlayfs: failed to set xattr on upper [ 997.440399][T20675] overlayfs: ...falling back to redirect_dir=nofollow. [ 997.447252][T20675] overlayfs: ...falling back to index=off. [ 997.453139][T20675] overlayfs: ...falling back to uuid=null. [ 997.525673][T20675] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 997.686403][T20669] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 997.780381][T20671] 8021q: adding VLAN 0 to HW filter on device bond1 [ 998.086239][T20686] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3714'. [ 1002.629523][T20735] fuse: fd is not a fuse device [ 1007.802520][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1007.809101][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1012.187310][T11259] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1012.386968][T11259] usb 2-1: Using ep0 maxpacket: 16 [ 1012.431484][T11259] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 1012.470262][T11259] usb 2-1: config 0 has no interface number 0 [ 1012.499937][T11259] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 1012.544940][T11259] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 1012.614741][T11259] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 1012.653680][T11259] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.691682][T11259] usb 2-1: Product: syz [ 1012.711789][T11259] usb 2-1: Manufacturer: syz [ 1012.730726][T11259] usb 2-1: SerialNumber: syz [ 1012.813711][T11259] usb 2-1: config 0 descriptor?? [ 1012.847659][T20797] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1012.910260][T20797] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1013.271959][T20797] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1013.364126][T20797] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1013.640725][T11259] asix 2-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1013.865663][T20813] loop9: detected capacity change from 0 to 512 [ 1013.928435][T20813] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 1014.007095][T20813] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 1014.081453][T20813] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 1014.149165][T20813] System zones: 1-12 [ 1014.306537][T20813] EXT4-fs (loop9): 1 truncate cleaned up [ 1014.366525][T20813] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1015.959849][T11259] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1016.740090][T11259] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 1016.806055][T16605] EXT4-fs error (device loop9): ext4_lookup:1785: inode #14: comm syz-executor: invalid fast symlink length 39 [ 1016.818936][T11259] asix 2-1:0.34: probe with driver asix failed with error -71 [ 1016.920023][T11259] usb 2-1: USB disconnect, device number 8 [ 1017.031254][T16605] EXT4-fs error (device loop9): ext4_lookup:1785: inode #14: comm syz-executor: invalid fast symlink length 39 [ 1018.668551][T12279] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1020.059735][T12279] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1021.924952][T12279] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1024.582058][T16605] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1024.715482][T12279] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1024.755756][T20905] loop1: detected capacity change from 0 to 1024 [ 1024.774542][T20908] loop3: detected capacity change from 0 to 512 [ 1024.927154][T20905] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 1025.738856][T20905] workqueue: Failed to create a rescuer kthread for wq "ext4-rsv-conversion": -EINTR [ 1025.969739][T20905] EXT4-fs: failed to create workqueue [ 1026.006612][T20908] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1026.034980][T20907] loop0: detected capacity change from 0 to 131072 [ 1026.043880][T20907] xfs: Deprecated parameter 'ikeep' [ 1026.049611][T20907] XFS: ikeep mount option is deprecated. [ 1026.110912][T20907] XFS (loop0): Mounting V5 Filesystem b93a8937-ccd4-41a2-86c7-66a1570a2846 [ 1026.114227][T20905] EXT4-fs (loop1): mount failed [ 1026.135139][T20908] ext4 filesystem being mounted at /139/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 1026.266273][T20896] net_ratelimit: 10 callbacks suppressed [ 1026.266300][T20896] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 1026.696053][T20907] XFS (loop0): Starting recovery (logdev: internal) [ 1026.776985][T20907] XFS (loop0): Ending recovery (logdev: internal) [ 1027.425631][T20942] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1028.035035][T16619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1028.390526][T16622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1028.413503][T16622] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1028.423585][T16622] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1028.440673][T16622] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1028.441346][T20955] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3774'. [ 1028.451267][T16622] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1028.568812][T20958] loop3: detected capacity change from 0 to 128 [ 1028.705871][T20958] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1028.747292][T20958] ext4 filesystem being mounted at /140/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1028.774915][T16641] XFS (loop0): Unmounting Filesystem b93a8937-ccd4-41a2-86c7-66a1570a2846 [ 1029.254531][T20971] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1029.264230][T20971] overlayfs: failed to set xattr on upper [ 1029.270060][T20971] overlayfs: ...falling back to redirect_dir=nofollow. [ 1029.276978][T20971] overlayfs: ...falling back to index=off. [ 1029.282785][T20971] overlayfs: ...falling back to uuid=null. [ 1029.404095][T20971] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 1029.458103][T12279] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 1029.480040][T20974] fuse: fd is not a fuse device [ 1030.791667][T16622] Bluetooth: hci0: command tx timeout [ 1031.179085][T12279] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 1031.243578][T12279] bridge1 (unregistering): left promiscuous mode [ 1031.386392][T12279] bond0 (unregistering): Released all slaves [ 1032.329804][T12279] bond1 (unregistering): Released all slaves [ 1032.594245][T12279] bond2 (unregistering): Released all slaves [ 1033.322302][T15817] Bluetooth: hci0: command tx timeout [ 1033.593737][T16619] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1034.971705][T21022] loop3: detected capacity change from 0 to 1024 [ 1035.273225][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 1035.273252][ T30] audit: type=1326 audit(1785443992.386:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1035.402387][T16622] Bluetooth: hci0: command tx timeout [ 1035.425762][ T30] audit: type=1326 audit(1785443992.426:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1035.539800][ T30] audit: type=1326 audit(1785443992.426:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1035.690268][ T30] audit: type=1326 audit(1785443992.426:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1035.814960][ T30] audit: type=1326 audit(1785443992.436:720): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1035.857962][T12279] hsr_slave_0: left promiscuous mode [ 1035.906646][ T30] audit: type=1326 audit(1785443992.466:721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1035.912502][T12279] hsr_slave_1: left promiscuous mode [ 1035.932951][ T30] audit: type=1326 audit(1785443992.466:722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1036.023908][ T30] audit: type=1326 audit(1785443992.846:723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1036.144654][T12279] virt_wifi0: left promiscuous mode [ 1036.159655][T12279] veth1_macvtap: left promiscuous mode [ 1036.163042][ T30] audit: type=1326 audit(1785443992.846:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1036.188254][T12279] veth0_macvtap: left promiscuous mode [ 1036.205288][T12279] veth1_vlan: left promiscuous mode [ 1036.248337][T12279] veth0_vlan: left promiscuous mode [ 1036.317815][ T30] audit: type=1326 audit(1785443992.856:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21032 comm="syz.0.3772" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f8dabb9e019 code=0x7ffc0000 [ 1036.438480][T21055] fuse: fd is not a fuse device [ 1036.459739][T21053] loop1: detected capacity change from 0 to 2048 [ 1036.514994][T21053] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=2362, location=2362 [ 1036.553266][T21053] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 1036.617631][T21053] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 1036.673250][T21053] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1037.476357][T16622] Bluetooth: hci0: command tx timeout [ 1038.031393][T16620] UDF-fs: error (device loop1): udf_read_inode: (ino 1345) failed !bh [ 1038.334290][T16620] UDF-fs: error (device loop1): udf_read_inode: (ino 1345) failed !bh [ 1038.375055][T21071] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3799'. [ 1038.774202][T16620] bridge0: port 1(syz_tun) entered disabled state [ 1039.671502][T16620] syz_tun (unregistering): left allmulticast mode [ 1039.710731][T16620] syz_tun (unregistering): left promiscuous mode [ 1039.734102][T16620] bridge0: port 1(syz_tun) entered disabled state [ 1041.304773][T20949] bridge0: port 1(bridge_slave_0) entered blocking state [ 1041.356329][T20949] bridge0: port 1(bridge_slave_0) entered disabled state [ 1041.387229][T20949] bridge_slave_0: entered allmulticast mode [ 1041.471775][T20949] bridge_slave_0: entered promiscuous mode [ 1041.543188][T20949] bridge0: port 2(bridge_slave_1) entered blocking state [ 1041.586534][T20949] bridge0: port 2(bridge_slave_1) entered disabled state [ 1041.621471][T20949] bridge_slave_1: entered allmulticast mode [ 1041.664126][T20949] bridge_slave_1: entered promiscuous mode [ 1042.922914][T15817] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1042.959455][T15817] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1042.971210][T15817] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1042.984447][T15817] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1042.991675][T20949] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1043.006834][T15817] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1043.145051][T20949] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1043.416237][T20949] team0: Port device team_slave_0 added [ 1044.448872][T20949] team0: Port device team_slave_1 added [ 1045.059339][T20949] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1045.085270][T15817] Bluetooth: hci1: command tx timeout [ 1045.103295][T20949] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1045.242756][T20949] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1045.279439][T20949] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1045.313257][T20949] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1045.848205][T20949] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1046.240131][T20949] hsr_slave_0: entered promiscuous mode [ 1046.269806][T20949] hsr_slave_1: entered promiscuous mode [ 1046.303840][T20949] debugfs: 'hsr0' already exists in 'hsr' [ 1046.331481][T20949] Cannot create hsr debugfs directory [ 1047.060724][T21194] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3823'. [ 1047.155309][T15817] Bluetooth: hci1: command tx timeout [ 1047.348556][T21200] netlink: 'syz.7.3824': attribute type 11 has an invalid length. [ 1047.390449][ T5281] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1047.789519][T21212] Mass Storage Function, version: 2009/09/11 [ 1047.846303][T21212] LUN: removable file: (no medium) [ 1048.108334][T21212] mass_storage.usb0/lun.0: file too small: file0 [ 1048.511715][T21219] tipc: Started in network mode [ 1048.540438][T21219] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 1048.553394][T21219] tipc: Enabled bearer , priority 10 [ 1048.609522][T15817] block nbd0: Receive control failed (result -32) [ 1048.616832][T21214] block nbd0: shutting down sockets [ 1049.204266][T21231] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3831'. [ 1049.234921][T15817] Bluetooth: hci1: command tx timeout [ 1051.592452][T15817] Bluetooth: hci1: command tx timeout [ 1051.600185][ T5749] tipc: Node number set to 43690 [ 1051.663937][T21248] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1053.661737][T21135] bridge0: port 1(bridge_slave_0) entered blocking state [ 1053.669415][T21135] bridge0: port 1(bridge_slave_0) entered disabled state [ 1053.694809][T21135] bridge_slave_0: entered allmulticast mode [ 1053.708242][T21135] bridge_slave_0: entered promiscuous mode [ 1053.728486][T21135] bridge0: port 2(bridge_slave_1) entered blocking state [ 1053.744826][T21135] bridge0: port 2(bridge_slave_1) entered disabled state [ 1053.762510][T21135] bridge_slave_1: entered allmulticast mode [ 1053.783994][T21135] bridge_slave_1: entered promiscuous mode [ 1053.826163][T11232] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1053.884787][ T5281] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1053.964746][T21135] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1054.004230][T11232] usb 4-1: config 1 has an invalid descriptor of length 105, skipping remainder of the config [ 1054.042081][T11232] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1054.075075][T11232] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1054.113629][T11232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1054.135457][T11232] usb 4-1: SerialNumber: syz [ 1054.317585][T21135] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1054.478803][T21135] team0: Port device team_slave_0 added [ 1054.499822][T21135] team0: Port device team_slave_1 added [ 1054.551288][T21271] loop3: detected capacity change from 0 to 512 [ 1054.601181][T21271] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 1055.414878][T21271] EXT4-fs error (device loop3): ext4_orphan_get:1425: comm syz.3.3839: bad orphan inode 131083 [ 1055.468411][T21271] loop3: lost filesystem error report for type 5 error -117 [ 1055.483268][T21271] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1055.704273][T21135] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1055.730284][T21135] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1055.788341][T21135] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1055.838543][T21135] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1055.858216][T21135] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1055.901791][T11232] usb 4-1: 0:2 : does not exist [ 1055.940985][T21135] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1055.955652][T21294] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3844'. [ 1056.246520][T21300] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3846'. [ 1056.299695][T21135] hsr_slave_0: entered promiscuous mode [ 1056.319212][T21135] hsr_slave_1: entered promiscuous mode [ 1056.356712][T21135] debugfs: 'hsr0' already exists in 'hsr' [ 1056.368487][T21135] Cannot create hsr debugfs directory [ 1056.401161][T11232] usb 4-1: USB disconnect, device number 7 [ 1056.428564][T16619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1056.548924][T20949] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1056.631305][T20949] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1056.845783][T21312] fuse: fd is not a fuse device [ 1057.145990][T21321] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1057.743217][T16725] udevd[16725]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1057.848134][T20949] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1057.868184][T20949] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1057.876902][T20949] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1057.948444][T20949] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1057.992948][T20949] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1058.036367][T20949] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1058.356737][T11232] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1058.473183][T20949] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1058.548695][T11232] usb 4-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1058.575280][T11232] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1058.600602][T11232] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1058.627552][T11232] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1058.645590][T11232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1058.669808][T21330] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1058.831240][T21345] loop0: detected capacity change from 0 to 2048 [ 1058.963205][T21345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1059.072909][T20949] 8021q: adding VLAN 0 to HW filter on device team0 [ 1059.148895][T12279] bridge0: port 1(bridge_slave_0) entered blocking state [ 1059.150695][T21345] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 1059.156161][T12279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1059.257052][T21345] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 16 with max blocks 17 with error 28 [ 1059.285814][T21345] EXT4-fs (loop0): This should not happen!! Data will be lost [ 1059.285814][T21345] [ 1059.304812][T21345] EXT4-fs (loop0): Total free blocks count 0 [ 1059.324355][T21345] EXT4-fs (loop0): Free/Dirty block details [ 1059.359143][T21345] EXT4-fs (loop0): free_blocks=4096 [ 1059.369298][T21345] EXT4-fs (loop0): dirty_blocks=32 [ 1059.396943][T21345] EXT4-fs (loop0): Block reservation details [ 1059.410181][T21345] EXT4-fs (loop0): i_reserved_data_blocks=2 [ 1059.480860][T12279] bridge0: port 2(bridge_slave_1) entered blocking state [ 1059.488115][T12279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1059.512657][ T5281] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1059.561111][T21355] EXT4-fs (loop0): Delayed block allocation failed for inode 16 at logical offset 16 with max blocks 16 with error 28 [ 1059.802928][T16641] EXT4-fs warning (device loop0): ext4_evict_inode:195: inode #16: comm syz-executor: data will be lost [ 1060.556748][T21135] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1060.587418][T21135] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1060.608064][T21135] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1060.626184][T21135] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1060.635588][T21135] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1060.651145][T21135] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1060.672458][T21135] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1060.690357][T21135] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1060.858888][T21135] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1060.922000][T21135] 8021q: adding VLAN 0 to HW filter on device team0 [ 1060.957246][T10781] bridge0: port 1(bridge_slave_0) entered blocking state [ 1060.964494][T10781] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1061.045970][T12710] bridge0: port 2(bridge_slave_1) entered blocking state [ 1061.053217][T12710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1061.133330][ T5281] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1061.359837][T20949] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1061.981551][T11232] aiptek 4-1:17.0: Aiptek using 400 ms programming speed [ 1062.021663][T11232] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:17.0/input/input15 [ 1062.141792][T21135] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1062.170834][T11232] usb 4-1: USB disconnect, device number 8 [ 1062.176907][ C0] aiptek 4-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1062.241408][T20949] veth0_vlan: entered promiscuous mode [ 1062.308847][T20949] veth1_vlan: entered promiscuous mode [ 1062.441742][T20949] veth0_macvtap: entered promiscuous mode [ 1062.461708][T21135] veth0_vlan: entered promiscuous mode [ 1062.477878][T20949] veth1_macvtap: entered promiscuous mode [ 1062.517649][T21135] veth1_vlan: entered promiscuous mode [ 1062.565160][T20949] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1062.627417][T20949] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1062.654820][T12279] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1062.665776][T12279] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1062.680129][T12279] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1062.708456][T12279] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1062.775439][T21135] veth0_macvtap: entered promiscuous mode [ 1062.847318][T21135] veth1_macvtap: entered promiscuous mode [ 1062.997425][T21135] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1063.035026][T12710] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1063.058981][T12710] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1063.107207][T21135] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1063.143085][T12721] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.153143][T12721] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.172222][T10782] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1063.179311][T12721] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.195652][T10782] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1063.204760][T12721] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.462792][T10782] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1063.506563][T10782] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1065.262463][T10782] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1065.330495][T10782] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1066.031292][T21465] loop2: detected capacity change from 0 to 512 [ 1066.081602][T21465] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1066.267908][T21465] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 1066.620572][T21465] EXT4-fs (loop2): 1 truncate cleaned up [ 1066.696525][T21465] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1068.462532][T21135] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1069.079811][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1069.087122][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1071.945651][T21558] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1072.879512][T21565] loop5: detected capacity change from 0 to 512 [ 1072.980007][T21565] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 1073.095005][T21565] EXT4-fs (loop5): 1 truncate cleaned up [ 1073.134482][T21565] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1074.736296][T20949] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1077.393460][ C0] tipc: RX(1000001): key[1] is activated [ 1077.695308][T21620] netlink: 104 bytes leftover after parsing attributes in process `syz.7.3900'. [ 1080.565433][T21641] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1084.391849][T21692] tipc: Started in network mode [ 1084.405583][T21692] tipc: Node identity 7f000001, cluster identity 4711 [ 1084.449589][T21692] tipc: Enabled bearer , priority 10 [ 1084.476525][T21692] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3930'. [ 1084.541504][T21692] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 1084.617412][T21692] tipc: Enabled bearer , priority 10 [ 1085.683169][T11275] tipc: Node number set to 2130706433 [ 1087.847124][T21726] syzkaller0: entered promiscuous mode [ 1088.147645][T21727] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1088.183919][T21726] syzkaller0: entered allmulticast mode [ 1088.336518][T21718] tipc: Started in network mode [ 1088.411272][T21718] tipc: Node identity d6c96b4d1ba7, cluster identity 4711 [ 1088.499099][T21718] tipc: Enabled bearer , priority 0 [ 1088.568892][T21715] tipc: Resetting bearer [ 1088.814452][T21737] netlink: 'syz.3.3926': attribute type 2 has an invalid length. [ 1089.639177][T21715] tipc: Disabling bearer [ 1089.811506][ T5785] tipc: Node number set to 3446565709 [ 1091.648910][T21772] netlink: 'syz.3.3936': attribute type 10 has an invalid length. [ 1091.803985][T21773] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1092.047994][T21776] ffs_data_put(): freeing [ 1094.166978][T21798] netlink: 11 bytes leftover after parsing attributes in process `syz.0.3943'. [ 1094.248852][T21800] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3943'. [ 1094.318743][T21794] tipc: Resetting bearer [ 1095.465160][T21794] dummy0: left promiscuous mode [ 1096.272801][T21794] macsec1: left promiscuous mode [ 1096.418776][T21739] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.464520][T21739] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.493786][T21739] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.536345][T21739] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.885104][T21856] fuse: fd is not a fuse device [ 1097.993409][T21861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3958'. [ 1098.023081][T21861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3958'. [ 1098.096572][T21865] loop3: detected capacity change from 0 to 2048 [ 1098.163821][T21865] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1098.280472][ T30] kauditd_printk_skb: 71 callbacks suppressed [ 1098.280500][ T30] audit: type=1800 audit(1785444055.389:797): pid=21865 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3957" name="bus" dev="loop3" ino=1367 res=0 errno=0 [ 1099.556709][T21873] loop0: detected capacity change from 0 to 512 [ 1099.627461][T21873] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 1099.643078][T21876] netlink: 'syz.4.3971': attribute type 2 has an invalid length. [ 1099.704491][T21873] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 1099.734652][T21873] System zones: 1-12 [ 1099.813212][T21873] EXT4-fs (loop0): 1 truncate cleaned up [ 1099.880477][T21873] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1101.317035][T21900] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3966'. [ 1101.828747][T16641] EXT4-fs error (device loop0): ext4_lookup:1785: inode #14: comm syz-executor: invalid fast symlink length 39 [ 1101.905905][T16641] EXT4-fs error (device loop0): ext4_lookup:1785: inode #14: comm syz-executor: invalid fast symlink length 39 [ 1102.259007][T19178] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1106.272742][T21943] loop3: detected capacity change from 0 to 512 [ 1106.327754][T21943] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 1106.408722][T21943] EXT4-fs (loop3): 1 truncate cleaned up [ 1106.497883][T21943] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1106.888365][T21962] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1107.522019][T16622] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1107.541042][T16622] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1107.558930][T16622] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1107.570971][T16622] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1107.581376][T16622] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1107.908784][T16619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1108.004796][T21977] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3987'. [ 1108.038410][T21977] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3987'. [ 1108.038732][T21979] loop5: detected capacity change from 0 to 512 [ 1108.059075][T21977] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3987'. [ 1108.156894][T21979] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 1108.237752][T21979] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 1108.251920][T21979] System zones: 1-12 [ 1108.298150][T21979] EXT4-fs (loop5): 1 truncate cleaned up [ 1108.397754][T21979] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1109.683830][T15817] Bluetooth: hci3: command tx timeout [ 1109.940463][T22010] netlink: 'syz.4.3990': attribute type 1 has an invalid length. [ 1109.984639][T22010] netlink: 'syz.4.3990': attribute type 4 has an invalid length. [ 1110.023680][T22010] netlink: 15334 bytes leftover after parsing attributes in process `syz.4.3990'. [ 1110.208994][T20949] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1110.294255][T11271] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1110.461462][T11271] usb 3-1: Using ep0 maxpacket: 16 [ 1110.469531][T11271] usb 3-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1110.482893][T11271] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1110.489639][T11271] usb 3-1: New USB device found, idVendor=6666, idProduct=8802, bcdDevice= 0.00 [ 1110.499370][T11271] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.526166][T11271] usb 3-1: config 0 descriptor?? [ 1111.712309][T15817] Bluetooth: hci3: command tx timeout [ 1111.713037][T11271] smartjoyplus 0003:6666:8802.0008: hidraw0: USB HID v10.01 Device [HID 6666:8802] on usb-dummy_hcd.2-1/input0 [ 1111.730167][T11271] smartjoyplus 0003:6666:8802.0008: no output reports found [ 1111.776113][T11271] usb 3-1: USB disconnect, device number 6 [ 1113.029052][T22042] fido_id[22042]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 1113.517365][T22065] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4002'. [ 1113.881438][T15817] Bluetooth: hci3: command tx timeout [ 1114.893121][T21965] bridge0: port 1(bridge_slave_0) entered blocking state [ 1114.934336][T21965] bridge0: port 1(bridge_slave_0) entered disabled state [ 1114.966245][T21965] bridge_slave_0: entered allmulticast mode [ 1115.006008][T21965] bridge_slave_0: entered promiscuous mode [ 1115.066000][T21965] bridge0: port 2(bridge_slave_1) entered blocking state [ 1115.105536][T21965] bridge0: port 2(bridge_slave_1) entered disabled state [ 1115.148186][T21965] bridge_slave_1: entered allmulticast mode [ 1115.198577][T21965] bridge_slave_1: entered promiscuous mode [ 1115.246777][T22086] tipc: Enabling of bearer rejected, failed to enable media [ 1115.404038][T21965] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1115.508894][T21965] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1116.001319][T15817] Bluetooth: hci3: command tx timeout [ 1117.496776][T21965] team0: Port device team_slave_0 added [ 1117.537271][T21965] team0: Port device team_slave_1 added [ 1117.720322][T21965] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1117.753051][T21965] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1117.887121][T21965] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1117.972443][T21965] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1119.117369][T21965] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.407086][T21965] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1119.571110][T21965] hsr_slave_0: entered promiscuous mode [ 1119.628987][T21965] hsr_slave_1: entered promiscuous mode [ 1119.756546][T21965] debugfs: 'hsr0' already exists in 'hsr' [ 1119.806281][T21965] Cannot create hsr debugfs directory [ 1125.935557][T22183] bond1 (unregistering): Released all slaves [ 1126.597598][T22209] fuse: fd is not a fuse device [ 1130.512235][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1130.518660][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1130.772510][T21965] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1131.048728][T21965] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1131.084305][T21965] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1132.037259][T21965] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1132.357744][T21965] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1133.003900][T21965] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1133.058211][T21965] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1133.136705][T21965] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1134.717796][T22283] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1134.748057][T21965] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1134.777567][T22285] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4049'. [ 1134.867823][T22283] IPVS: persistence engine module ip_vs_pe_‘‚ not found [ 1134.878348][T22290] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4049'. [ 1134.952795][T22290] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4049'. [ 1135.004226][T22285] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1135.064001][T22295] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 1, id = 0 [ 1135.137151][T22290] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1135.180579][T22290] bond1: (slave bond0): making interface the new active one [ 1135.220805][T22290] bond1: (slave bond0): Enslaving as an active interface with an up link [ 1135.254551][T21965] 8021q: adding VLAN 0 to HW filter on device team0 [ 1135.325591][T12279] bridge0: port 1(bridge_slave_0) entered blocking state [ 1135.332840][T12279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1135.416013][T21709] bridge0: port 2(bridge_slave_1) entered blocking state [ 1135.423235][T21709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1136.539418][T21965] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1137.043849][T21965] veth0_vlan: entered promiscuous mode [ 1137.078744][T21965] veth1_vlan: entered promiscuous mode [ 1137.126757][T21965] veth0_macvtap: entered promiscuous mode [ 1137.139155][T21965] veth1_macvtap: entered promiscuous mode [ 1137.176954][T21965] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1137.197110][T21965] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1137.216573][T12721] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1137.247365][T12721] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1137.265965][T12721] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1137.279497][T12721] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1137.445595][T12721] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1137.473088][T12721] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1137.540015][ T123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1137.553285][ T123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1139.459295][T22362] loop8: detected capacity change from 0 to 32768 [ 1139.486158][T22362] BTRFS: device fsid 3a375e4e-b156-4d76-a2ad-16e198ce1409 devid 1 transid 8 /dev/loop8 (7:8) scanned by syz.8.3978 (22362) [ 1139.526299][T22362] BTRFS info (device loop8): first mount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409 [ 1139.539095][T22362] BTRFS info (device loop8): using xxhash64 checksum algorithm [ 1139.645097][T22362] BTRFS info (device loop8): enabling ssd optimizations [ 1139.663386][T22362] BTRFS info (device loop8): turning on async discard [ 1139.697542][T22362] BTRFS info (device loop8): enabling free space tree [ 1139.941620][ T30] audit: type=1804 audit(1785444097.061:798): pid=22393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.3978" name="/newroot/0/file0/bus" dev="loop8" ino=263 res=1 errno=0 [ 1140.039677][T22393] loop0: detected capacity change from 512 to 0 [ 1140.477668][T22398] netlink: 'syz.2.4053': attribute type 2 has an invalid length. [ 1142.446485][T21965] BTRFS info (device loop8): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409 [ 1143.281881][T22429] loop5: detected capacity change from 0 to 128 [ 1143.425275][T22432] loop2: detected capacity change from 0 to 512 [ 