last executing test programs: 1m22.998403s ago: executing program 4 (id=1686): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ffb000/0x3000)=nil) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x0, 0xee00}}, './file0\x00'}) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000008c0)=@newsa={0x1d4, 0x1a, 0x7, 0x70bd2a, 0x25dfdbfc, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0x0, 0x16, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, {0x5a, 0xb400, 0x2, 0x4, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0xc001, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2}, [@sec_ctx={0x35, 0x8, {0x31, 0x8, 0x0, 0x4, 0x29, "8d12376092e59fd9027f52d5550b799cbb5ee309b089cee79bc319e7f84d082dc8a853a77c48cd279f"}}, @policy={0xac, 0x7, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00', 0x4e23, 0x854, 0x4e20, 0x4, 0xa, 0x0, 0x80, 0x32, 0x0, r1}, {0xffffffffda7974c9, 0x9, 0x9e, 0x2, 0x1, 0xfff, 0xfffffffffffff001, 0x2}, {0x6, 0xf, 0x9, 0x8}, 0x9, 0x6e6bbb, 0x2, 0x0, 0x2}}]}, 0x1d4}}, 0x8000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0xa, 0x2, 0x0) sendto(r3, 0x0, 0x0, 0x41, &(0x7f0000000680)=@l2tp={0x2, 0x0, @empty, 0x2}, 0x80) sendmsg$nl_xfrm(r3, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)=@flushsa={0xfc, 0x1c, 0xca64522761762ea4, 0x70bd29, 0x25dfdbfb, {0x841738584c534722}, [@algo_aead={0xde, 0x12, {{'rfc4106(essiv(rfc7539(rfc3686(fpu(ofb(aes-aesni))),blake2b-160-g'}, 0x490, 0x40, "d39738e114ec45e6e388c32380e9a798b83518a70a6df90665e7187302233ad1f96eef0c70ec5deb0d8b2f4f6bdbad393b46f02f3543188da931ccaabe5102be2826a8681e62c77a60704f486749e5af2f5ea2b36c076d13c6caf784b20e3dc4fdafb7bd2f926931c2d1fd25c4528045846f49e8e532e3aee593b8d0c5f1da9995cddde273a1463d0629e389428c33694dd9"}}, @replay_thresh={0x8, 0xb, 0x8}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000805}, 0x400d0) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000060a0b0400000000000000000200000014000480100001800a00010071759bab2c9b00000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x68}, 0x1, 0x0, 0x0, 0x84}, 0x0) 1m22.330365896s ago: executing program 4 (id=1689): r0 = socket$kcm(0x11, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1m21.883014018s ago: executing program 4 (id=1692): syz_mount_image$btrfs(&(0x7f00000055c0), &(0x7f0000000000)='./bus\x00', 0x300000a, &(0x7f0000000380)={[{@metadata_ratio={'metadata_ratio', 0x3d, 0x4}}, {@inode_cache}, {@usebackuproot}, {}, {@commit={'commit', 0x3d, 0x8}}, {@discard_async}, {@nobarrier}, {@thread_pool={'thread_pool', 0x3d, 0x8}}, {@nospace_cache}, {@discard_async}, {@ssd_spread}, {@nossd}]}, 0x23, 0x55a3, &(0x7f000000e0c0)="$eJzs3X9snHUdB/DnruvaFdeWMOuArGwDJFtEOjdNCCR2bNNpYTnphE3I+gNH0DmtY8NVCCtinIERijWMwQoLbn9MEYqucyiJBewqul8IJtNFBbPFNWOkOBExYTG9u+d299zaHhMpwuu1tM/zvc/z/d73njx/3PvW73MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABEHwx+N3TL/t3roJ26+ru++8a85e+2D3kuMX3rq1avND20v2dTz31aNVq1qPLF1w0/2JpkfW93d3BkEs2S+W7t9w2fwrr69vuKI0HLDxc6ltZeVQT5nq+mKqMTbnwcF+uT9NQRAURwYoSm/npXfiOQNkdlfkDzisayf1tE4dP69x28qujc8uu3xL/ktnUOloT2C0pK+rgyeupdrk73jkiEw769KL5Vyiqf7RC+4deREAwFtSk0huMm9H029xM+22aD3Sro202yPt8B1Ce3bjVKTGHTvUPCdH66M0z9pUVCgZcp6Revr8Z9qJaP9IOxI13sI8cw9NR5rSoebZEqmP1jwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3k0uuH5m/d49D7/8ldbf/u7h17/16sePrGq8ZaC7/qJ1ix/v2PG9vx2tWtV6ZOmCm+5PND2yvr+7Mwgqk/1iqe6xZ6ri8ZkDddseu6e3puFDC9cUpccNt2OyDg72hzsXVwRBc1blYDhsf3kQJHILyWawIb/wpeTOZ8ICAAAA7yVnJn/HM+1UHCzOaceSaTKW/BdKhcVrJ/W0Th0/r3Hbyq6Nzy67fMupj5cYYrzak46XaVee+IllBeMw/kbHO1EPD12RN87woiNG8/zpx/qnNdfdUHrl7gsWzphdv+XS4CfTD3csX3TfhBfHL9nXXpOX/yuHz//hmZP/AQAA+G/I/9FxhjdS/m+uqZh0cOp3ix67rur44fkP/Lyz7/kn4w8VD3Q//dLYcbf9cnVe/p+c85R5+T+ccZj/48Gp5X8AAAB4N/tf5//avHGGN1L+/8X+zZ//98pvTDk84187Xnj69xdvnVI+/7WyGTe8+cSCVxp2tf0pL//XFJb/x2RPO3xwVzjhZRVBUFP4SQUAAAByhP/vfuKjhTCvpz45iOb1y+4qe3LXG+tvjJ/V8o8zFvfPqv7i7tVf37ApNrChc92O5XNX5OX/2sLyf/E783IBAACAAvxm+y13V395ydYtew7N2XFnYvPYS+a+uuennVf1vXwsUfT8zX15+T9RWP4vGZ2XAwAAAJzEU+MmPnfo0UNfm7177YS9q9rmPD5t3+qFD/xz9t+veOnPxzddWJ6X/xsLy/9l6W165UOq087wrxA6KoKgdHCnJVXoC9o/mSkAAAAAb5Mwpzc1revduX7MrNfOPvzDNSuW/2rvpd++a2P1zQd+XXX7ucf2996Yl/9bhr//f3ing3D9f879//LW/2cVUnf9u8SNAQAAAHg/yl/PH94eP/XNBUN9/36h6/8/euaBko7m8ysnx7dVz3rig31Xra1+fVHHRZ/YfusbH46V//VTefm/rbD8X5S9fTu//w8AAABOwf/b9/8tzhtneCPd/79v3DPnrPnsPT+o/WbZU+e+eXfzd9oPTj9v87QzPlJ0fvecmX/4fl7+by8s/4fb07JfXk94fm6vCIKJgzvpuwluDae7LFLoKs4qpE58pEd92CNd6CrJKiS1RHp8rCIIpgzutEUKp4eF9khhoDxd2BQp7A0L6eshU3g0UugJr7R7y9PTjRZ+FhbSCyy6whUUp2WWRER6HBuqx2DhpD0OZJ4cAADgfSUMz+ksW5zbDKJRtis20gFlIx0QH+mAopEOGBM5IHrgUI8HjbmF8PEfz+1e+so1D9b1Xt1w9KzZe5bc0faBnkW9O7/wo55z/nL1Cws/nZf/NxWW/8NTMTa1GWr9fxCu/09/r2Fm/X9jWKiMFLrCQiJ6x4BE+BypsHtn+ByViXSPgYmZAgAAALynhZ8LFI3yPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sHfvcVJVd4LATzf9oJum6YgBY4ygRkR3aZomGEQcUXRXo4tNJKtjhtAIjXZoAwq4YsyKr3GV6GLUmBjZwY+jJg6r+CDqRIXoiElGJfE5Kz4HnciqS9BR45gs++m+dYqqW112IaC0+/3+0XWqfud569F17r11LgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/P/hsiX3Nrw58H9965ffW/f697409TdTD9m8y19uqHt3yDlPbT5ocN0tbw1asPCNtklnXtsyffk1G1YuDaGlq1xZUrzsoUHl5aP/cMxdt13xcNO0wVPOrcrUm4mHfp1/yjN3Loytvto/hLvLQqhIB0bUJYHKzP26WN8edSF8LmwJZEu01SYl0g2Hh2tCWBa2BLJV3VsTQl1OYMoTD666rDNxVU0I+4YQqtNtvFCdtFGTDgyrSgK16cCciiTw/uZENnBPeRKAbRbfDNkX/YqW/AwN3Zcr8vqr3G4d+3Slh9cnJhqK53vrsB3cqRxV6QdatulpK6iOHaLg7bHau60XvNsKtvMST1vuF6nMN5TNW0LVoXxm26zpCzrmx0fKQ2Njn2I17aDned2mc2ZsTbrXvA5jBxq2y+vwgdpJ9Ze9PfHglSf/8fR956+duq3dfC5nk+amd7TqkHnN9ZrnMZrg86QXvP0KviUN9aUrhHD8nz5f9sycl3bf+MGrJ068/YWLr5628JopE58d9Iux/3jtLndPu7xg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MbKxP5uYAAADQa/SGvaZfHf3qS6c+dPeiF5cfV/Hdcb86abf6irO/33H8rivHf/HSK9sf36Vg/j+0tOP/8ZB/Xe5oV4cwoStxwYAQdut6PAn8LHbn5AEh7NWVaskPHJYKrA7hC12J/bNVpUr0jSWGpgK/r88EJqQCa2KgJRW4MQaWpAIXxsCKVGBGDKxOBQ6PgdCeP44D6jPjKDlQEwOtyUZcEc9CeKc+tpbaVuuyVQEAAGwnmdlhZf7dnHMdtjVDnF6uqOkpQzwDu2iG6lQN6RlsdlpVtIaKnmoo76mG7LgXffTwC2ou66nmgtMwyvIzfDjkO+UDJu79o7tuHHFT84sTv/vu2OO/8uc33129/z/993vOmX/dAQXz/6aPnv9Xd9ORsoLj/yFM7vobc5dnIh3ZeGtLXgYAAABgG1z12NInbzjgqP9z38v33fmla28oX3311//vKxsv2HvUccPL+v7dt1cUzP8nlHb+f9wn0icnc3g07oaYPSCEpvxAUu3BhYHkqHe/TAAAAAB6g+zx+Oyx8PbMbXKKdno+XZi/ZSvzxwP/E7rNf/mmv372y9c+eeLCYftsuOK/nflB2efH/m6XY9eOfPytPYf9Q0PfwvP/W0o7/782/zbpxJrYiysHhNA3J/BI7GVnoMvQGHj50PxAZvxr4gZYHKvKnJiQrWpxLNEaA02pwLJiJX6bLbFbfiDzZGUbvyA7jvZMiZwAAAAAfOLi7oB4XD6e/3/P5AO+tP+gl8a8uOe9C1+bsPSEU2t/uM8tu74+oGPSmAMnHHLEMwXz/9atO/+/ax5ccHp/R78QRlaE0Cf9w4BHa5OFAWOgriyTuL82qatPuqrzakMY3zmwdFWvZNb/r0ivMfhETVJVDOy29083DetM3FATwsjcwDPfvH5MZ2J+KpBt/Bs1IQzpHG268ZV9k8Yr041f0zeEPXMC2apO7htCZ2NV6aoerM5cxyBd1W3VIQzMCWSrOrA6hIUBgF4q/iudmfvgvIVnz57e0dF2xg5MxH34NWFWe0db44w5HTOri/RpZqrPecsYnVc4plKvfPN8ZomiqUNuH15KOvs7wabctjL78QtOHMzcj9+FKrvG2VyZd3d0esjD9ylsIuR8kyo25PIdPOTa3Eq2PIkF9cf8VaFf6LtgXtsZjWdNnz//jFHJ31KzNyd/42GmZFuNSm+r2u76VsLLo+hqWSkfd1vtl1vJyPmnzR05b+HZI9pPm35K2ylt32keO6q5ecxXx45pHtk5qqbkbw9D3a+7qlND3Xx9iePajkPdvSKnkk/iU0NCQqK3JaYvKTt/wrRf3/+tPdacdtZJe/z9HjNHnPRXl/9m7omNh0z+1fV/ubZg/j/3o+f/8VMnfvJn1mcodvy/IR7mTx7fcpi/NQaWlXr8v6HY0fzsiQFDU4FFMbDIYX4AAAA+G+LuyLg3M+6Vvq7un+4+cuaMQ97/5QlTrv7bseNOPWv9vg0XX33skv+w/p0lq454u2D+v6i03/9vp/X/s0vXf63YMv/7xxJNxdb/Ty/zn13/f1Gx9f/Ty/xn1/9f9ims/78gG0htknes/w8AAHwWfHLr//e4vH/6AgEFGXpc3j99gYCCDD0u41/qBQK2ev3/OR1/UTvo8jnjDh0x98ePrNp7ycDbvvT8xF/vs/SgEfeuvOW9UbcWzP+XlDb/t3A/AAAA7Dwe+mXfb1/87rD7n3rk/SPLLv3txpuO/6u2Aw75w8DmUyYfXfP9m/6tYP6/rLT5/ye//l8odv7/0GKBlmILA1r/DwAAgF6q2Pp/Nw98eejq+SNufOznb97yUusvZo5/7d8t+cFXpg9runnNut80zFhfMP9fUdr8P552UZ6XO/bmw/pkTbuQXtNuY332JwMAAADQO5SHxsbKEvPmrYx62Mdvc11mKdCPSud6+r5BqxaUP3RVWfXGH1wy7ZDGc489c86RF63/fu2TP6md2lh9RsH8f3Vp8/+832U8UDup/rK3Jx784cqT/3j6vvPXTt1y/B8AAADYcUrdLwEAAAAAAAAAAAAAAHz6nmpdetAHo45+Y+Zeo/70jWNf+MHiL37zkb+59s9n/vzw+/Zq3zxsSsHv/8PkrnLFfv8fr/sXf1+wa17u2GrP6/9l7k855taFXUsWPlofwj65gdnnz/5cyFybf7/cwKqp+w/uTJyfLnHfi4e/1pmYlg4cNWKX9zoT41OB1rhI4hfSgXhVxff6pwJxecUn04G4PVakA1WZwCX9k3GUpbfVhrpkW5Wlt9VzdSEMyAlkt9XddUkbZekBXpUKZAd4ejoQBzgpEyhP9+rWfkmvYqAuFv2bfkmvAADYacVvgZVhVntHW1P8Ch9vd6/Iv43yliw7r7DashKbfz6zNNnUIbcPLyXdJ/1ddMu1xitDdecQRhV8Xc3NUtY1yu1TSw+bbtciQ+5ptbfyIuXStnbTVRUfUU0yosYZczpmVvY48NE9Z2mu6DHLqILJTm6W8q5NWkItJfSlhBGVuG1K6HK8Xx4aG/ukco2LwYaQp6dXRKm/189d56/YqyA3z9/WXHtpn8F93v+38Rc99OCAyo5TJ7ddtPtj/zxw1Mwf//DB1mt+XzD/byht/l+dO673MhcDWBSvrHfwgBBaSxwRAAAAfPb9z3OX33HinDUbZq2uePZ3v5tdftyJlZvPueucsy967v7FR13y72/e1viKsqc2nfjGprP++o2ffOW6h8966fAZZ901ad0h69uqb/zuXyw/dUjB/H9oafP/uAcrcyg42duxOl7//4IBIXRdWr8hCfwsDvfkASHs1ZVqiSWSC+p/LZZoSgI/iztM9o8lWlvyq+obAytSgd/XZwKrU4E1MZDZS/HTkNmVc0V9CGO6UpPzS8yNJRpSgeNiYGgq0BgDTalA/xiYkAq82T8TaEkF/jEGQnv+trqzf2ZbAQAAbI3MPKsy/25Iz/NWVPSUoaynDLU9ZSjvKUN1TxmKjSLevyNmqEydvFKWk6kyXWtNqpaCDPFi+Fvdr4IM4bf5OdMFC5qO5x9kzzcoy88w7od3tB70tXk/3nTxjx4/8sALj1xy5duXHt1v8JXP/u/2c/v131RbMP9vKm3+X5t/m7S+Js7/t1z/Lwk8Ert3ZTx1fGgMvHxofiCzY2BNnOwuzlbVkimRmbQvjiUmxMDQVGBuDExIBVonZwLLBucHMjPtbOMXZBtvz5TICQAAAMAnLu4giLtp4vx/5bjwzh5Hvt+8+5UD5457/JHzjphes2t1zT+PX7t0/KXVD+3Xt2D+P6G0+X9sr19uYxfG3rzaP4S7y7b0JhsYUZcE4n6Muvjz+D3qQvhczg6ObIm22qREVarh8HBN8gv1qnRV99YkawzE+1OeeHDVZZ2Jq2pC2Ddn70u2jReqkzZq0oFhVUmgNh2YU5EE4p6fbOCe8iQA2yy7VzC+oDKnumQ1dF+uyOvvs3JN0PTwCvaBdpOvu99c7SjV6Qcy+1Sztu5pK6iOHaLg7bHau603vtsavNtyv0hlvqFs3hKqDuUz22ZNX9AxPz6S+0vWAjvoec79lWop6e3wOlz08Xvbs+p0B5pSHx9N3Zfr/nVYFqt7oHZS/WVvTzx45cl/PH3f+WunltyNIuIPhQ++de4Bz+Vs3h2tOmRec73u86TF50lv/Dcw1NMWQlh+wawnn/iX95+vWN/8Xw4cu/y2Nx9b/pODHpg14gsbLvnyxrfePapg/t9S2vy/InXb5YO4MecNCGF4zsZ9NG7+iQOSz8GcQPIpObAwkBxyX19f9JMTAAAAtrfs7o7s/oL2zG1yQnh6nlyYv2Ur88f9FRO6zV9qvweO+YfvHXrV69/4+vrdL3906VPr/tObrxwx7dAHNj29YuXrzcd+/umC+X/rR8//+6a66fi/4//sII7/d2tn3xXdN/3Aom3aFV1QHTuE4//d2tnfbY7/d8vxf8f/u+P4fw8c/+/Wzv60FXxLmutLVwihdcANt/+idvrwflec860Za3/+9DtN416oO/foO//H4YvDNeet+nPB/H9uafN/6/91v2hfdv2/1mLr/80ttv7fIuv/AQAAO1SRhebS87yC1fsKMqRX7yvI0OMCgT0uMWj9v61e/6/2pLNPeqX+rb2umXj7f75z+oXPn3Tis/v2ef6E20+4aeTVw1/68oaC+f+i0ub/8eXQL7f13rL+39DJRapaEgNzLQwIAADAzqjYDgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+XSseXPzFzYv3OeimZz9/0+H/umzNrL1/dcDm0WNObhy+eGDZlX/3L28NWrDwjbZJZ17bMn35NRtWLg2hvatcWVK87KFB5eWj/3DMXbdd8XDTtMFTzq3O1FuZuf1iXu7Y6of1ISzLeaQuJjbWd97ZEphyzK0LKzoTj9aHsE9uYPb5sz/XmbixPoT9cgOrpu4/uDNxfrrEfS8e/lpnYlo6cNSIXd7rTIzPBMrS3b2uf9LdsnR3L+sfwoCcQLa73+6fX1W2jf+YCZSn27i5LmkjBupi0R/VJW3EQEcs0d43hJEVIfRJV/Xr6qSqPumq/r46qapPuqr/Wh3C+BBCRbqqF6uSqirSI19blVQVA7vt/dNNwzoTy6pCGJkbeOab14/pTJyeCmQb/3pVCEM6XzLpxu+oTBqvTDd+VWUIe4YQqtIl/rUiKVGVLvFKRQgDcwLZxk+tCGFh4DMhfvjMzH1w3sKzZ0/v6Gg7YwcmqjJt1YRZ7R1tjTPmdMysTvWpmLKc9ObzPv7Yn990zozO26lDbh9eSroiU66yq8vNlXl3R+/svY/9qs2tZMvzUVB/zF8V+oW+C+a1ndF41vT5888YlfwtNXtz8rdPJppsq1G9ZVvtl1vJyPmnzR05b+HZI9pPm35K2ylt32keO6q5ecxXx45pHtk5qqbk7/YY6vWf/FB3r8ip5JP4AJCQkOhtifK8T7emnf2DvOCL/paOVobqrg/ogmlFbpayrlFuj0Ef9jFH/HG+p/Q4olEFE4eCLM09ZxldMJnYkqUmydL1va5gcphbU3nXJo33y0NjY59i26Eh/27u5n1rGzbvusymKzUNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/D924EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBYAAAAAEOZvHUbPBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwKUAAAD//5twzl8=") r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregset(0x4205, r0, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) (fail_nth: 1) 1m19.050386365s ago: executing program 4 (id=1701): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x201899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) unshare(0x22020600) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) write$binfmt_elf64(r0, 0x0, 0xb0) faccessat(r0, &(0x7f0000000040)='./file0/file0\x00', 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) r1 = socket$caif_seqpacket(0x25, 0x5, 0x3) write(r1, &(0x7f0000000300), 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) umount2(&(0x7f0000000100)='./file0\x00', 0x0) 1m18.714502823s ago: executing program 4 (id=1703): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$sndctrl(0x0, 0x0, 0x0) getpid() mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6) shutdown(0xffffffffffffffff, 0x32ce970513f32900) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x8) connect$inet(r2, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={0xffffffffffffffff, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r3}, 0x20) sendto(r3, &(0x7f0000000700), 0x0, 0x0, 0x0, 0x0) 1m17.649616178s ago: executing program 4 (id=1708): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad", 0x8f}], 0x1, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1m17.263011937s ago: executing program 32 (id=1708): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad", 0x8f}], 0x1, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 22.155806642s ago: executing program 1 (id=1878): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg$inet(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cce6", 0x2}], 0x1}}], 0x1, 0x4001) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ff2000/0xd000)=nil, 0xd000, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0}, &(0x7f00000002c0)=0x40) setns(0xc9, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg$inet(r1, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="81006b", 0x3}], 0x1}}], 0x1, 0x40) r2 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="800000000001010400000000141a000002fff500240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000011c00108008000140000000000800024000000000080003"], 0x80}, 0x1, 0x0, 0x0, 0x4000810}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000000010104000000000000000002000b00240001801400018008000100e000000108000200e00000010c0002800500010000000000080008400000c0d504000f80"], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000100)=0x7ff, 0x4) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000a40)=@raw={'raw\x00', 0x8, 0x3, 0x300, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x0, 0x0, 0x31ea8be7603078ea}}, @common=@inet=@tos={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x360) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000200), 0x4) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x33822}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x3c}, 0x1, 0x0, 0x0, 0x480c1}, 0x240408d0) preadv(r2, &(0x7f0000003240)=[{&(0x7f0000002100)=""/4096, 0x1000}], 0x1, 0x1, 0x0) 21.594745956s ago: executing program 1 (id=1881): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x488c9) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 18.997435218s ago: executing program 1 (id=1892): landlock_create_ruleset(&(0x7f0000000000)={0x802, 0x8, 0x0, 0x18300, 0xf, 0x3}, 0x30, 0x0) socket$kcm(0x10, 0x3, 0x10) r0 = syz_usb_connect$cdc_ncm(0x2, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") syz_open_dev$char_usb(0xc, 0xb4, 0x0) close(0x3) sendmsg(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000040)=[{0x0}, {&(0x7f00000015c0)="817bb97cdac2f8f819447aa4a50c293af36b43cab2641b7753df26945d52221c709e64446077e0", 0x27}], 0x2}, 0x40040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b36, &(0x7f0000000040)={'wlan1\x00', @random="0100"}) socket$xdp(0x2c, 0x3, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x0, 