1143.693171][T22432] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 1144.558405][T22432] EXT4-fs (loop2): 1 truncate cleaned up [ 1144.571489][T22432] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1144.623286][T22429] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 1144.761747][T22429] hpfs: filesystem error: improperly stopped [ 1144.888586][T22429] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 1144.910916][T22449] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4066'. [ 1144.927916][T22429] hpfs: You really don't want any checks? You are crazy... [ 1144.979780][T22429] hpfs: Code page index out of array [ 1144.990945][T22429] hpfs: code page support is disabled [ 1145.008801][T22429] hpfs: hpfs_map_4sectors(): unaligned read [ 1145.102714][T22429] hpfs: hpfs_map_4sectors(): unaligned read [ 1145.151119][T22429] hpfs: filesystem error: unable to find root dir [ 1145.730814][T22464] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4072'. [ 1145.975827][T21135] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1146.989190][T22478] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4073'. [ 1147.151460][T22478] netlink: 'syz.2.4073': attribute type 7 has an invalid length. [ 1147.177466][T22479] netlink: 'syz.5.4074': attribute type 2 has an invalid length. [ 1147.507016][T22478] netlink: 'syz.2.4073': attribute type 8 has an invalid length. [ 1147.617266][T22478] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4073'. [ 1147.813847][T22480] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4073'. [ 1148.078788][T22480] netlink: 'syz.2.4073': attribute type 7 has an invalid length. [ 1148.122064][T22480] netlink: 'syz.2.4073': attribute type 8 has an invalid length. [ 1148.201914][T22480] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4073'. [ 1149.509191][T11275] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1149.730694][T11275] usb 6-1: Using ep0 maxpacket: 32 [ 1149.758480][T11275] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1149.799391][T11275] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1149.823520][T11275] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1149.865845][T11275] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1149.932667][T11275] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1149.968133][T11275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1150.001113][T11275] usb 6-1: Product: syz [ 1150.019703][T11275] usb 6-1: Manufacturer: syz [ 1150.034938][T11275] usb 6-1: SerialNumber: syz [ 1150.089435][T11233] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1150.103886][ C1] imon 6-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1150.224624][T11275] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/input/input16 [ 1150.282673][T11233] usb 9-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1150.341781][T11233] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1150.409905][T11233] usb 9-1: config 0 descriptor?? [ 1150.521099][T11233] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 1150.550882][T22518] loop3: detected capacity change from 0 to 128 [ 1150.561910][T11275] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1150.578420][T11275] (id 0x00) [ 1150.754548][T22526] loop2: detected capacity change from 0 to 256 [ 1150.823069][T22518] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 1150.902844][T22526] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 1150.946493][T22518] hpfs: filesystem error: improperly stopped [ 1151.019246][T22518] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 1151.215663][T22518] hpfs: You really don't want any checks? You are crazy... [ 1151.384525][T22518] hpfs: Code page index out of array [ 1151.473820][T22518] hpfs: code page support is disabled [ 1151.511975][T22518] hpfs: hpfs_map_4sectors(): unaligned read [ 1151.537747][T22518] hpfs: hpfs_map_4sectors(): unaligned read [ 1151.570319][T22518] hpfs: filesystem error: unable to find root dir [ 1151.789940][T11275] rc_core: IR keymap rc-imon-pad not found [ 1151.847105][T11275] Registered IR keymap rc-empty [ 1151.869251][T11275] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1151.914031][T11275] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1152.024350][T11275] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/rc/rc0 [ 1152.344234][T11275] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/rc/rc0/input17 [ 1152.373377][T22543] loop3: detected capacity change from 0 to 65 [ 1152.442910][T11275] imon 6-1:155.0: iMON device (15c2:ffdc, intf0) on usb<6:6> initialized [ 1152.537766][T11275] usb 6-1: USB disconnect, device number 6 [ 1152.686908][T22552] netlink: 'syz.7.4095': attribute type 2 has an invalid length. [ 1152.802322][T22543] BFS-fs: bfs_fill_super(): NOTE: filesystem loop3 was created with 512 inodes, the real maximum is 511, mounting anyway [ 1152.868257][T11233] usb 9-1: USB disconnect, device number 2 [ 1153.090940][T22528] Bluetooth: hci0: command 0x0406 tx timeout [ 1154.506419][T22572] loop3: detected capacity change from 0 to 64 [ 1160.348657][T11233] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1160.357221][T22625] gsmld_receive_buf: 00000000: f9 . [ 1160.378020][T22624] 9pnet_fd: p9_fd_create_tcp (22624): problem connecting socket to 127.0.0.1 [ 1160.393824][T22625] gsmld_receive_buf: 00000000: b7 . [ 1160.435536][T22625] gsmld_receive_buf: 00000000: 05 . [ 1160.552923][T11233] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1160.593753][T22630] gsmld_receive_buf: 00000000: 05 . [ 1160.656828][T11233] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1160.744723][T11233] usb 4-1: Product: syz [ 1160.782612][T22625] gsmld_receive_buf: 00000000: 00 . [ 1161.491440][T11233] usb 4-1: Manufacturer: syz [ 1161.512315][T11233] usb 4-1: SerialNumber: syz [ 1161.992951][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1162.048736][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1162.996289][T22651] xt_hashlimit: size too large, truncated to 1048576 [ 1163.976284][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1165.359209][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001008. ret = -EPROTO [ 1165.519516][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 1165.663761][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1165.916375][T11233] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1166.989669][T11233] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 1167.259937][T11233] usb 4-1: USB disconnect, device number 9 [ 1167.469353][T22693] hsr0: entered promiscuous mode [ 1167.514818][T22693] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4127'. [ 1168.818105][T22528] Bluetooth: hci1: command 0x0406 tx timeout [ 1171.486525][T22739] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4139'. [ 1171.565489][T22739] bridge0: port 2(bridge_slave_1) entered disabled state [ 1171.572903][T22739] bridge0: port 1(bridge_slave_0) entered disabled state [ 1172.305272][T22745] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4139'. [ 1172.470066][T22745] bridge0: port 2(bridge_slave_1) entered blocking state [ 1172.477328][T22745] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1172.485030][T22745] bridge0: port 1(bridge_slave_0) entered blocking state [ 1172.492289][T22745] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1172.603868][T22745] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4139'. [ 1172.694124][T22745] bridge0: port 2(bridge_slave_1) entered disabled state [ 1172.701538][T22745] bridge0: port 1(bridge_slave_0) entered disabled state [ 1177.282716][T22801] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4154'. [ 1182.614261][T22809] usbip-host 1-1: usbip-host: register new device (bus 1 dev 5) [ 1187.426295][T22528] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1187.443878][T22528] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1187.927066][T22528] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1187.985922][T22528] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1188.232173][T16622] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1188.692438][T22863] dummy0: left promiscuous mode [ 1188.903082][T22863] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1188.918796][T22863] batadv_slave_1: left promiscuous mode [ 1189.164068][T16616] bond0: (slave syz_tun): Releasing backup interface [ 1189.212833][T21709] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.237346][T21709] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.258556][T21709] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.332942][T21709] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1190.508124][T16622] Bluetooth: hci4: command tx timeout [ 1191.955160][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1191.962217][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1192.645584][T16622] Bluetooth: hci4: command tx timeout [ 1194.836693][T16622] Bluetooth: hci4: command tx timeout [ 1195.024902][T22948] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4186'. [ 1196.950083][T16622] Bluetooth: hci4: command tx timeout [ 1197.401580][T22963] binder_alloc: 22961: binder_alloc_buf, no vma [ 1198.045088][ T5749] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1198.617008][ T5749] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1198.805459][ T5749] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1198.818133][ T5749] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1198.828917][ T5749] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1198.877598][ T5749] usb 6-1: config 0 descriptor?? [ 1199.275577][T11233] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1200.346401][T11233] usb 4-1: Using ep0 maxpacket: 16 [ 1200.378330][T11233] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1200.579175][ T5749] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 1200.687874][ T5749] cp2112 0003:10C4:EA90.0009: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 1200.796765][T11233] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1200.821083][T11233] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1200.830345][T11233] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1200.844114][T11233] usb 4-1: config 0 descriptor?? [ 1200.955234][ T5749] cp2112 0003:10C4:EA90.0009: error requesting version [ 1201.103276][T11233] usbhid 4-1:0.0: can't add hid device: -71 [ 1201.115384][T11233] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1201.120036][ T5749] cp2112 0003:10C4:EA90.0009: probe with driver cp2112 failed with error -32 [ 1201.127687][T11233] usb 4-1: USB disconnect, device number 10 [ 1201.214077][ T5749] usb 6-1: USB disconnect, device number 7 [ 1201.222910][T23011] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1201.680897][T16622] Bluetooth: hci1: unexpected event for opcode 0x200b [ 1203.892387][T12721] bridge_slave_1: left allmulticast mode [ 1203.927576][T12721] bridge_slave_1: left promiscuous mode [ 1204.914911][T12721] bridge0: port 2(bridge_slave_1) entered disabled state [ 1204.980833][T23052] loop2: detected capacity change from 0 to 64 [ 1205.506661][T12721] bridge_slave_0: left allmulticast mode [ 1205.637615][T12721] bridge_slave_0: left promiscuous mode [ 1205.846429][T12721] bridge0: port 1(bridge_slave_0) entered disabled state [ 1209.272577][T12721] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1209.321575][T12721] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1209.356200][T12721] bond0 (unregistering): Released all slaves [ 1209.388927][T12721] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1209.557210][T12721] bond1 (unregistering): Released all slaves [ 1210.863672][T23113] loop5: detected capacity change from 0 to 128 [ 1211.097005][T23113] FAT-fs (loop5): error, invalid access to FAT (entry 0x0ffffff6) [ 1212.347943][T12721] tipc: Left network mode [ 1214.314163][T23143] fuse: fd is not a fuse device [ 1215.589415][T22851] bridge0: port 1(bridge_slave_0) entered blocking state [ 1215.599451][T22851] bridge0: port 1(bridge_slave_0) entered disabled state [ 1215.624072][T22851] bridge_slave_0: entered allmulticast mode [ 1215.724698][T22851] bridge_slave_0: entered promiscuous mode [ 1215.833365][T22851] bridge0: port 2(bridge_slave_1) entered blocking state [ 1215.867993][T22851] bridge0: port 2(bridge_slave_1) entered disabled state [ 1215.900939][T22851] bridge_slave_1: entered allmulticast mode [ 1215.932656][T22851] bridge_slave_1: entered promiscuous mode [ 1219.113666][T22851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1219.172403][T23189] binder: 23187:23189 unknown command 0 [ 1219.493269][T23189] binder: 23187:23189 ioctl c0306201 2000000001c0 returned -22 [ 1219.772085][T23194] binder_alloc: 23187: binder_alloc_buf size 5376 failed, no address space [ 1219.840387][T22851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1219.863362][T23194] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) [ 1220.098104][T12721] hsr_slave_0: left promiscuous mode [ 1220.236837][T12721] hsr_slave_1: left promiscuous mode [ 1220.425397][T23200] loop2: detected capacity change from 0 to 32768 [ 1220.425970][T12721] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1220.433153][T23200] btrfs: Deprecated parameter 'usebackuproot' [ 1220.445237][T23200] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 1220.457739][T23200] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.4246 (23200) [ 1220.478185][T23200] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1220.488404][T23200] BTRFS info (device loop2): using crc32c checksum algorithm [ 1220.535211][T12721] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1220.574152][ T123] BTRFS warning (device loop2): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 1220.592226][T23200] BTRFS error (device loop2): failed to load root extent [ 1220.599726][T23200] BTRFS warning (device loop2): try to load backup roots slot 1 [ 1220.607980][ T123] BTRFS warning (device loop2): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 1220.629087][T23200] BTRFS warning (device loop2): couldn't read tree root [ 1220.636261][T23200] BTRFS warning (device loop2): try to load backup roots slot 2 [ 1220.649801][T10783] BTRFS error (device loop2): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 1220.719944][T23200] BTRFS warning (device loop2): couldn't read tree root [ 1220.727079][T23200] BTRFS warning (device loop2): try to load backup roots slot 3 [ 1220.757160][T23200] BTRFS info (device loop2): rebuilding free space tree [ 1220.780642][T23200] BTRFS info (device loop2): checking UUID tree [ 1220.787955][T23200] BTRFS info (device loop2): enabling ssd optimizations [ 1220.794954][T23200] BTRFS info (device loop2): turning on async discard [ 1220.802207][T23200] BTRFS info (device loop2): enabling free space tree [ 1220.809106][T23200] BTRFS info (device loop2): force clearing of disk cache [ 1220.816305][T23200] BTRFS info (device loop2): enabling auto defrag [ 1220.822731][T23200] BTRFS info (device loop2): trying to use backup root at mount time [ 1220.830865][T23200] BTRFS info (device loop2): use zstd compression, level 3 [ 1221.335058][T21135] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1223.235896][T12721] team0 (unregistering): Port device team_slave_1 removed [ 1223.623669][T12721] team0 (unregistering): Port device team_slave_0 removed [ 1225.802849][T22851] team0: Port device team_slave_0 added [ 1225.871306][T22851] team0: Port device team_slave_1 added [ 1226.204176][T22851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1226.250527][T22851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1226.387226][T22851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1226.819582][T22851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1227.006663][T22851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1227.220610][T22851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1228.450558][T22851] hsr_slave_0: entered promiscuous mode [ 1228.499195][T22851] hsr_slave_1: entered promiscuous mode [ 1228.509916][T22851] debugfs: 'hsr0' already exists in 'hsr' [ 1228.520000][T22851] Cannot create hsr debugfs directory [ 1228.535013][T11232] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1228.716985][T11232] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1228.755413][T11232] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1228.780796][T11232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1228.812816][T11232] usb 4-1: config 0 descriptor?? [ 1229.001934][T12721] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.043665][T11232] usbhid 4-1:0.0: can't add hid device: -71 [ 1229.078659][T11232] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1229.109303][T11232] usb 4-1: USB disconnect, device number 11 [ 1229.190594][T22851] netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1229.209315][T22851] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.337273][T12721] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.448969][T22851] netdevsim netdevsim6 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1229.459552][T22851] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.572902][T12721] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.662936][T11232] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1229.687599][T22851] netdevsim netdevsim6 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1229.698340][T22851] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.736932][T12721] bridge0: port 3(netdevsim0) entered disabled state [ 1229.797927][T12721] netdevsim netdevsim0 netdevsim0 (unregistering): left allmulticast mode [ 1229.807103][T12721] netdevsim netdevsim0 netdevsim0 (unregistering): left promiscuous mode [ 1229.822537][T12721] bridge0: port 3(netdevsim0) entered disabled state [ 1229.837197][T11232] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1229.856433][T12721] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1229.866404][T11232] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1229.894745][T11232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1229.930534][T11232] usb 4-1: config 0 descriptor?? [ 1229.944500][T22851] netdevsim netdevsim6 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1229.958451][T22851] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.189499][T16622] Bluetooth: hci3: command 0x0406 tx timeout [ 1230.356784][T12721] vxlan0: left allmulticast mode [ 1230.361995][T12721] vxlan0: left promiscuous mode [ 1230.375145][T12721] bridge0: port 4(vxlan0) entered disabled state [ 1230.397156][T12721] bridge_slave_1: left allmulticast mode [ 1230.404725][T12721] bridge_slave_1: left promiscuous mode [ 1230.418882][T12721] bridge0: port 2(bridge_slave_1) entered disabled state [ 1230.440545][T12721] bridge_slave_0: left allmulticast mode [ 1230.451375][T12721] bridge_slave_0: left promiscuous mode [ 1230.458120][T12721] bridge0: port 1(bridge_slave_0) entered disabled state [ 1230.765646][T12721] bond0 (unregistering): Released all slaves [ 1230.780278][T11232] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 1230.807159][T11232] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input18 [ 1230.846454][T12721] bond1 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 1230.874119][T12721] bond1 (unregistering): Released all slaves [ 1231.126300][T12721] tipc: Disabling bearer [ 1231.132159][T12721] tipc: Disabling bearer [ 1231.160041][T12721] tipc: Left network mode [ 1231.272137][T11233] usb 4-1: USB disconnect, device number 12 [ 1231.278232][ C0] aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1231.462782][T22851] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1231.477759][T22851] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1231.511504][T22851] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1231.525206][T22851] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1231.536617][T22851] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1231.548138][T22851] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1231.579368][T22851] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1231.599169][T22851] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1231.616001][T12721] hsr_slave_0: left promiscuous mode [ 1231.623153][T12721] hsr_slave_1: left promiscuous mode [ 1231.629880][T12721] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1231.637771][T12721] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1231.650402][T12721] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1231.659147][T12721] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1231.680604][T12721] virt_wifi0: left promiscuous mode [ 1231.688946][T12721] veth1_macvtap: left promiscuous mode [ 1231.695178][T12721] veth0_macvtap: left promiscuous mode [ 1231.700891][T12721] veth1_vlan: left promiscuous mode [ 1231.706320][T12721] veth0_vlan: left promiscuous mode [ 1232.170463][T12721] team0 (unregistering): Port device team_slave_1 removed [ 1232.199167][T12721] team0 (unregistering): Port device team_slave_0 removed [ 1232.642898][T22851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1232.673714][T22851] 8021q: adding VLAN 0 to HW filter on device team0 [ 1232.705635][ T123] bridge0: port 1(bridge_slave_0) entered blocking state [ 1232.712823][ T123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1232.760809][ T123] bridge0: port 2(bridge_slave_1) entered blocking state [ 1232.768028][ T123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1233.632786][T22851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1234.073885][T22851] veth0_vlan: entered promiscuous mode [ 1234.099930][T22851] veth1_vlan: entered promiscuous mode [ 1234.176198][T22851] veth0_macvtap: entered promiscuous mode [ 1234.193221][T22851] veth1_macvtap: entered promiscuous mode [ 1234.221613][T22851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1234.242181][T22851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1234.274813][T10782] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1234.292148][T10782] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1234.325690][T10782] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1234.335543][T10782] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1234.501937][ T6339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1234.541652][ T6339] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1234.582105][ T123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1234.604888][ T123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1240.570317][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1245.054586][T11277] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1245.537461][T11277] usb 4-1: config 0 has no interfaces? [ 1245.829523][T11277] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1245.868589][T23495] netlink: 'syz.6.4287': attribute type 4 has an invalid length. [ 1245.895408][T11277] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1246.213792][T11277] usb 4-1: Product: syz [ 1246.250807][T11277] usb 4-1: Manufacturer: syz [ 1246.284484][T11277] usb 4-1: SerialNumber: syz [ 1246.368631][T11277] usb 4-1: config 0 descriptor?? [ 1246.528182][T23499] netlink: 'syz.6.4287': attribute type 4 has an invalid length. [ 1247.880886][T11277] usb 4-1: USB disconnect, device number 13 [ 1250.551321][T23542] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4297'. [ 1251.948404][ T30] audit: type=1800 audit(1785444209.058:799): pid=23550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.4299" name="bus" dev="ramfs" ino=73664 res=0 errno=0 [ 1252.380915][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1253.623066][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1253.629622][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1256.551281][T23596] fuse: fd is not a fuse device [ 1258.953714][T23621] syzkaller0: entered promiscuous mode [ 1258.987918][T23621] syzkaller0: entered allmulticast mode [ 1259.023655][T23629] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 65487 [ 1261.011622][T23645] netlink: 'syz.3.4323': attribute type 4 has an invalid length. [ 1261.221420][ T30] audit: type=1800 audit(1785444218.338:800): pid=23627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.4318" name="bus" dev="ramfs" ino=72647 res=0 errno=0 [ 1263.107639][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1267.680037][T11259] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1267.767995][T23698] netlink: 'syz.3.4338': attribute type 1 has an invalid length. [ 1268.536239][T11259] usb 9-1: Using ep0 maxpacket: 16 [ 1269.417869][T11259] usb 9-1: device descriptor read/all, error -71 [ 1270.383306][T23714] netlink: 'syz.2.4344': attribute type 4 has an invalid length. [ 1274.541613][ T5281] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1277.697211][T23792] syzkaller0: entered promiscuous mode [ 1278.333377][T23792] syzkaller0: entered allmulticast mode [ 1286.838739][T23862] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1287.410474][ T5281] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1298.572895][T23955] loop3: detected capacity change from 0 to 512 [ 1298.649685][T23955] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 1298.710492][T23955] EXT4-fs (loop3): 1 truncate cleaned up [ 1298.773336][T23955] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1300.612076][T16619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1302.571125][T23984] bridge0: port 2(bridge_slave_1) entered disabled state [ 1302.578942][T23984] bridge0: port 1(bridge_slave_0) entered disabled state [ 1303.219703][T24006] netlink: 68 bytes leftover after parsing attributes in process `syz.7.4410'. [ 1303.573039][T24010] Bluetooth: MGMT ver 1.23 [ 1303.685054][T23984] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1303.722052][T23984] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1305.148482][T24019] loop3: detected capacity change from 0 to 8 [ 1305.561299][T24019] SQUASHFS error: zlib decompression failed, data probably corrupt [ 1305.646754][T24019] SQUASHFS error: Failed to read block 0x9b: -5 [ 1305.670159][T24019] SQUASHFS error: Unable to read metadata cache entry [99] [ 1305.707633][T24019] SQUASHFS error: Unable to read inode 0x127 [ 1309.586963][T24046] loop8: detected capacity change from 0 to 512 [ 1309.902211][T24046] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 1310.282551][T24052] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4422'. [ 1310.381305][T24052] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4422'. [ 1310.509483][T24057] netlink: 'syz.3.4422': attribute type 4 has an invalid length. [ 1310.649638][T24057] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4422'. [ 1310.975173][T24046] EXT4-fs (loop8): 1 truncate cleaned up [ 1311.094909][T24046] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1311.351819][T21709] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1311.376628][T24050] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1311.398413][T24057] .`: renamed from bond0 [ 1311.512785][T21709] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1311.554098][T21709] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1311.788526][T16622] Bluetooth: hci4: command 0x0406 tx timeout [ 1312.406057][T21709] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1313.704901][T21965] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1314.716651][T11233] IPVS: starting estimator thread 0... [ 1314.754406][T24090] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4428'. [ 1314.823275][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1314.829648][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1315.005920][T24090] netlink: 17 bytes leftover after parsing attributes in process `syz.2.4428'. [ 1315.161056][T24097] MTRR 0 not used [ 1315.200393][T24093] IPVS: using max 22 ests per chain, 52800 per kthread [ 1315.409026][T24090] tipc: Invalid UDP bearer configuration [ 1315.470259][T24090] tipc: Enabling of bearer rejected, failed to enable media [ 1316.121222][T24103] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4432'. [ 1317.294815][T15817] Bluetooth: hci2: unexpected event for opcode 0x200b [ 1319.307727][T24129] tipc: Failed to remove unknown binding: 66,0,0/0:753202099/753202101 [ 1319.316280][T24129] tipc: Failed to remove unknown binding: 66,0,0/0:753202099/753202100 [ 1319.325703][T24129] tipc: Failed to remove unknown binding: 66,0,0/0:753202099/753202101 [ 1319.334239][T24129] tipc: Failed to remove unknown binding: 66,0,0/0:753202099/753202100 [ 1319.379124][T24113] bridge2: port 1(veth3) entered blocking state [ 1319.421036][T24113] bridge2: port 1(veth3) entered disabled state [ 1319.440063][T24113] veth3: entered allmulticast mode [ 1319.458024][T24113] veth3: entered promiscuous mode [ 1319.553035][T24132] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4440'. [ 1319.924125][T24144] ptrace attach of "ci-upstream-kasan-badwrites-root/syz-executor exec"[21965] was attempted by " [ 1321.792241][T24160] syzkaller0: entered promiscuous mode [ 1322.091863][T24160] syzkaller0: entered allmulticast mode [ 1322.210626][T24172] loop3: detected capacity change from 0 to 128 [ 1322.223167][T24168] loop2: detected capacity change from 0 to 512 [ 1323.146729][T24172] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1323.223775][T24172] ext4 filesystem being mounted at /240/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1323.274919][T24168] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1323.306459][T24168] ext4 filesystem being mounted at /107/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1323.540887][T24180] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1323.624072][T16619] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1325.624500][T15817] Bluetooth: hci6: unexpected event for opcode 0x200b [ 1326.520694][T24213] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 1328.393900][T21135] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1332.435878][T24242] loop5: detected capacity change from 0 to 512 [ 1332.499655][T24242] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 1332.621800][T24242] EXT4-fs (loop5): 1 truncate cleaned up [ 1332.776180][T24242] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1334.227294][T20949] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1336.158799][T15817] Bluetooth: hci0: unexpected event for opcode 0x200b [ 1338.797432][T24305] syzkaller0: entered promiscuous mode [ 1338.803180][T11277] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1338.811501][T24305] syzkaller0: entered allmulticast mode [ 1339.030325][T11277] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1339.039506][T11277] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1340.281181][T11277] ATM dev 0: ADSL state: running [ 1340.374304][T11277] ATM dev 0: ADSL line: down [ 1341.438716][T11233] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1343.891620][ T9] usb 4-1: USB disconnect, device number 14 [ 1343.892232][ C1] ATM dev 0: usbatm_complete: urb 0xffff888029abea00 failed (-71)! [ 1343.905633][ C1] ATM dev 0: usbatm_complete: urb 0xffff888029abeb00 failed (-71)! [ 1343.913568][ C1] ATM dev 0: usbatm_complete: urb 0xffff88801fec4d00 failed (-71)! [ 1343.921498][ C1] ATM dev 0: usbatm_complete: urb 0xffff88802ce5ef00 failed (-71)! [ 1343.937989][T11259] cxacru 4-1:1.0: send of cm 0x88 failed (-71) [ 1343.944629][T11259] ATM dev 0: poll status: error -71 [ 1343.950184][T11259] ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 1343.998450][ C1] ATM dev 0: usbatm_submit_urb: urb 0xffff888029abea00 submission failed (-19)! [ 1344.108147][ C1] ATM dev 0: usbatm_submit_urb: urb 0xffff888029abea00 submission failed (-19)! [ 1347.088175][T11271] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1347.310679][T11271] usb 7-1: Using ep0 maxpacket: 16 [ 1347.396949][T11271] usb 7-1: device descriptor read/all, error -71 [ 1347.547042][T24376] random: crng reseeded on system resumption [ 1347.924000][T15817] Bluetooth: hci3: unexpected event for opcode 0x042c [ 1348.712779][T24380] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4499'. [ 1350.890425][T24403] tipc: Started in network mode [ 1351.062133][T24403] tipc: Node identity 264258302756, cluster identity 4711 [ 1352.094180][T24403] tipc: Enabled bearer , priority 0 [ 1352.112663][T24413] syzkaller0: entered promiscuous mode [ 1352.150127][T24413] syzkaller0: entered allmulticast mode [ 1352.165326][T24409] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1352.343846][ T5281] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1352.403191][T24413] tipc: Resetting bearer [ 1352.504210][T24401] tipc: Resetting bearer [ 1353.746586][T24401] tipc: Disabling bearer [ 1354.246456][T11271] tipc: Node number set to 18110512 [ 1356.132303][T24448] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4520'. [ 1356.206137][T24448] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1356.434111][T24448] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1357.083658][T24478] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4527'. [ 1357.140991][ T30] audit: type=1107 audit(1785444314.264:801): pid=24475 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Ti1íÅÖ[‹ÚPoÔ [ 1357.140991][ T30] È/v,ÂöLö9‡ÕÖ2û€ÔMeX€7xW•Ï¨ÛáÄ fXKSRUÓrÂjæ[j‘ט¢ëí\¯È©¹(,èñëÅ%òÑþ¯¾9¶0ú•.:± õãÀ´sϨöÈ-I¤!>g&Ñ"©ç/ëÓä\Y=L3º{!