0x800, 0x0, 0x100001, 0x5}, 0x0, &(0x7f0000000240)={0x1f, 0x2, 0xffff, 0x3, 0x4, 0x80000000000000, 0x6a9}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 15.254749536s ago: executing program 1 (id=1904): r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f0000001040)={0xa, &(0x7f00000002c0)="aea643a84ca1fc91c10a00779e28f3cf69a9f69cf032e16e1f8b8ccc737a2cebfc01000000b10e1ec3"}) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) pipe2$watch_queue(&(0x7f00000001c0), 0x80) (async) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3]) (async) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) (async) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') (async) chdir(&(0x7f0000000080)='./file1\x00') socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$int_out(r2, 0x5460, &(0x7f0000000240)) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000001500)={0x2020}, 0x2020) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="d8000000180081054e81f782db4cb904021d0800fe00fe05e8fe55a10a0015000600142603600e1208000f007f370301a8001600a40002400f000100035c0461c1d67f6f94007134cf6edb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090014d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00350db798262f3d40fad95667e006dcdf63951f215c3f8b6ad2cba0e2375ee535e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0) open(&(0x7f0000000280)='./file0\x00', 0x101000, 0x28d) (async) r8 = open(&(0x7f0000000280)='./file0\x00', 0x101000, 0x28d) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, 0x0) ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) 14.710714309s ago: executing program 1 (id=1907): r0 = syz_init_net_socket$bt_cmtp(0x1f, 0x3, 0x5) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f0000000480)={@none, 0x7ff, 0x6, 0x1}) 14.206108222s ago: executing program 1 (id=1911): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/pm_freeze_timeout', 0x40802, 0x74) write$cgroup_int(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x80) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) 13.272256904s ago: executing program 33 (id=1911): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/pm_freeze_timeout', 0x40802, 0x74) write$cgroup_int(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x80) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) 8.470572988s ago: executing program 2 (id=1942): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x9e, &(0x7f00000007c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd60000000006806fffe8000000000000000000000000000bbff02000000000000000000000000000100004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0"], 0x0) 8.360751991s ago: executing program 2 (id=1944): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001000)={0x1, 0x1, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000c00000/0x18000)=nil, &(0x7f0000002000)=[@text32={0x20, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.958076261s ago: executing program 2 (id=1949): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x7) read$char_usb(r0, 0x0, 0x0) 6.058335136s ago: executing program 2 (id=1964): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd03010000092100"], 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000100), 0x12) listen(r1, 0x1) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000008050000010b007e"], 0x88) 5.289556064s ago: executing program 0 (id=1970): bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, 0x1, 0x13838}}, 0x20}, 0x1, 0x0, 0x0, 0x45}, 0x40000) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x38, 0xfff, 0xffffffffeffffffe, 0x6, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x8, 0x3, 0xb, 0x7, 0xffffeffffffffff8, 0x9, 0xc], 