Òƒ‚2›Ô¦pjÈüë>ü; ’üÛºí/×ðٴᵎõÙµ]Êaÿ× ×'v- ›”<€$‘Ø%¿Q£Øî5µõýlç¢ë½ÖeFr‡=óœ’/¡a®ÌË# [ 1357.140991][ T30] Ð’ôš…h†‘0ÜV°ä¤Z”2“' [ 1358.147114][T24477] tipc: Enabled bearer , priority 0 [ 1358.160530][T24479] syzkaller0: entered promiscuous mode [ 1358.183076][T24479] syzkaller0: entered allmulticast mode [ 1358.256211][T24482] tipc: Resetting bearer [ 1358.269072][T24470] tipc: Resetting bearer [ 1358.322430][T24470] tipc: Disabling bearer [ 1358.345022][ T5281] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1363.884017][T16622] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1363.935382][T16622] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1363.945875][T16622] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1363.954734][T16622] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1363.968809][T16622] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1365.404853][T24540] mac80211_hwsim hwsim37 syzkaller0: entered promiscuous mode [ 1365.417264][T24540] mac80211_hwsim hwsim37 syzkaller0: entered allmulticast mode [ 1365.728571][T24545] loop2: detected capacity change from 0 to 256 [ 1366.018159][T16622] Bluetooth: hci4: command tx timeout [ 1366.703339][T24552] loop8: detected capacity change from 0 to 256 [ 1366.745958][T24552] exfat: Deprecated parameter 'namecase' [ 1366.765516][T24552] exfat: Deprecated parameter 'namecase' [ 1366.843060][T24552] exFAT-fs (loop8): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 1367.049077][ T30] audit: type=1800 audit(1785444324.174:802): pid=24552 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.4543" name="file1" dev="loop8" ino=1048945 res=0 errno=0 [ 1368.096942][T16622] Bluetooth: hci4: command tx timeout [ 1368.349199][T12279] bridge_slave_1: left allmulticast mode [ 1368.380590][T12279] bridge_slave_1: left promiscuous mode [ 1368.412131][T12279] bridge0: port 2(bridge_slave_1) entered disabled state [ 1369.459892][T12279] bridge_slave_0: left allmulticast mode [ 1369.522643][T12279] bridge_slave_0: left promiscuous mode [ 1369.574777][T12279] bridge0: port 1(bridge_slave_0) entered disabled state [ 1370.186750][T16622] Bluetooth: hci4: command tx timeout [ 1372.267164][T16622] Bluetooth: hci4: command tx timeout [ 1375.220493][T24606] netlink: 'syz.7.4551': attribute type 4 has an invalid length. [ 1376.434493][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1376.441059][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1376.636390][T24610] MTRR 0 not used [ 1377.410356][T12279] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1377.491500][T12279] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1377.538157][T12279] bond0 (unregistering): Released all slaves [ 1377.610819][ T5281] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1377.690837][T24612] loop3: detected capacity change from 0 to 4096 [ 1377.728779][T24612] EXT4-fs: inline encryption not supported [ 1377.893148][T24612] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 1378.043756][T24612] EXT4-fs (loop3): Test dummy encryption mode enabled [ 1378.112060][T24612] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 1378.151692][T24612] System zones: 0-5 [ 1378.234398][T24612] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1378.480390][T24614] bridge0: port 2(bridge_slave_1) entered disabled state [ 1378.487857][T24614] bridge0: port 1(bridge_slave_0) entered disabled state [ 1378.730570][T24626] overlay: ./file0 is not a directory [ 1378.840095][T24614] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1378.870606][T24614] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1379.010243][T16619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1379.453210][T22107] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1380.480627][T22107] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1380.541818][T22107] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1380.913759][T24647] loop2: detected capacity change from 0 to 40427 [ 1381.086428][T24647] F2FS-fs (loop2): invalid crc value [ 1381.204837][T24647] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 1381.221347][T24647] F2FS-fs (loop2): f2fs_disable_checkpoint starts, unusable: 0 [ 1381.229091][T24647] F2FS-fs (loop2): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 1381.239973][T24647] F2FS-fs (loop2): Start checkpoint disabled! [ 1381.623375][T24647] F2FS-fs (loop2): f2fs_disable_checkpoint finishes, err:0 [ 1381.631338][T24647] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 1381.672016][T21709] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.466145][T24662] loop8: detected capacity change from 0 to 128 [ 1384.041744][T22107] kworker/u8:2: attempt to access beyond end of device [ 1384.041744][T22107] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1385.631987][T22107] CPU: 1 UID: 0 PID: 22107 Comm: kworker/u8:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 1385.632047][T22107] Tainted: [L]=SOFTLOCKUP [ 1385.632060][T22107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1385.632084][T22107] Workqueue: writeback wb_workfn (flush-7:2) [ 1385.632143][T22107] Call Trace: [ 1385.632155][T22107] [ 1385.632170][T22107] dump_stack_lvl+0x100/0x190 [ 1385.632214][T22107] f2fs_stop_checkpoint+0x5e6/0xb30 [ 1385.632273][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.632316][T22107] ? errseq_set+0xe3/0x150 [ 1385.632370][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.632422][T22107] f2fs_write_end_bio+0xf53/0x1340 [ 1385.632464][T22107] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 1385.632510][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.632567][T22107] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 1385.632604][T22107] bio_endio+0x778/0x8e0 [ 1385.632650][T22107] submit_bio_noacct+0x64c/0x1ff0 [ 1385.632719][T22107] f2fs_submit_write_bio+0x133/0x330 [ 1385.632780][T22107] __submit_merged_bio+0x330/0x7b0 [ 1385.632815][T22107] ? rcu_is_watching+0x12/0xc0 [ 1385.632874][T22107] __submit_merged_write_cond+0x3fe/0x510 [ 1385.632923][T22107] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1385.632975][T22107] ? __pfx___might_resched+0x10/0x10 [ 1385.633013][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.633060][T22107] ? folio_clear_dirty_for_io+0x178/0x960 [ 1385.633125][T22107] f2fs_write_cache_pages+0x20e9/0x2630 [ 1385.633195][T22107] ? find_held_lock+0x2b/0x80 [ 1385.633249][T22107] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 1385.633296][T22107] ? __pfx_check_buffer+0x10/0x10 [ 1385.633360][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.633407][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.633459][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.633502][T22107] ? __rb_reserve_next.constprop.0+0x6f6/0x1640 [ 1385.633658][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.633703][T22107] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 1385.633764][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.633808][T22107] ? rcu_is_watching+0x12/0xc0 [ 1385.633872][T22107] f2fs_write_data_pages+0x799/0x16d0 [ 1385.633939][T22107] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1385.634007][T22107] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1385.634066][T22107] do_writepages+0x278/0x600 [ 1385.634132][T22107] ? __pfx_do_writepages+0x10/0x10 [ 1385.634193][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634245][T22107] __writeback_single_inode+0x164/0x1300 [ 1385.634296][T22107] ? find_held_lock+0x2b/0x80 [ 1385.634356][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634404][T22107] ? __pfx___writeback_single_inode+0x10/0x10 [ 1385.634453][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634496][T22107] ? do_raw_spin_unlock+0x145/0x1e0 [ 1385.634547][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634599][T22107] writeback_sb_inodes+0x766/0x1c50 [ 1385.634676][T22107] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 1385.634724][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634842][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634887][T22107] ? rcu_is_watching+0x12/0xc0 [ 1385.634938][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.634982][T22107] ? queue_io+0x287/0x530 [ 1385.635034][T22107] wb_writeback+0x1c0/0xb50 [ 1385.635100][T22107] ? __pfx_wb_writeback+0x10/0x10 [ 1385.635162][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635206][T22107] ? mark_held_locks+0x40/0x70 [ 1385.635247][T22107] ? _raw_spin_unlock_irq+0x23/0x50 [ 1385.635294][T22107] wb_workfn+0x143/0xc80 [ 1385.635349][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635392][T22107] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1385.635436][T22107] ? __pfx_wb_workfn+0x10/0x10 [ 1385.635489][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635538][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635587][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635630][T22107] ? rcu_is_watching+0x12/0xc0 [ 1385.635692][T22107] process_one_work+0xa23/0x1940 [ 1385.635753][T22107] ? __pfx_process_one_work+0x10/0x10 [ 1385.635791][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635853][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.635907][T22107] worker_thread+0x5ef/0xe50 [ 1385.635959][T22107] ? __pfx_worker_thread+0x10/0x10 [ 1385.635998][T22107] ? kthread+0x13a/0x450 [ 1385.636057][T22107] ? __pfx_worker_thread+0x10/0x10 [ 1385.636107][T22107] kthread+0x370/0x450 [ 1385.636163][T22107] ? __pfx_kthread+0x10/0x10 [ 1385.636224][T22107] ret_from_fork+0x72b/0xd50 [ 1385.636276][T22107] ? __pfx_ret_from_fork+0x10/0x10 [ 1385.636327][T22107] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1385.636371][T22107] ? __switch_to+0x800/0x10f0 [ 1385.636428][T22107] ? __switch_to_asm+0x39/0x70 [ 1385.636479][T22107] ? __pfx_kthread+0x10/0x10 [ 1385.636539][T22107] ret_from_fork_asm+0x1a/0x30 [ 1385.636620][T22107] [ 1386.214523][T22107] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 1386.609381][T12279] hsr_slave_0: left promiscuous mode [ 1386.686874][T11233] IPVS: starting estimator thread 0... [ 1386.849897][T24680] MTRR 0 not used [ 1386.932810][T12279] hsr_slave_1: left promiscuous mode [ 1387.076634][T24679] IPVS: using max 21 ests per chain, 50400 per kthread [ 1387.186371][T12279] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1387.497173][T12279] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1387.759996][T24685] loop2: detected capacity change from 0 to 128 [ 1387.859332][T24685] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1387.879171][T24685] ext4 filesystem being mounted at /127/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1388.012667][T11271] usbip-host 1-1: USB disconnect, device number 5 [ 1389.017756][T21135] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1390.334185][T24714] loop3: detected capacity change from 0 to 128 [ 1390.347845][T24715] loop2: detected capacity change from 0 to 2048 [ 1390.394453][T24715] EXT4-fs (loop2): Number of reserved GDT blocks insanely large: 64768 [ 1390.413465][T24714] FAT-fs (loop3): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 1390.461050][T24714] FAT-fs (loop3): data area starts beyond volume (36 > 6) [ 1390.480289][T24714] FAT-fs (loop3): Can't find a valid FAT filesystem [ 1390.753998][T24720] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4592'. [ 1391.044791][T12279] team0 (unregistering): Port device team_slave_1 removed [ 1391.669799][T12279] team0 (unregistering): Port device team_slave_0 removed [ 1393.071107][T24671] bridge0: port 2(bridge_slave_1) entered disabled state [ 1393.078620][T24671] bridge0: port 1(bridge_slave_0) entered disabled state [ 1393.311948][T15817] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1393.333976][T15817] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1393.346106][T15817] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1393.358012][T15817] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1393.367496][T15817] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1393.502766][T24671] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1393.658735][T24678] netlink: 16 bytes leftover after parsing attributes in process `syz.8.4569'. [ 1393.675458][T24678] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4569'. [ 1393.696073][T24678] tipc: Invalid UDP bearer configuration [ 1393.696148][T24678] tipc: Enabling of bearer rejected, failed to enable media [ 1393.731585][ T5281] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1393.895646][T21709] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.979113][T21709] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1394.615785][T21709] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1395.465299][T16622] Bluetooth: hci5: command tx timeout [ 1396.107543][T10783] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1397.535781][T16622] Bluetooth: hci5: command tx timeout [ 1399.615230][T16622] Bluetooth: hci5: command tx timeout [ 1401.795004][T16622] Bluetooth: hci5: command tx timeout [ 1404.462200][T24835] random: crng reseeded on system resumption [ 1404.861911][T16622] Bluetooth: hci1: unexpected event for opcode 0x042c [ 1406.213332][T24516] bridge0: port 1(bridge_slave_0) entered blocking state [ 1406.239380][T24516] bridge0: port 1(bridge_slave_0) entered disabled state [ 1406.305329][T24516] bridge_slave_0: entered allmulticast mode [ 1406.864153][T24516] bridge_slave_0: entered promiscuous mode [ 1411.508765][T24516] bridge0: port 2(bridge_slave_1) entered blocking state [ 1411.524609][T24516] bridge0: port 2(bridge_slave_1) entered disabled state [ 1411.590242][T24516] bridge_slave_1: entered allmulticast mode [ 1411.647809][T24516] bridge_slave_1: entered promiscuous mode [ 1411.686248][ T5281] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1411.698167][T24862] tipc: Enabling of bearer rejected, failed to enable media [ 1412.104910][T24890] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4614'. [ 1412.145179][T24516] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1412.247601][T24516] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1412.297098][T24893] bridge2: port 1(veth3) entered blocking state [ 1412.303895][T24893] bridge2: port 1(veth3) entered disabled state [ 1412.311042][T24893] veth3: entered allmulticast mode [ 1412.330576][T24893] veth3: entered promiscuous mode [ 1412.415515][T24894] bridge2: port 2(veth5) entered blocking state [ 1412.422254][T24894] bridge2: port 2(veth5) entered disabled state [ 1412.429455][T24894] veth5: entered allmulticast mode [ 1412.438332][T24894] veth5: entered promiscuous mode [ 1412.622611][T24516] team0: Port device team_slave_0 added [ 1412.638238][T24516] team0: Port device team_slave_1 added [ 1412.792903][T24735] bridge0: port 1(bridge_slave_0) entered blocking state [ 1412.817986][T24735] bridge0: port 1(bridge_slave_0) entered disabled state [ 1412.839358][T24735] bridge_slave_0: entered allmulticast mode [ 1412.856779][T24735] bridge_slave_0: entered promiscuous mode [ 1412.878509][T24735] bridge0: port 2(bridge_slave_1) entered blocking state [ 1412.889026][T24735] bridge0: port 2(bridge_slave_1) entered disabled state [ 1412.904670][T24735] bridge_slave_1: entered allmulticast mode [ 1412.927432][T24735] bridge_slave_1: entered promiscuous mode [ 1412.962904][T24516] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1412.970606][T24516] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1412.998072][T24516] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1413.035189][T24516] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1413.042462][T24516] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1413.074880][T24516] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1413.190451][T24735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1413.210363][T24735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1413.368975][T24735] team0: Port device team_slave_0 added [ 1413.415159][T24516] hsr_slave_0: entered promiscuous mode [ 1413.421753][T24516] hsr_slave_1: entered promiscuous mode [ 1413.428223][T24516] debugfs: 'hsr0' already exists in 'hsr' [ 1413.433945][T24516] Cannot create hsr debugfs directory [ 1413.441861][ T5281] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1413.451758][T24735] team0: Port device team_slave_1 added [ 1413.480755][T12279] bridge_slave_1: left allmulticast mode [ 1413.487415][T12279] bridge_slave_1: left promiscuous mode [ 1413.493180][T12279] bridge0: port 2(bridge_slave_1) entered disabled state [ 1413.503204][T12279] bridge_slave_0: left allmulticast mode [ 1413.509071][T12279] bridge_slave_0: left promiscuous mode [ 1413.515359][T12279] bridge0: port 1(bridge_slave_0) entered disabled state [ 1413.529786][T12279] veth3: left allmulticast mode [ 1413.535583][T12279] veth3: left promiscuous mode [ 1413.540499][T12279] bridge2: port 1(veth3) entered disabled state [ 1413.738993][T12279] bond1 (unregistering): (slave bond0): Releasing active interface [ 1413.750122][T12279] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1413.760985][T12279] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1413.770584][T12279] bond0 (unregistering): Released all slaves [ 1413.787304][T12279] bond1 (unregistering): Released all slaves [ 1413.883019][T24735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1413.890269][T24735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1413.939527][T24735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1413.951677][T12279] tipc: Left network mode [ 1413.953313][T24735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1413.963126][T24735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1413.993938][T24735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1414.114646][T24735] hsr_slave_0: entered promiscuous mode [ 1414.121760][T24735] hsr_slave_1: entered promiscuous mode [ 1414.129382][T24735] debugfs: 'hsr0' already exists in 'hsr' [ 1414.135304][T24735] Cannot create hsr debugfs directory [ 1414.331148][T12279] hsr_slave_0: left promiscuous mode [ 1414.337659][T12279] hsr_slave_1: left promiscuous mode [ 1414.343749][T12279] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1414.649403][T12279] team0 (unregistering): Port device team_slave_1 removed [ 1414.681815][T12279] team0 (unregistering): Port device team_slave_0 removed [ 1415.014878][ T5281] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1415.811383][T24516] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1415.831409][T24516] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1415.844382][T24516] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1415.861466][T24516] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1415.896213][T24516] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1415.916135][T24516] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1416.076724][T24516] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1416.093540][T24516] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1416.112825][ T5281] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1416.326197][T24516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1416.421956][T24516] 8021q: adding VLAN 0 to HW filter on device team0 [ 1416.452628][T12710] bridge0: port 1(bridge_slave_0) entered blocking state [ 1416.459864][T12710] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1416.490598][T21739] bridge0: port 2(bridge_slave_1) entered blocking state [ 1416.497817][T21739] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1416.810507][T24735] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1416.825820][T24735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1416.835067][T24735] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1416.851905][T24735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1416.872943][T24735] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1416.899440][T24735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1416.918311][T24735] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1416.950004][T24735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1417.107894][T24735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1417.155125][T24735] 8021q: adding VLAN 0 to HW filter on device team0 [ 1417.196055][T10767] bridge0: port 1(bridge_slave_0) entered blocking state [ 1417.203410][T10767] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1417.254667][T10767] bridge0: port 2(bridge_slave_1) entered blocking state [ 1417.261861][T10767] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1417.376197][ T5281] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1417.681518][T24516] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1418.273730][T24516] veth0_vlan: entered promiscuous mode [ 1418.291649][T24516] veth1_vlan: entered promiscuous mode [ 1418.358397][T24516] veth0_macvtap: entered promiscuous mode [ 1418.371083][T24516] veth1_macvtap: entered promiscuous mode [ 1418.398829][T24516] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1418.435991][T24735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1418.448440][T24516] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1418.471559][T21739] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1418.490807][T21739] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1418.537723][T21739] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1418.588461][T21739] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1418.641839][ T5281] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1419.138152][T15817] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1419.153692][T15817] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1419.164977][T15817] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1419.176047][T15817] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1419.183986][T15817] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1419.378860][T24735] veth0_vlan: entered promiscuous mode [ 1419.412712][T24735] veth1_vlan: entered promiscuous mode [ 1419.500736][T24735] veth0_macvtap: entered promiscuous mode [ 1419.520946][T24735] veth1_macvtap: entered promiscuous mode [ 1419.738578][T24735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1419.760961][T24735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1419.800788][T21739] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1419.831603][T21739] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1419.869338][T21739] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1419.921853][T21739] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1420.109743][ T6340] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.201104][ T5281] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1420.398898][ T6340] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.500120][T12721] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1420.518940][T12721] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1420.598651][T12710] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1420.607633][T12710] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1420.708452][ T6340] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.998633][ T6340] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1421.294068][T15817] Bluetooth: hci0: command tx timeout [ 1422.778707][T25061] tipc: Started in network mode [ 1422.783700][T25061] tipc: Node identity 9ae2e6167162, cluster identity 4711 [ 1422.791084][T25061] tipc: Enabled bearer , priority 0 [ 1422.930130][T25053] tipc: Resetting bearer [ 1423.383963][T15817] Bluetooth: hci0: command tx timeout [ 1424.280834][T25050] tipc: Disabling bearer [ 1424.294695][T21422] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1424.477607][T11259] tipc: Node number set to 3951093270 [ 1424.490588][T21422] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1424.513818][T21422] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1425.713638][T15817] Bluetooth: hci0: command tx timeout [ 1426.978763][T25016] bridge0: port 1(bridge_slave_0) entered blocking state [ 1426.986860][T25016] bridge0: port 1(bridge_slave_0) entered disabled state [ 1426.994632][T25016] bridge_slave_0: entered allmulticast mode [ 1427.002990][T25016] bridge_slave_0: entered promiscuous mode [ 1427.012290][T25016] bridge0: port 2(bridge_slave_1) entered blocking state [ 1427.020649][T25016] bridge0: port 2(bridge_slave_1) entered disabled state [ 1427.021131][T21422] ATM dev 0: ADSL state: running [ 1427.028052][T25016] bridge_slave_1: entered allmulticast mode [ 1427.043241][T25016] bridge_slave_1: entered promiscuous mode [ 1427.086228][T21422] ATM dev 0: ADSL line: down [ 1427.321880][ T6340] bridge_slave_1: left allmulticast mode [ 1427.344462][ T6340] bridge_slave_1: left promiscuous mode [ 1427.358976][ T6340] bridge0: port 2(bridge_slave_1) entered disabled state [ 1427.389967][ T6340] bridge_slave_0: left allmulticast mode [ 1427.402814][ T6340] bridge_slave_0: left promiscuous mode [ 1427.416852][ T6340] bridge0: port 1(bridge_slave_0) entered disabled state [ 1427.785070][T15817] Bluetooth: hci0: command tx timeout [ 1428.363060][ C0] ATM dev 0: usbatm_complete: urb 0xffff888032bb1600 failed (-71)! [ 1428.366140][T23430] usb 3-1: USB disconnect, device number 7 [ 1428.371044][ C0] ATM dev 0: usbatm_complete: urb 0xffff888032bb1800 failed (-71)! [ 1428.371104][ C0] ATM dev 0: usbatm_complete: urb 0xffff888032bb1500 failed (-71)! [ 1428.371153][ C0] ATM dev 0: usbatm_complete: urb 0xffff888032bb1200 failed (-71)! [ 1428.372193][T11271] cxacru 3-1:1.0: send of cm 0x88 failed (-71) [ 1428.438715][T11271] ATM dev 0: poll status: error -71 [ 1428.459294][T11271] ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 1428.469048][ C0] ATM dev 0: usbatm_submit_urb: urb 0xffff888032bb1600 submission failed (-19)! [ 1428.554921][T11271] ================================================================== [ 1428.563022][T11271] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15ca/0x1bd0 [ 1428.570725][T11271] Read of size 8 at addr ffff88802a7c4a18 by task kworker/0:14/11271 [ 1428.578794][T11271] [ 1428.581129][T11271] CPU: 0 UID: 0 PID: 11271 Comm: kworker/0:14 Tainted: G L syzkaller #0 PREEMPT(full) [ 1428.581184][T11271] Tainted: [L]=SOFTLOCKUP SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1428.581199][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1428.581225][T11271] Workqueue: events cxacru_poll_status [ 1428.581283][T11271] Call Trace: [ 1428.581296][T11271] [ 1428.581310][T11271] dump_stack_lvl+0x100/0x190 [ 1428.581352][T11271] print_report+0x13d/0x4b0 [ 1428.581408][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.581456][T11271] ? __virt_addr_valid+0x239/0x430 [ 1428.581505][T11271] ? __mutex_lock+0x15ca/0x1bd0 [ 1428.581553][T11271] kasan_report+0xdf/0x1c0 [ 1428.581595][T11271] ? __mutex_lock+0x15ca/0x1bd0 [ 1428.581649][T11271] __mutex_lock+0x15ca/0x1bd0 [ 1428.581697][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1428.581750][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.581796][T11271] ? preempt_schedule_common+0x42/0xc0 [ 1428.581839][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.581885][T11271] ? preempt_schedule_thunk+0x16/0x40 [ 1428.581948][T11271] ? __pfx___mutex_lock+0x10/0x10 [ 1428.581998][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.582045][T11271] ? __mutex_unlock_slowpath+0x6da/0x930 [ 1428.582102][T11271] ? __pfx__printk+0x10/0x10 [ 1428.582143][T11271] ? cxacru_poll_status+0x4c0/0xdc0 [ 1428.582196][T11271] ? cxacru_poll_status+0x4c3/0xdc0 [ 1428.582249][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.582300][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1428.582354][T11271] cxacru_poll_status+0x55b/0xdc0 [ 1428.582408][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.582459][T11271] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1428.582507][T11271] ? debug_object_deactivate+0x2e4/0x3b0 [ 1428.582562][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.582600][T11271] ? rcu_is_watching+0x12/0xc0 [ 1428.582650][T11271] process_one_work+0xa23/0x1940 [ 1428.582693][T11271] ? __pfx_process_one_work+0x10/0x10 [ 1428.582725][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.582773][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.582819][T11271] worker_thread+0x5ef/0xe50 [ 1428.582859][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1428.582893][T11271] ? kthread+0x13a/0x450 [ 1428.582944][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1428.582974][T11271] kthread+0x370/0x450 [ 1428.583025][T11271] ? __pfx_kthread+0x10/0x10 [ 1428.583087][T11271] ret_from_fork+0x72b/0xd50 [ 1428.583132][T11271] ? __pfx_ret_from_fork+0x10/0x10 [ 1428.583176][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1428.583216][T11271] ? __switch_to+0x800/0x10f0 [ 1428.583270][T11271] ? __switch_to_asm+0x39/0x70 [ 1428.583312][T11271] ? __pfx_kthread+0x10/0x10 [ 1428.583362][T11271] ret_from_fork_asm+0x1a/0x30 [ 1428.583420][T11271] [ 1428.583432][T11271] [ 1428.848213][T11271] Allocated by task 21422: [ 1428.852625][T11271] kasan_save_stack+0x30/0x50 [ 1428.857334][T11271] kasan_save_track+0x14/0x30 [ 1428.862034][T11271] __kasan_kmalloc+0xaa/0xb0 [ 1428.866650][T11271] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1428.872055][T11271] cxacru_bind+0xac/0x1440 [ 1428.876488][T11271] usbatm_usb_probe+0x378/0x1b50 [ 1428.881441][T11271] cxacru_usb_probe+0x101/0x200 [ 1428.886312][T11271] usb_probe_interface+0x303/0x8f0 [ 1428.891446][T11271] really_probe+0x241/0xa60 [ 1428.895964][T11271] __driver_probe_device+0x20e/0x450 [ 1428.901267][T11271] driver_probe_device+0x4a/0x140 [ 1428.906306][T11271] __device_attach_driver+0x1df/0x320 [ 1428.911695][T11271] bus_for_each_drv+0x159/0x1e0 [ 1428.916549][T11271] __device_attach+0x1e4/0x4d0 [ 1428.921328][T11271] device_initial_probe+0xaf/0xd0 [ 1428.926367][T11271] bus_probe_device+0x64/0x160 [ 1428.931139][T11271] device_add+0x121d/0x1970 [ 1428.935662][T11271] usb_set_configuration+0xd97/0x1c60 [ 1428.941054][T11271] usb_generic_driver_probe+0xa1/0xe0 [ 1428.946434][T11271] usb_probe_device+0xef/0x400 [ 1428.951214][T11271] really_probe+0x241/0xa60 [ 1428.955731][T11271] __driver_probe_device+0x20e/0x450 [ 1428.961030][T11271] driver_probe_device+0x4a/0x140 [ 1428.966074][T11271] __device_attach_driver+0x1df/0x320 [ 1428.971462][T11271] bus_for_each_drv+0x159/0x1e0 [ 1428.976317][T11271] __device_attach+0x1e4/0x4d0 [ 1428.981095][T11271] device_initial_probe+0xaf/0xd0 [ 1428.986136][T11271] bus_probe_device+0x64/0x160 [ 1428.990940][T11271] device_add+0x121d/0x1970 [ 1428.995464][T11271] usb_new_device.cold+0x685/0x115c [ 1429.000676][T11271] hub_event+0x30a3/0x4a60 [ 1429.005110][T11271] process_one_work+0xa23/0x1940 [ 1429.010059][T11271] worker_thread+0x5ef/0xe50 [ 1429.014651][T11271] kthread+0x370/0x450 [ 1429.018741][T11271] ret_from_fork+0x72b/0xd50 [ 1429.023359][T11271] ret_from_fork_asm+0x1a/0x30 [ 1429.028163][T11271] [ 1429.030483][T11271] Freed by task 23430: [ 1429.034545][T11271] kasan_save_stack+0x30/0x50 [ 1429.039247][T11271] kasan_save_track+0x14/0x30 [ 1429.043948][T11271] kasan_save_free_info+0x3b/0x70 [ 1429.048981][T11271] __kasan_slab_free+0x5f/0x80 [ 1429.053745][T11271] kfree+0x22b/0x6c0 [ 1429.057653][T11271] cxacru_unbind+0x1fc/0x3d0 [ 1429.062273][T11271] usbatm_usb_disconnect+0x449/0x7e0 [ 1429.067569][T11271] usb_unbind_interface+0x1dd/0x9e0 [ 1429.072838][T11271] device_remove+0x12a/0x180 [ 1429.077443][T11271] device_release_driver_internal+0x44e/0x620 [ 1429.083528][T11271] bus_remove_device+0x2bc/0x560 [ 1429.088473][T11271] device_del+0x376/0x9b0 [ 1429.092811][T11271] usb_disable_device+0x367/0x810 [ 1429.097845][T11271] usb_disconnect+0x2e2/0x9a0 [ 1429.102533][T11271] hub_event+0x1c4f/0x4a60 [ 1429.106963][T11271] process_one_work+0xa23/0x1940 [ 1429.111903][T11271] worker_thread+0x5ef/0xe50 [ 1429.116492][T11271] kthread+0x370/0x450 [ 1429.120585][T11271] ret_from_fork+0x72b/0xd50 [ 1429.125188][T11271] ret_from_fork_asm+0x1a/0x30 [ 1429.129968][T11271] [ 1429.132278][T11271] Last potentially related work creation: [ 1429.137977][T11271] kasan_save_stack+0x30/0x50 [ 1429.142690][T11271] kasan_record_aux_stack+0xa7/0xc0 [ 1429.147901][T11271] insert_work+0x36/0x230 [ 1429.152254][T11271] __queue_work+0x9bc/0x12b0 [ 1429.156867][T11271] call_timer_fn+0x19a/0x610 [ 1429.161460][T11271] __run_timers+0x570/0xb00 [ 1429.165967][T11271] run_timer_base+0x114/0x190 [ 1429.170655][T11271] run_timer_softirq+0x1a/0x50 [ 1429.175430][T11271] handle_softirqs+0x1ea/0x9b0 [ 1429.180205][T11271] __irq_exit_rcu+0x162/0x210 [ 1429.184890][T11271] irq_exit_rcu+0x9/0x30 [ 1429.189143][T11271] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1429.194783][T11271] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1429.200775][T11271] [ 1429.203108][T11271] The buggy address belongs to the object at ffff88802a7c4800 [ 1429.203108][T11271] which belongs to the cache kmalloc-1k of size 1024 [ 1429.217161][T11271] The buggy address is located 536 bytes inside of [ 1429.217161][T11271] freed 1024-byte region [ffff88802a7c4800, ffff88802a7c4c00) [ 1429.231049][T11271] [ 1429.233365][T11271] The buggy address belongs to the physical page: [ 1429.239765][T11271] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a7c0 [ 1429.248523][T11271] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1429.257030][T11271] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1429.264580][T11271] page_type: f5(slab) [ 1429.268559][T11271] raw: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1429.277147][T11271] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1429.285734][T11271] head: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1429.294525][T11271] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1429.303200][T11271] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1429.311869][T11271] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1429.320530][T11271] page dumped because: kasan: bad access detected [ 1429.326930][T11271] page_owner tracks the page as allocated [ 1429.332637][T11271] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 987, tgid 987 (kworker/u8:7), ts 108600700676, free_ts 108539852171 [ 1429.353408][T11271] post_alloc_hook+0xfd/0x120 [ 1429.358110][T11271] get_page_from_freelist+0xf48/0x3530 [ 1429.363593][T11271] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1429.369508][T11271] new_slab+0xa2/0x640 [ 1429.373588][T11271] refill_objects+0xe3/0x410 [ 1429.378193][T11271] __pcs_replace_empty_main+0x376/0x680 [ 1429.383754][T11271] __kmalloc_noprof+0x66d/0x820 [ 1429.388622][T11271] ___neigh_create+0x1532/0x2940 [ 1429.393581][T11271] ip6_finish_output2+0xffa/0x1ce0 [ 1429.398707][T11271] __ip6_finish_output+0x357/0xdf0 [ 1429.403832][T11271] ip6_output+0x2aa/0xa60 [ 1429.408199][T11271] ndisc_send_skb+0xa85/0x1bf0 [ 1429.413000][T11271] ndisc_send_ns+0xc6/0x140 [ 1429.417545][T11271] addrconf_dad_work+0xca1/0x1360 [ 1429.422581][T11271] process_one_work+0xa23/0x1940 [ 1429.427520][T11271] worker_thread+0x5ef/0xe50 [ 1429.432110][T11271] page last free pid 5636 tgid 5636 stack trace: [ 1429.438447][T11271] __free_frozen_pages+0x79f/0x1090 [ 1429.443659][T11271] qlist_free_all+0x47/0xf0 [ 1429.448203][T11271] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1429.453680][T11271] __kasan_slab_alloc+0x69/0x90 [ 1429.458531][T11271] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1429.464009][T11271] vm_area_dup+0x27/0x8e0 [ 1429.468355][T11271] __split_vma+0x18c/0xda0 [ 1429.472785][T11271] vms_gather_munmap_vmas+0x3a5/0x1720 [ 1429.478256][T11271] do_vmi_align_munmap+0x287/0x5f0 [ 1429.483387][T11271] do_vmi_munmap+0x1f8/0x3e0 [ 1429.487998][T11271] __vm_munmap+0x196/0x390 [ 1429.492435][T11271] __x64_sys_munmap+0x59/0x80 [ 1429.497146][T11271] do_syscall_64+0x115/0x870 [ 1429.501754][T11271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1429.507657][T11271] [ 1429.510002][T11271] Memory state around the buggy address: [ 1429.515650][T11271] ffff88802a7c4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1429.523976][T11271] ffff88802a7c4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1429.532042][T11271] >ffff88802a7c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1429.540105][T11271] ^ [ 1429.544951][T11271] ffff88802a7c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1429.553013][T11271] ffff88802a7c4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1429.561078][T11271] ================================================================== [ 1430.360402][T11271] Disabling lock debugging due to kernel taint [ 1430.366624][T11271] ================================================================== [ 1430.374688][T11271] BUG: KASAN: slab-use-after-free in __mutex_lock+0x1d1/0x1bd0 [ 1430.382382][T11271] Read of size 8 at addr ffff88802a7c49c0 by task kworker/0:14/11271 [ 1430.390495][T11271] [ 1430.392825][T11271] CPU: 0 UID: 0 PID: 11271 Comm: kworker/0:14 Tainted: G B L syzkaller #0 PREEMPT(full) [ 