0x25000, 0x304}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.985276181s ago: executing program 0 (id=1973): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0xc804, &(0x7f0000000500)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000240)='./file0\x00') truncate(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x6) lsetxattr$trusted_overlay_nlink(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340), &(0x7f0000000380)={'L+'}, 0x16, 0x3) 4.810495236s ago: executing program 0 (id=1975): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bff000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, 0x0}) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x88f, 0x0, 0xf16d}]}) 4.559620182s ago: executing program 0 (id=1977): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) bind$inet6(r0, 0x0, 0x0) setresuid(0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, 0x0}}], 0x1, 0x0) getresuid(&(0x7f0000000080), &(0x7f00000000c0), 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x16, &(0x7f0000000300)={@remote, @empty, @val={@void, {0x8100, 0x6, 0x1, 0x3}}, {@llc_tr={0x11, {@llc={0x4, 0x80, "339d"}}}}}, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @rand_addr=0x64010101}, 0x10) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/27, 0x1b) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newlink={0x28, 0x10, 0x1, 0x70bd2b, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) 4.466058244s ago: executing program 5 (id=1978): openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000100)) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x30, r5, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x30}, 0x1, 0x900}, 0x0) 4.070087183s ago: executing program 0 (id=1981): socket$nl_route(0x10, 0x3, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setns(0xc9, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x12, 0x2f, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.742876711s ago: executing program 2 (id=1984): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0x2, 0x9}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r6, {0xffff, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xf4, 0x0, 0x4, 0xb, 0x3}, 0x31}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x40) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, r6, 0x18}, 0x80, &(0x7f00000034c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005004024c1020000ff88125ce882cbf400930bf4533f", 0x20}, {&(0x7f00000022c0)="ffc9ace87aade11690dd52a158e0", 0xe}], 0x2}, 0x8000) 3.671574223s ago: executing program 0 (id=1985): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000000c0)="94029fa32a0c00612eb80802be58666a67d73398b58ca82216045886e246d60a04f0ab8b3d6626ee8f045270ee48b3770200", 0x32}, {0x0}], 0x2) 3.527024546s ago: executing program 5 (id=1986): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/msr/parameters/allow_writes\x00', 0x2, 0x0) 3.37058605s ago: executing program 5 (id=1987): bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 3.286579112s ago: executing program 5 (id=1988): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002940)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x1, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe38, 0x2, {{{0x9, 0xb, 0x4, 0x8c45, 0x200}, 0x5b, 0xf, [{0x0, 0x80000000, 0x0, 0x0, 0x2, 0xea4a}]}, [{0x5c, 0x71e, 0x3, 0xfffffffe, 0x6, 0x1}, {0x5, 0x40, 0x2, 0xd, 0x401}, {0x5, 0xc, 0x8, 0xfffffffb, 0x3, 0xfffffffb}, {0x8, 0xfffffffc, 0x16, 0x9, 0x2, 0x9}, {0x0, 0x80000000, 0x3, 0x1, 0x76}, {0x10001, 0x459e, 0x5, 0xb8a5, 0x5, 0x8}, {0x8, 0x2, 0x1ff, 0xfffffffa, 0x8, 0x3}, {0x1b, 0x8, 0x900000, 0xfffffff8, 0x5, 0x8}, {0x9, 0x1, 0x9, 0x10, 0x4}, {0x0, 0xcc, 0x3, 0xffff, 