1430.392878][T11271] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1430.392893][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1430.392917][T11271] Workqueue: events cxacru_poll_status [ 1430.392970][T11271] Call Trace: [ 1430.392983][T11271] [ 1430.392997][T11271] dump_stack_lvl+0x100/0x190 [ 1430.393034][T11271] print_report+0x13d/0x4b0 [ 1430.393084][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.393125][T11271] ? __virt_addr_valid+0x239/0x430 [ 1430.393168][T11271] ? __mutex_lock+0x1d1/0x1bd0 [ 1430.393211][T11271] kasan_report+0xdf/0x1c0 [ 1430.393250][T11271] ? __mutex_lock+0x1d1/0x1bd0 [ 1430.393300][T11271] kasan_check_range+0x10f/0x1e0 [ 1430.393341][T11271] __mutex_lock+0x1d1/0x1bd0 [ 1430.393383][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1430.393430][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1430.393477][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.393517][T11271] ? preempt_schedule_common+0x42/0xc0 [ 1430.393556][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.393600][T11271] ? preempt_schedule_thunk+0x16/0x40 [ 1430.393655][T11271] ? __pfx___mutex_lock+0x10/0x10 [ 1430.393699][T11271] ? __mutex_unlock_slowpath+0x6da/0x930 [ 1430.393743][T11271] ? __pfx__printk+0x10/0x10 [ 1430.393779][T11271] ? cxacru_poll_status+0x4c0/0xdc0 [ 1430.393826][T11271] ? cxacru_poll_status+0x4c3/0xdc0 [ 1430.393873][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.393919][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1430.393967][T11271] cxacru_poll_status+0x55b/0xdc0 [ 1430.394015][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.394059][T11271] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1430.394108][T11271] ? debug_object_deactivate+0x2e4/0x3b0 [ 1430.394166][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.394206][T11271] ? rcu_is_watching+0x12/0xc0 [ 1430.394258][T11271] process_one_work+0xa23/0x1940 [ 1430.394300][T11271] ? __pfx_process_one_work+0x10/0x10 [ 1430.394332][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.394379][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.394423][T11271] worker_thread+0x5ef/0xe50 [ 1430.394461][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1430.394494][T11271] ? kthread+0x13a/0x450 [ 1430.394545][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1430.394581][T11271] kthread+0x370/0x450 [ 1430.394631][T11271] ? __pfx_kthread+0x10/0x10 [ 1430.394685][T11271] ret_from_fork+0x72b/0xd50 [ 1430.394730][T11271] ? __pfx_ret_from_fork+0x10/0x10 [ 1430.394775][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1430.394816][T11271] ? __switch_to+0x800/0x10f0 [ 1430.394868][T11271] ? __switch_to_asm+0x39/0x70 [ 1430.394914][T11271] ? __pfx_kthread+0x10/0x10 [ 1430.394967][T11271] ret_from_fork_asm+0x1a/0x30 [ 1430.395024][T11271] [ 1430.395036][T11271] [ 1430.665330][T11271] Allocated by task 21422: [ 1430.669737][T11271] kasan_save_stack+0x30/0x50 [ 1430.674528][T11271] kasan_save_track+0x14/0x30 [ 1430.679236][T11271] __kasan_kmalloc+0xaa/0xb0 [ 1430.683846][T11271] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1430.689232][T11271] cxacru_bind+0xac/0x1440 [ 1430.693667][T11271] usbatm_usb_probe+0x378/0x1b50 [ 1430.698617][T11271] cxacru_usb_probe+0x101/0x200 [ 1430.703484][T11271] usb_probe_interface+0x303/0x8f0 [ 1430.708624][T11271] really_probe+0x241/0xa60 [ 1430.713139][T11271] __driver_probe_device+0x20e/0x450 [ 1430.718439][T11271] driver_probe_device+0x4a/0x140 [ 1430.723481][T11271] __device_attach_driver+0x1df/0x320 [ 1430.728871][T11271] bus_for_each_drv+0x159/0x1e0 [ 1430.733724][T11271] __device_attach+0x1e4/0x4d0 [ 1430.738503][T11271] device_initial_probe+0xaf/0xd0 [ 1430.743551][T11271] bus_probe_device+0x64/0x160 [ 1430.748321][T11271] device_add+0x121d/0x1970 [ 1430.752930][T11271] usb_set_configuration+0xd97/0x1c60 [ 1430.758316][T11271] usb_generic_driver_probe+0xa1/0xe0 [ 1430.763695][T11271] usb_probe_device+0xef/0x400 [ 1430.768481][T11271] really_probe+0x241/0xa60 [ 1430.773002][T11271] __driver_probe_device+0x20e/0x450 [ 1430.778300][T11271] driver_probe_device+0x4a/0x140 [ 1430.783340][T11271] __device_attach_driver+0x1df/0x320 [ 1430.788723][T11271] bus_for_each_drv+0x159/0x1e0 [ 1430.793577][T11271] __device_attach+0x1e4/0x4d0 [ 1430.798352][T11271] device_initial_probe+0xaf/0xd0 [ 1430.803392][T11271] bus_probe_device+0x64/0x160 [ 1430.808162][T11271] device_add+0x121d/0x1970 [ 1430.812684][T11271] usb_new_device.cold+0x685/0x115c [ 1430.817895][T11271] hub_event+0x30a3/0x4a60 [ 1430.822328][T11271] process_one_work+0xa23/0x1940 [ 1430.827268][T11271] worker_thread+0x5ef/0xe50 [ 1430.831861][T11271] kthread+0x370/0x450 [ 1430.835949][T11271] ret_from_fork+0x72b/0xd50 [ 1430.840554][T11271] ret_from_fork_asm+0x1a/0x30 [ 1430.845333][T11271] [ 1430.847643][T11271] Freed by task 23430: [ 1430.851701][T11271] kasan_save_stack+0x30/0x50 [ 1430.856400][T11271] kasan_save_track+0x14/0x30 [ 1430.861095][T11271] kasan_save_free_info+0x3b/0x70 [ 1430.866129][T11271] __kasan_slab_free+0x5f/0x80 [ 1430.870895][T11271] kfree+0x22b/0x6c0 [ 1430.874821][T11271] cxacru_unbind+0x1fc/0x3d0 [ 1430.879429][T11271] usbatm_usb_disconnect+0x449/0x7e0 [ 1430.884725][T11271] usb_unbind_interface+0x1dd/0x9e0 [ 1430.889940][T11271] device_remove+0x12a/0x180 [ 1430.894539][T11271] device_release_driver_internal+0x44e/0x620 [ 1430.900631][T11271] bus_remove_device+0x2bc/0x560 [ 1430.905579][T11271] device_del+0x376/0x9b0 [ 1430.909919][T11271] usb_disable_device+0x367/0x810 [ 1430.914954][T11271] usb_disconnect+0x2e2/0x9a0 [ 1430.919676][T11271] hub_event+0x1c4f/0x4a60 [ 1430.924106][T11271] process_one_work+0xa23/0x1940 [ 1430.929051][T11271] worker_thread+0x5ef/0xe50 [ 1430.933643][T11271] kthread+0x370/0x450 [ 1430.937756][T11271] ret_from_fork+0x72b/0xd50 [ 1430.942358][T11271] ret_from_fork_asm+0x1a/0x30 [ 1430.947135][T11271] [ 1430.949446][T11271] Last potentially related work creation: [ 1430.955144][T11271] kasan_save_stack+0x30/0x50 [ 1430.959841][T11271] kasan_record_aux_stack+0xa7/0xc0 [ 1430.965047][T11271] insert_work+0x36/0x230 [ 1430.969397][T11271] __queue_work+0x9bc/0x12b0 [ 1430.973987][T11271] call_timer_fn+0x19a/0x610 [ 1430.978603][T11271] __run_timers+0x570/0xb00 [ 1430.983107][T11271] run_timer_base+0x114/0x190 [ 1430.987786][T11271] run_timer_softirq+0x1a/0x50 [ 1430.992553][T11271] handle_softirqs+0x1ea/0x9b0 [ 1430.997322][T11271] __irq_exit_rcu+0x162/0x210 [ 1431.002005][T11271] irq_exit_rcu+0x9/0x30 [ 1431.006258][T11271] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1431.011897][T11271] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1431.018062][T11271] [ 1431.020376][T11271] The buggy address belongs to the object at ffff88802a7c4800 [ 1431.020376][T11271] which belongs to the cache kmalloc-1k of size 1024 [ 1431.034429][T11271] The buggy address is located 448 bytes inside of [ 1431.034429][T11271] freed 1024-byte region [ffff88802a7c4800, ffff88802a7c4c00) [ 1431.048322][T11271] [ 1431.050637][T11271] The buggy address belongs to the physical page: [ 1431.057033][T11271] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a7c0 [ 1431.065794][T11271] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1431.074289][T11271] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1431.082264][T11271] page_type: f5(slab) [ 1431.086245][T11271] raw: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1431.094830][T11271] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1431.103446][T11271] head: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1431.112118][T11271] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1431.120881][T11271] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1431.129647][T11271] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1431.138487][T11271] page dumped because: kasan: bad access detected [ 1431.144928][T11271] page_owner tracks the page as allocated [ 1431.150631][T11271] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 987, tgid 987 (kworker/u8:7), ts 108600700676, free_ts 108539852171 [ 1431.171404][T11271] post_alloc_hook+0xfd/0x120 [ 1431.176102][T11271] get_page_from_freelist+0xf48/0x3530 [ 1431.181595][T11271] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1431.187533][T11271] new_slab+0xa2/0x640 [ 1431.191619][T11271] refill_objects+0xe3/0x410 [ 1431.196224][T11271] __pcs_replace_empty_main+0x376/0x680 [ 1431.201796][T11271] __kmalloc_noprof+0x66d/0x820 [ 1431.206671][T11271] ___neigh_create+0x1532/0x2940 [ 1431.211612][T11271] ip6_finish_output2+0xffa/0x1ce0 [ 1431.216759][T11271] __ip6_finish_output+0x357/0xdf0 [ 1431.221886][T11271] ip6_output+0x2aa/0xa60 [ 1431.226233][T11271] ndisc_send_skb+0xa85/0x1bf0 [ 1431.231013][T11271] ndisc_send_ns+0xc6/0x140 [ 1431.235567][T11271] addrconf_dad_work+0xca1/0x1360 [ 1431.240602][T11271] process_one_work+0xa23/0x1940 [ 1431.245555][T11271] worker_thread+0x5ef/0xe50 [ 1431.250145][T11271] page last free pid 5636 tgid 5636 stack trace: [ 1431.256459][T11271] __free_frozen_pages+0x79f/0x1090 [ 1431.261666][T11271] qlist_free_all+0x47/0xf0 [ 1431.266184][T11271] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1431.271663][T11271] __kasan_slab_alloc+0x69/0x90 [ 1431.276515][T11271] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1431.282008][T11271] vm_area_dup+0x27/0x8e0 [ 1431.286359][T11271] __split_vma+0x18c/0xda0 [ 1431.290787][T11271] vms_gather_munmap_vmas+0x3a5/0x1720 [ 1431.296259][T11271] do_vmi_align_munmap+0x287/0x5f0 [ 1431.301388][T11271] do_vmi_munmap+0x1f8/0x3e0 [ 1431.306014][T11271] __vm_munmap+0x196/0x390 [ 1431.310455][T11271] __x64_sys_munmap+0x59/0x80 [ 1431.315139][T11271] do_syscall_64+0x115/0x870 [ 1431.319743][T11271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1431.325643][T11271] [ 1431.327955][T11271] Memory state around the buggy address: [ 1431.333583][T11271] ffff88802a7c4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1431.341643][T11271] ffff88802a7c4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1431.349708][T11271] >ffff88802a7c4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1431.357760][T11271] ^ [ 1431.363901][T11271] ffff88802a7c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1431.371955][T11271] ffff88802a7c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1431.380004][T11271] ================================================================== [ 1431.406967][T11271] ================================================================== [ 1431.415055][T11271] BUG: KASAN: slab-use-after-free in __mutex_lock+0x18f9/0x1bd0 [ 1431.422718][T11271] Read of size 8 at addr ffff88802a7c49c0 by task kworker/0:14/11271 [ 1431.430789][T11271] [ 1431.433122][T11271] CPU: 0 UID: 0 PID: 11271 Comm: kworker/0:14 Tainted: G B L syzkaller #0 PREEMPT(full) [ 1431.433182][T11271] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1431.433199][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1431.433224][T11271] Workqueue: events cxacru_poll_status [ 1431.433282][T11271] Call Trace: [ 1431.433294][T11271] [ 1431.433309][T11271] dump_stack_lvl+0x100/0x190 [ 1431.433351][T11271] print_report+0x13d/0x4b0 [ 1431.433405][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.433450][T11271] ? __virt_addr_valid+0x239/0x430 [ 1431.433497][T11271] ? __mutex_lock+0x18f9/0x1bd0 [ 1431.433548][T11271] kasan_report+0xdf/0x1c0 [ 1431.433588][T11271] ? __mutex_lock+0x18f9/0x1bd0 [ 1431.433639][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1431.433693][T11271] __mutex_lock+0x18f9/0x1bd0 [ 1431.433740][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1431.433792][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.433837][T11271] ? preempt_schedule_common+0x42/0xc0 [ 1431.433879][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.433924][T11271] ? preempt_schedule_thunk+0x16/0x40 [ 1431.433983][T11271] ? __pfx___mutex_lock+0x10/0x10 [ 1431.434031][T11271] ? __mutex_unlock_slowpath+0x6da/0x930 [ 1431.434081][T11271] ? __pfx__printk+0x10/0x10 [ 1431.434121][T11271] ? cxacru_poll_status+0x4c0/0xdc0 [ 1431.434173][T11271] ? cxacru_poll_status+0x4c3/0xdc0 [ 1431.434224][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.434276][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1431.434327][T11271] cxacru_poll_status+0x55b/0xdc0 [ 1431.434379][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.434429][T11271] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1431.434483][T11271] ? debug_object_deactivate+0x2e4/0x3b0 [ 1431.434555][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.434599][T11271] ? rcu_is_watching+0x12/0xc0 [ 1431.434657][T11271] process_one_work+0xa23/0x1940 [ 1431.434705][T11271] ? __pfx_process_one_work+0x10/0x10 [ 1431.434740][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.434793][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.434842][T11271] worker_thread+0x5ef/0xe50 [ 1431.434885][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1431.434922][T11271] ? kthread+0x13a/0x450 [ 1431.434978][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1431.435012][T11271] kthread+0x370/0x450 [ 1431.435067][T11271] ? __pfx_kthread+0x10/0x10 [ 1431.435126][T11271] ret_from_fork+0x72b/0xd50 [ 1431.435176][T11271] ? __pfx_ret_from_fork+0x10/0x10 [ 1431.435226][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1431.435270][T11271] ? __switch_to+0x800/0x10f0 [ 1431.435328][T11271] ? __switch_to_asm+0x39/0x70 [ 1431.435378][T11271] ? __pfx_kthread+0x10/0x10 [ 1431.435437][T11271] ret_from_fork_asm+0x1a/0x30 [ 1431.435501][T11271] [ 1431.435515][T11271] [ 1431.701328][T11271] Allocated by task 21422: [ 1431.705733][T11271] kasan_save_stack+0x30/0x50 [ 1431.710438][T11271] kasan_save_track+0x14/0x30 [ 1431.715163][T11271] __kasan_kmalloc+0xaa/0xb0 [ 1431.719773][T11271] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1431.725176][T11271] cxacru_bind+0xac/0x1440 [ 1431.729607][T11271] usbatm_usb_probe+0x378/0x1b50 [ 1431.734553][T11271] cxacru_usb_probe+0x101/0x200 [ 1431.739419][T11271] usb_probe_interface+0x303/0x8f0 [ 1431.744553][T11271] really_probe+0x241/0xa60 [ 1431.749078][T11271] __driver_probe_device+0x20e/0x450 [ 1431.754384][T11271] driver_probe_device+0x4a/0x140 [ 1431.759421][T11271] __device_attach_driver+0x1df/0x320 [ 1431.764805][T11271] bus_for_each_drv+0x159/0x1e0 [ 1431.769693][T11271] __device_attach+0x1e4/0x4d0 [ 1431.774469][T11271] device_initial_probe+0xaf/0xd0 [ 1431.779506][T11271] bus_probe_device+0x64/0x160 [ 1431.784279][T11271] device_add+0x121d/0x1970 [ 1431.788809][T11271] usb_set_configuration+0xd97/0x1c60 [ 1431.794210][T11271] usb_generic_driver_probe+0xa1/0xe0 [ 1431.799617][T11271] usb_probe_device+0xef/0x400 [ 1431.804395][T11271] really_probe+0x241/0xa60 [ 1431.808929][T11271] __driver_probe_device+0x20e/0x450 [ 1431.814228][T11271] driver_probe_device+0x4a/0x140 [ 1431.819267][T11271] __device_attach_driver+0x1df/0x320 [ 1431.824657][T11271] bus_for_each_drv+0x159/0x1e0 [ 1431.829510][T11271] __device_attach+0x1e4/0x4d0 [ 1431.834291][T11271] device_initial_probe+0xaf/0xd0 [ 1431.839332][T11271] bus_probe_device+0x64/0x160 [ 1431.844100][T11271] device_add+0x121d/0x1970 [ 1431.848622][T11271] usb_new_device.cold+0x685/0x115c [ 1431.853828][T11271] hub_event+0x30a3/0x4a60 [ 1431.858258][T11271] process_one_work+0xa23/0x1940 [ 1431.863198][T11271] worker_thread+0x5ef/0xe50 [ 1431.867790][T11271] kthread+0x370/0x450 [ 1431.871879][T11271] ret_from_fork+0x72b/0xd50 [ 1431.876479][T11271] ret_from_fork_asm+0x1a/0x30 [ 1431.881268][T11271] [ 1431.883609][T11271] Freed by task 23430: [ 1431.887667][T11271] kasan_save_stack+0x30/0x50 [ 1431.892367][T11271] kasan_save_track+0x14/0x30 [ 1431.897061][T11271] kasan_save_free_info+0x3b/0x70 [ 1431.902097][T11271] __kasan_slab_free+0x5f/0x80 [ 1431.906858][T11271] kfree+0x22b/0x6c0 [ 1431.910762][T11271] cxacru_unbind+0x1fc/0x3d0 [ 1431.915366][T11271] usbatm_usb_disconnect+0x449/0x7e0 [ 1431.920662][T11271] usb_unbind_interface+0x1dd/0x9e0 [ 1431.925875][T11271] device_remove+0x12a/0x180 [ 1431.930475][T11271] device_release_driver_internal+0x44e/0x620 [ 1431.936563][T11271] bus_remove_device+0x2bc/0x560 [ 1431.941511][T11271] device_del+0x376/0x9b0 [ 1431.945855][T11271] usb_disable_device+0x367/0x810 [ 1431.950891][T11271] usb_disconnect+0x2e2/0x9a0 [ 1431.955587][T11271] hub_event+0x1c4f/0x4a60 [ 1431.960015][T11271] process_one_work+0xa23/0x1940 [ 1431.964953][T11271] worker_thread+0x5ef/0xe50 [ 1431.969548][T11271] kthread+0x370/0x450 [ 1431.973640][T11271] ret_from_fork+0x72b/0xd50 [ 1431.978241][T11271] ret_from_fork_asm+0x1a/0x30 [ 1431.983051][T11271] [ 1431.985362][T11271] Last potentially related work creation: [ 1431.991060][T11271] kasan_save_stack+0x30/0x50 [ 1431.995755][T11271] kasan_record_aux_stack+0xa7/0xc0 [ 1432.000963][T11271] insert_work+0x36/0x230 [ 1432.005332][T11271] __queue_work+0x9bc/0x12b0 [ 1432.009920][T11271] call_timer_fn+0x19a/0x610 [ 1432.014528][T11271] __run_timers+0x570/0xb00 [ 1432.019036][T11271] run_timer_base+0x114/0x190 [ 1432.023716][T11271] run_timer_softirq+0x1a/0x50 [ 1432.028491][T11271] handle_softirqs+0x1ea/0x9b0 [ 1432.033268][T11271] __irq_exit_rcu+0x162/0x210 [ 1432.037966][T11271] irq_exit_rcu+0x9/0x30 [ 1432.042245][T11271] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1432.047893][T11271] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1432.053888][T11271] [ 1432.056208][T11271] The buggy address belongs to the object at ffff88802a7c4800 [ 1432.056208][T11271] which belongs to the cache kmalloc-1k of size 1024 [ 1432.070435][T11271] The buggy address is located 448 bytes inside of [ 1432.070435][T11271] freed 1024-byte region [ffff88802a7c4800, ffff88802a7c4c00) [ 1432.084322][T11271] [ 1432.086635][T11271] The buggy address belongs to the physical page: [ 1432.093032][T11271] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a7c0 [ 1432.101811][T11271] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1432.110308][T11271] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1432.117850][T11271] page_type: f5(slab) [ 1432.121832][T11271] raw: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1432.130504][T11271] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1432.139095][T11271] head: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1432.147770][T11271] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1432.156448][T11271] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1432.165124][T11271] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1432.173825][T11271] page dumped because: kasan: bad access detected [ 1432.180232][T11271] page_owner tracks the page as allocated [ 1432.185936][T11271] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 987, tgid 987 (kworker/u8:7), ts 108600700676, free_ts 108539852171 [ 1432.206741][T11271] post_alloc_hook+0xfd/0x120 [ 1432.211451][T11271] get_page_from_freelist+0xf48/0x3530 [ 1432.216931][T11271] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1432.222845][T11271] new_slab+0xa2/0x640 [ 1432.226925][T11271] refill_objects+0xe3/0x410 [ 1432.231529][T11271] __pcs_replace_empty_main+0x376/0x680 [ 1432.237089][T11271] __kmalloc_noprof+0x66d/0x820 [ 1432.241962][T11271] ___neigh_create+0x1532/0x2940 [ 1432.246904][T11271] ip6_finish_output2+0xffa/0x1ce0 [ 1432.252028][T11271] __ip6_finish_output+0x357/0xdf0 [ 1432.257151][T11271] ip6_output+0x2aa/0xa60 [ 1432.261492][T11271] ndisc_send_skb+0xa85/0x1bf0 [ 1432.266277][T11271] ndisc_send_ns+0xc6/0x140 [ 1432.270835][T11271] addrconf_dad_work+0xca1/0x1360 [ 1432.275889][T11271] process_one_work+0xa23/0x1940 [ 1432.280830][T11271] worker_thread+0x5ef/0xe50 [ 1432.285423][T11271] page last free pid 5636 tgid 5636 stack trace: [ 1432.291741][T11271] __free_frozen_pages+0x79f/0x1090 [ 1432.296960][T11271] qlist_free_all+0x47/0xf0 [ 1432.301483][T11271] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1432.306962][T11271] __kasan_slab_alloc+0x69/0x90 [ 1432.311817][T11271] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1432.317298][T11271] vm_area_dup+0x27/0x8e0 [ 1432.321659][T11271] __split_vma+0x18c/0xda0 [ 1432.326086][T11271] vms_gather_munmap_vmas+0x3a5/0x1720 [ 1432.331560][T11271] do_vmi_align_munmap+0x287/0x5f0 [ 1432.336686][T11271] do_vmi_munmap+0x1f8/0x3e0 [ 1432.341286][T11271] __vm_munmap+0x196/0x390 [ 1432.345716][T11271] __x64_sys_munmap+0x59/0x80 [ 1432.350396][T11271] do_syscall_64+0x115/0x870 [ 1432.354994][T11271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1432.360915][T11271] [ 1432.363227][T11271] Memory state around the buggy address: [ 1432.368847][T11271] ffff88802a7c4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1432.376919][T11271] ffff88802a7c4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1432.384977][T11271] >ffff88802a7c4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1432.393029][T11271] ^ [ 1432.399174][T11271] ffff88802a7c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1432.407231][T11271] ffff88802a7c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1432.415283][T11271] ================================================================== [ 1432.423640][T11271] ================================================================== [ 1432.431804][T11271] BUG: KASAN: slab-use-after-free in __mutex_lock+0x233/0x1bd0 [ 1432.439356][T11271] Write of size 8 at addr ffff88802a7c49c0 by task kworker/0:14/11271 [ 1432.447494][T11271] [ 1432.449807][T11271] CPU: 0 UID: 0 PID: 11271 Comm: kworker/0:14 Tainted: G B L syzkaller #0 PREEMPT(full) [ 1432.449851][T11271] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1432.449864][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1432.449885][T11271] Workqueue: events cxacru_poll_status [ 1432.449928][T11271] Call Trace: [ 1432.449939][T11271] [ 1432.449950][T11271] dump_stack_lvl+0x100/0x190 [ 1432.449983][T11271] print_report+0x13d/0x4b0 [ 1432.450024][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.450063][T11271] ? __virt_addr_valid+0x239/0x430 [ 1432.450099][T11271] ? __mutex_lock+0x233/0x1bd0 [ 1432.450135][T11271] kasan_report+0xdf/0x1c0 [ 1432.450165][T11271] ? __mutex_lock+0x233/0x1bd0 [ 1432.450205][T11271] kasan_check_range+0x10f/0x1e0 [ 1432.450240][T11271] __mutex_lock+0x233/0x1bd0 [ 1432.450276][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1432.450316][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.450350][T11271] ? preempt_schedule_common+0x42/0xc0 [ 1432.450382][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.450416][T11271] ? preempt_schedule_thunk+0x16/0x40 [ 1432.450463][T11271] ? __pfx___mutex_lock+0x10/0x10 [ 1432.450499][T11271] ? __mutex_unlock_slowpath+0x6da/0x930 [ 1432.450537][T11271] ? __pfx__printk+0x10/0x10 [ 1432.450567][T11271] ? cxacru_poll_status+0x4c0/0xdc0 [ 1432.450607][T11271] ? cxacru_poll_status+0x4c3/0xdc0 [ 1432.450646][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.450685][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1432.450724][T11271] cxacru_poll_status+0x55b/0xdc0 [ 1432.450763][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.450801][T11271] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1432.450842][T11271] ? debug_object_deactivate+0x2e4/0x3b0 [ 1432.450892][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.450926][T11271] ? rcu_is_watching+0x12/0xc0 [ 1432.450969][T11271] process_one_work+0xa23/0x1940 [ 1432.451005][T11271] ? __pfx_process_one_work+0x10/0x10 [ 1432.451031][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.451077][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.451113][T11271] worker_thread+0x5ef/0xe50 [ 1432.451146][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1432.451174][T11271] ? kthread+0x13a/0x450 [ 1432.451215][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1432.451241][T11271] kthread+0x370/0x450 [ 1432.451284][T11271] ? __pfx_kthread+0x10/0x10 [ 1432.451328][T11271] ret_from_fork+0x72b/0xd50 [ 1432.451366][T11271] ? __pfx_ret_from_fork+0x10/0x10 [ 1432.451403][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1432.451437][T11271] ? __switch_to+0x800/0x10f0 [ 1432.451480][T11271] ? __switch_to_asm+0x39/0x70 [ 1432.451518][T11271] ? __pfx_kthread+0x10/0x10 [ 1432.451563][T11271] ret_from_fork_asm+0x1a/0x30 [ 1432.451612][T11271] [ 1432.451622][T11271] [ 1432.716712][T11271] Allocated by task 21422: [ 1432.721120][T11271] kasan_save_stack+0x30/0x50 [ 1432.725807][T11271] kasan_save_track+0x14/0x30 [ 1432.730495][T11271] __kasan_kmalloc+0xaa/0xb0 [ 1432.735131][T11271] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1432.740505][T11271] cxacru_bind+0xac/0x1440 [ 1432.744927][T11271] usbatm_usb_probe+0x378/0x1b50 [ 1432.749861][T11271] cxacru_usb_probe+0x101/0x200 [ 1432.754710][T11271] usb_probe_interface+0x303/0x8f0 [ 1432.759829][T11271] really_probe+0x241/0xa60 [ 1432.764331][T11271] __driver_probe_device+0x20e/0x450 [ 1432.769627][T11271] driver_probe_device+0x4a/0x140 [ 1432.774651][T11271] __device_attach_driver+0x1df/0x320 [ 1432.780109][T11271] bus_for_each_drv+0x159/0x1e0 [ 1432.784950][T11271] __device_attach+0x1e4/0x4d0 [ 1432.789714][T11271] device_initial_probe+0xaf/0xd0 [ 1432.794753][T11271] bus_probe_device+0x64/0x160 [ 1432.799512][T11271] device_add+0x121d/0x1970 [ 1432.804072][T11271] usb_set_configuration+0xd97/0x1c60 [ 1432.809444][T11271] usb_generic_driver_probe+0xa1/0xe0 [ 1432.814808][T11271] usb_probe_device+0xef/0x400 [ 1432.819658][T11271] really_probe+0x241/0xa60 [ 1432.824156][T11271] __driver_probe_device+0x20e/0x450 [ 1432.829441][T11271] driver_probe_device+0x4a/0x140 [ 1432.834464][T11271] __device_attach_driver+0x1df/0x320 [ 1432.839836][T11271] bus_for_each_drv+0x159/0x1e0 [ 1432.844676][T11271] __device_attach+0x1e4/0x4d0 [ 1432.849440][T11271] device_initial_probe+0xaf/0xd0 [ 1432.854467][T11271] bus_probe_device+0x64/0x160 [ 1432.859225][T11271] device_add+0x121d/0x1970 [ 1432.863736][T11271] usb_new_device.cold+0x685/0x115c [ 1432.868930][T11271] hub_event+0x30a3/0x4a60 [ 1432.873345][T11271] process_one_work+0xa23/0x1940 [ 1432.878274][T11271] worker_thread+0x5ef/0xe50 [ 1432.882857][T11271] kthread+0x370/0x450 [ 1432.886937][T11271] ret_from_fork+0x72b/0xd50 [ 1432.891529][T11271] ret_from_fork_asm+0x1a/0x30 [ 1432.896300][T11271] [ 1432.898605][T11271] Freed by task 23430: [ 1432.902653][T11271] kasan_save_stack+0x30/0x50 [ 1432.907337][T11271] kasan_save_track+0x14/0x30 [ 1432.912025][T11271] kasan_save_free_info+0x3b/0x70 [ 1432.917049][T11271] __kasan_slab_free+0x5f/0x80 [ 1432.921800][T11271] kfree+0x22b/0x6c0 [ 1432.925689][T11271] cxacru_unbind+0x1fc/0x3d0 [ 1432.930300][T11271] usbatm_usb_disconnect+0x449/0x7e0 [ 1432.935604][T11271] usb_unbind_interface+0x1dd/0x9e0 [ 1432.940827][T11271] device_remove+0x12a/0x180 [ 1432.945417][T11271] device_release_driver_internal+0x44e/0x620 [ 1432.951485][T11271] bus_remove_device+0x2bc/0x560 [ 1432.956417][T11271] device_del+0x376/0x9b0 [ 1432.960744][T11271] usb_disable_device+0x367/0x810 [ 1432.965768][T11271] usb_disconnect+0x2e2/0x9a0 [ 1432.970441][T11271] hub_event+0x1c4f/0x4a60 [ 1432.974854][T11271] process_one_work+0xa23/0x1940 [ 1432.979798][T11271] worker_thread+0x5ef/0xe50 [ 1432.984376][T11271] kthread+0x370/0x450 [ 1432.988464][T11271] ret_from_fork+0x72b/0xd50 [ 1432.993053][T11271] ret_from_fork_asm+0x1a/0x30 [ 1432.997836][T11271] [ 1433.000142][T11271] Last potentially related work creation: [ 1433.005835][T11271] kasan_save_stack+0x30/0x50 [ 1433.010535][T11271] kasan_record_aux_stack+0xa7/0xc0 [ 1433.015739][T11271] insert_work+0x36/0x230 [ 1433.020074][T11271] __queue_work+0x9bc/0x12b0 [ 1433.024651][T11271] call_timer_fn+0x19a/0x610 [ 1433.029229][T11271] __run_timers+0x570/0xb00 [ 1433.033814][T11271] run_timer_base+0x114/0x190 [ 1433.038483][T11271] run_timer_softirq+0x1a/0x50 [ 1433.043237][T11271] handle_softirqs+0x1ea/0x9b0 [ 1433.048009][T11271] __irq_exit_rcu+0x162/0x210 [ 1433.052680][T11271] irq_exit_rcu+0x9/0x30 [ 1433.056920][T11271] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1433.062552][T11271] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1433.068546][T11271] [ 1433.070850][T11271] The buggy address belongs to the object at ffff88802a7c4800 [ 1433.070850][T11271] which belongs to the cache kmalloc-1k of size 1024 [ 1433.085067][T11271] The buggy address is located 448 bytes inside of [ 1433.085067][T11271] freed 1024-byte region [ffff88802a7c4800, ffff88802a7c4c00) [ 1433.098941][T11271] [ 1433.101246][T11271] The buggy address belongs to the physical page: [ 1433.107634][T11271] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a7c0 [ 1433.116382][T11271] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1433.124867][T11271] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1433.132402][T11271] page_type: f5(slab) [ 1433.136371][T11271] raw: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1433.144949][T11271] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1433.153522][T11271] head: 00fff00000000040 ffff88813fe21dc0 dead000000000100 dead000000000122 [ 1433.162181][T11271] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1433.170840][T11271] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1433.179504][T11271] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1433.188157][T11271] page dumped because: kasan: bad access detected [ 1433.194553][T11271] page_owner tracks the page as allocated [ 1433.200281][T11271] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 987, tgid 987 (kworker/u8:7), ts 108600700676, free_ts 108539852171 [ 1433.221138][T11271] post_alloc_hook+0xfd/0x120 [ 1433.225840][T11271] get_page_from_freelist+0xf48/0x3530 [ 1433.231393][T11271] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1433.237296][T11271] new_slab+0xa2/0x640 [ 1433.241370][T11271] refill_objects+0xe3/0x410 [ 1433.245962][T11271] __pcs_replace_empty_main+0x376/0x680 [ 1433.251513][T11271] __kmalloc_noprof+0x66d/0x820 [ 1433.256369][T11271] ___neigh_create+0x1532/0x2940 [ 1433.261301][T11271] ip6_finish_output2+0xffa/0x1ce0 [ 1433.266764][T11271] __ip6_finish_output+0x357/0xdf0 [ 1433.271906][T11271] ip6_output+0x2aa/0xa60 [ 1433.276242][T11271] ndisc_send_skb+0xa85/0x1bf0 [ 1433.281011][T11271] ndisc_send_ns+0xc6/0x140 [ 1433.285514][T11271] addrconf_dad_work+0xca1/0x1360 [ 1433.290539][T11271] process_one_work+0xa23/0x1940 [ 1433.295487][T11271] worker_thread+0x5ef/0xe50 [ 1433.300071][T11271] page last free pid 5636 tgid 5636 stack trace: [ 1433.306381][T11271] __free_frozen_pages+0x79f/0x1090 [ 1433.311578][T11271] qlist_free_all+0x47/0xf0 [ 1433.316081][T11271] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1433.321559][T11271] __kasan_slab_alloc+0x69/0x90 [ 1433.326404][T11271] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1433.331872][T11271] vm_area_dup+0x27/0x8e0 [ 1433.336213][T11271] __split_vma+0x18c/0xda0 [ 1433.340627][T11271] vms_gather_munmap_vmas+0x3a5/0x1720 [ 1433.346084][T11271] do_vmi_align_munmap+0x287/0x5f0 [ 1433.351197][T11271] do_vmi_munmap+0x1f8/0x3e0 [ 1433.355788][T11271] __vm_munmap+0x196/0x390 [ 1433.360208][T11271] __x64_sys_munmap+0x59/0x80 [ 1433.364878][T11271] do_syscall_64+0x115/0x870 [ 1433.369485][T11271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1433.375376][T11271] [ 1433.377681][T11271] Memory state around the buggy address: [ 1433.383291][T11271] ffff88802a7c4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1433.391356][T11271] ffff88802a7c4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1433.399423][T11271] >ffff88802a7c4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1433.407470][T11271] ^ [ 1433.413608][T11271] ffff88802a7c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1433.421656][T11271] ffff88802a7c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1433.429699][T11271] ================================================================== [ 1433.442293][T11271] Kernel panic - not syncing: kasan.fault=panic_on_write set ... [ 1433.450010][T11271] CPU: 0 UID: 0 PID: 11271 Comm: kworker/0:14 Tainted: G B L syzkaller #0 PREEMPT(full) [ 1433.461121][T11271] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1433.466644][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1433.476689][T11271] Workqueue: events cxacru_poll_status [ 1433.482164][T11271] Call Trace: [ 1433.485429][T11271] [ 1433.488347][T11271] dump_stack_lvl+0x100/0x190 [ 1433.493049][T11271] vpanic+0x552/0x970 [ 1433.497044][T11271] ? __pfx_vpanic+0x10/0x10 [ 1433.501567][T11271] ? trace_irq_enable.constprop.0+0x122/0x160 [ 1433.507652][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.513285][T11271] ? irqentry_exit+0x24d/0xa00 [ 1433.518072][T11271] ? __mutex_lock+0x233/0x1bd0 [ 1433.522836][T11271] panic+0xd1/0xe0 [ 1433.526555][T11271] ? __pfx_panic+0x10/0x10 [ 1433.530993][T11271] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 1433.536984][T11271] end_report.part.0+0x68/0x90 [ 1433.541758][T11271] kasan_report.cold+0xe/0x18 [ 1433.546445][T11271] ? __mutex_lock+0x233/0x1bd0 [ 1433.551233][T11271] kasan_check_range+0x10f/0x1e0 [ 1433.556173][T11271] __mutex_lock+0x233/0x1bd0 [ 1433.560769][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1433.566059][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.571690][T11271] ? preempt_schedule_common+0x42/0xc0 [ 1433.577149][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.582784][T11271] ? preempt_schedule_thunk+0x16/0x40 [ 1433.588269][T11271] ? __pfx___mutex_lock+0x10/0x10 [ 1433.593315][T11271] ? __mutex_unlock_slowpath+0x6da/0x930 [ 1433.598951][T11271] ? __pfx__printk+0x10/0x10 [ 1433.603539][T11271] ? cxacru_poll_status+0x4c0/0xdc0 [ 1433.608766][T11271] ? cxacru_poll_status+0x4c3/0xdc0 [ 1433.613971][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.619609][T11271] ? cxacru_poll_status+0x55b/0xdc0 [ 1433.624828][T11271] cxacru_poll_status+0x55b/0xdc0 [ 1433.629858][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.635492][T11271] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1433.641047][T11271] ? debug_object_deactivate+0x2e4/0x3b0 [ 1433.646701][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.652335][T11271] ? rcu_is_watching+0x12/0xc0 [ 1433.657124][T11271] process_one_work+0xa23/0x1940 [ 1433.662068][T11271] ? __pfx_process_one_work+0x10/0x10 [ 1433.667434][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.673105][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.678743][T11271] worker_thread+0x5ef/0xe50 [ 1433.683353][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1433.688460][T11271] ? kthread+0x13a/0x450 [ 1433.692715][T11271] ? __pfx_worker_thread+0x10/0x10 [ 1433.697815][T11271] kthread+0x370/0x450 [ 1433.701917][T11271] ? __pfx_kthread+0x10/0x10 [ 1433.706523][T11271] ret_from_fork+0x72b/0xd50 [ 1433.711127][T11271] ? __pfx_ret_from_fork+0x10/0x10 [ 1433.716245][T11271] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1433.721878][T11271] ? __switch_to+0x800/0x10f0 [ 1433.726570][T11271] ? __switch_to_asm+0x39/0x70 [ 1433.731338][T11271] ? __pfx_kthread+0x10/0x10 [ 1433.735959][T11271] ret_from_fork_asm+0x1a/0x30 [ 1433.740741][T11271] [ 1433.744099][T11271] Kernel Offset: disabled [ 1433.748498][T11271] Rebooting in 86400 seconds..