0x7, 0x7}, {0x8, 0x6, 0xdc5, 0x3, 0x3, 0xfffffffa}, {0xa8, 0x5, 0x10000, 0xffffffff, 0x6b0c, 0x8e2}, {0x6, 0x8, 0x200, 0x1, 0x0, 0xffffffff}, {0x2, 0x3, 0x9, 0x0, 0x1, 0x8}, {0x7, 0x30000000, 0x4, 0xb, 0x5, 0x7}, {0x7fff, 0x6, 0x3, 0x6, 0x64, 0x6}, {0xa, 0x9, 0x6, 0x8, 0xfb}, {0xb1, 0xa37, 0xfffffeff, 0x100, 0x200, 0x7fff}, {0x100, 0x3, 0x8, 0x9, 0x7, 0x8}, {0x4e91, 0x7, 0xffffffff, 0x40f, 0x11, 0x1b}, {0xffff, 0x2, 0xfffffff0, 0x101, 0x7ff, 0x6}, {0x1, 0xb, 0x3, 0x5, 0xfffffffc, 0x5}, {0x2, 0x2, 0x400, 0x1a76, 0xa, 0x800}, {0xa578, 0x5, 0x5, 0x9c, 0x675, 0x88b}, {0xfffff221, 0x101, 0x5, 0xfffffff9, 0x80000000, 0x81}, {0x5, 0x0, 0x7, 0x0, 0xb, 0x3}, {0x3, 0xc11, 0x400, 0x6, 0x53f, 0x9}, {0x3, 0x7, 0x6, 0x4, 0x4, 0x4}, {0x5, 0x401, 0x1, 0x6, 0x4, 0x1ff}, {0xffffffff, 0x40089cf3, 0x5, 0x3, 0x9, 0x800}, {0x0, 0x5, 0x4, 0x9, 0x2}, {0x29f, 0xca, 0x0, 0x1, 0x5, 0xfffffffa}, {0x10001, 0x10001, 0x10, 0x4, 0x10000, 0x6}, {0xae7, 0x800, 0x80000001, 0xf, 0x6, 0x6}, {0x4, 0x4, 0x8, 0x2, 0x9, 0x4c}, {0x4, 0x1, 0xfffffff7, 0xcc, 0x7ff, 0xeb9a}, {0x8001, 0x3, 0x2bd2, 0x1621, 0x3, 0x2}, {0x8, 0xfffffe00, 0x9, 0xd5e, 0x5, 0x2}, {0x6, 0x4, 0x6, 0x11f, 0xc, 0x1}, {0x5, 0x101, 0x721, 0x100, 0x908, 0x8}, {0x2597, 0xa, 0x9, 0x8, 0x80000001, 0x4}, {0x3, 0x7fffffff, 0x200, 0x8ad, 0xd34e}, {0x7fff, 0x800, 0x6, 0x2, 0x7, 0xb2f6}, {0x4, 0xc7, 0x6c, 0xfffffd20, 0x6, 0x1}, {0x401, 0x5, 0x3, 0xdf, 0x8, 0x5}, {0x5, 0x1, 0xe, 0x2, 0x6, 0xa2fe}, {0xfffff685, 0xfff, 0x4, 0xa6c, 0x9, 0x5}, {0x10, 0xc771, 0x1, 0x37, 0xe3f, 0x3ff}, {0x7, 0x0, 0xa, 0x1000, 0x6, 0x401}, {0x5, 0x3ff, 0x5, 0xff, 0x10000, 0x3}, {0x2, 0x9, 0xafa5, 0x0, 0x1, 0x4}, {0x4, 0x40, 0x2, 0xa, 0x2, 0xfffffff7}, {0xb, 0x1, 0x3, 0x100, 0xb, 0x7}, {0x100, 0x995, 0x374e, 0x9, 0x1000, 0xffffdb76}, {0x3, 0x4, 0xa6de, 0x9bf4, 0x3, 0x6}, {0x7ff, 0x0, 0x9, 0x0, 0xfffffffa, 0x1}, {0x7, 0x929, 0x7f, 0xe0000, 0x2, 0x81}, {0x1, 0x34, 0x0, 0x5, 0xe22, 0x6}, {0xfffffffc, 0xaadf, 0xbc7, 0x6, 0x8, 0x2}, {0x6ef, 0x3, 0x9, 0x7, 0x4, 0x8000}, {0x2, 0x1, 0x2, 0xc3c1, 0x7, 0x4bbd}, {0x3ff, 0x4, 0xfffffffe, 0x100, 0x7fffffff, 0x3}, {0x7, 0x2, 0xff, 0x9, 0xb5a1, 0x2}, {0x9, 0x9, 0xffff, 0x100, 0xf8000000, 0x8000}, {0x0, 0xfff, 0x7, 0x7, 0xffffffff, 0xfffffffe}, {0x5, 0x9, 0x80, 0x9, 0x6, 0x9250}, {0x3, 0x5, 0x81, 0x4, 0x1, 0x6}, {0x6, 0x7fffffff, 0x0, 0x1b, 0x39, 0x4}, {0x5, 0x3ff, 0x40, 0xbe, 0xffff, 0x5}, {0x24, 0x53956696, 0x81, 0x4, 0x3, 0x5}, {0x80000001, 0x7, 0x0, 0x5, 0x2, 0x8001}, {0x10000, 0x400, 0x4, 0x1, 0x618, 0x1}, {0xf1, 0x5, 0xfffffbff, 0x5, 0x400, 0xa6}, {0x4, 0x7ff, 0x5, 0x8, 0x800, 0x8}, {0x8, 0x1, 0x1000, 0x100, 0x4, 0x45f2}, {0xd8, 0x8, 0x5, 0xf8b, 0x6, 0xb5}, {0x6, 0x7, 0xe9, 0x80, 0x5, 0xa}, {0x2, 0x0, 0x4, 0x400, 0x1, 0x6}, {0xfa9, 0x3, 0x0, 0xffff, 0x0, 0x3}, {0x99, 0x9, 0x6, 0x3, 0x5, 0x10000}, {0x7fff, 0x4, 0x6, 0x2, 0x48, 0x5}, {0xffffb1c7, 0x7, 0x80000001, 0x1, 0x3, 0xb54f}, {0x2, 0x1, 0x1000, 0x101, 0x9, 0xf7}, {0xfffff000, 0x7, 0x7, 0x6ba, 0x6}, {0x6, 0x0, 0x5, 0x6a7a, 0x545, 0x7}, {0xfffffffc, 0x2c04, 0x7, 0x8000000, 0x4, 0x8000}, {0xffff, 0x7fff, 0x3, 0x3, 0x4, 0x8}, {0x100, 0x400, 0x4800000, 0x835, 0x4, 0x52}, {0x4, 0x7b, 0xff, 0xfff, 0x1, 0x9}, {0x18000000, 0x9, 0x833b, 0xfffff251, 0x5, 0xa}, {0xf, 0x1, 0x8, 0x2, 0x5}, {0x40, 0xfffffffc, 0x4, 0x7f, 0x7, 0x3}, {0x2e, 0x80000001, 0x7fff, 0x3, 0x3, 0x401}, {0x9, 0xacc, 0xd, 0x1, 0x95e, 0x5}, {0x9c2, 0x6, 0x4, 0xffffffff, 0x1000}, {0x7b8, 0x5, 0xb, 0xa, 0x8, 0x200}, {0xf, 0xb7a, 0xe, 0x6, 0xc1, 0x7}, {0x7, 0x5f6b0af1, 0x6, 0x54, 0x0, 0xfff}, {0x78f6, 0x46000000, 0x0, 0x6, 0x8, 0xee96}, {0xfffffffe, 0x7, 0x80000001, 0xff, 0x0, 0x3}, {0x40, 0xf29, 0x9, 0xb, 0xcb, 0x1}, {0x91cb, 0x3, 0x0, 0x7, 0x3}, {0x9, 0xd0f, 0x8, 0xfffffffb, 0x8, 0x2}, {0x401, 0x7fffffff, 0x800, 0xfffff001, 0xc}, {0x6, 0x9, 0xc000, 0x0, 0x8000, 0x7fff}, {0x69, 0xffff, 0x1, 0x6, 0x80, 0x8}, {0x8c7, 0x2, 0xd0, 0x0, 0x4, 0x3}, {0x3ff, 0x4, 0x7, 0xffff, 0x1, 0xff}, {0x4, 0x1ff, 0xd, 0x9, 0x9, 0x2}, {0x7, 0x1, 0xc2, 0x7, 0x4}, {0x22b, 0x7, 0x704e, 0x3, 0x9, 0x6}, {0x80000001, 0x2, 0xffffd611, 0x8, 0x7}, {0x8000, 0x80, 0x9, 0xffff, 0x0, 0x2}, {0x6783edc, 0xaf2, 0x7, 0x8, 0x1, 0xff000000}, {0x7, 0x1, 0x140000, 0x4, 0xd, 0x200}, {0xb, 0x2, 0x8, 0xa, 0x1}, {0x7, 0x69a5, 0x100, 0x236, 0x4, 0x10001}, {0x3, 0xffff0000, 0x144, 0x2, 0x81, 0x8}, {0xde8, 0x2, 0x6, 0x9b, 0x88db, 0x401}, {0x0, 0x6, 0x40, 0x0, 0x9, 0xc9}, {0x2bd1272, 0x59, 0x3921, 0x57, 0x6, 0x80000000}, {0x3, 0x7, 0xb861, 0x1, 0x6, 0x4}, {0x1, 0x3, 0x8, 0x9, 0x4, 0x8}, {0x0, 0x7, 0x80, 0xed2, 0x80000000, 0x8}, {0x2, 0xfffffc01, 0xfc3, 0x8d5, 0x8001, 0x3fffc000}, {0x8d, 0x6, 0x0, 0x5, 0x4, 0x1}, {0x6, 0x9, 0xeec6, 0x6, 0x7, 0x9}, {0x80000000, 0xd6187927, 0x1, 0x2a, 0xa, 0x7fffffff}], [{0x1, 0x1}, {0x4}, {0x2}, {0x2}, {0x0, 0x1}, {0x4}, {0x2}, {0x5, 0x1}, {0x1}, {0x3}, {0x1}, {0x2}, {0x2}, {0x5, 0x1}, {0x3}, {0x2}, {0x5, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x7}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x5, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {}, {0x5, 0xd716e616b6744d43}, {0x5, 0x1}, {0x2, 0x1}, {0x4}, {}, {0x3, 0x1}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x1}, {0x5}, {0x1}, {0x2}, {0x4}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {}, {0x3, 0xb4d2ea9c256b621e}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x4}, {0x0, 0x1}, {0x1, 0x1}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x1}, {0x3}, {0x3}, {}, {0x5, 0x1}, {0x1, 0x1}, {0x2}, {0x5, 0x1}, {0x1, 0x1}, {0x5}, {0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x0, 0x1}, {0x3}, {0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x1, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0xe270aa78089fc197}, {0x4}, {0x3, 0x1}, {0x3, 0x1}, {0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x1}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x3}, {0x5, 0x1}, {0x1}, {0x5, 0x1}, {0x2}, {0x1}, {0x3}, {0x2}, {0x2}]}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r6, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r4, 0x109}, 0x80, &(0x7f0000000600)=[{&(0x7f00000002c0)="d800", 0x2}], 0x1}, 0x20000885) 3.010800919s ago: executing program 2 (id=1989): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) 2.749703595s ago: executing program 5 (id=1991): openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = syz_usbip_server_init(0x1) syz_usb_connect(0x1, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="11010000733336088dee1edb2361000000010902"], 0x0) syz_open_dev$video(0x0, 0x80000000, 0x32b881) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) lseek(0xffffffffffffffff, 0xa, 0x1) write$usbip_server(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000300000001"], 0x35) ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000002200)={0x0, 0x0, 0x0}, 0x0) 2.725540535s ago: executing program 6 (id=1913): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, 0x0}, 0x0) 2.321227465s ago: executing program 6 (id=1994): write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x1, 0x70100f4f, 0xd, 0xe001, 0x10, 0x2, 0x0, 0x0, 0x80, 0x5}}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.164591433s ago: executing program 6 (id=1996): recvmsg$unix(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e0b080510"], 0xe) 1.160962783s ago: executing program 3 (id=1997): r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x10000, @private2, 0x1}, 0x1c) shutdown(r0, 0x0) 1.011991736s ago: executing program 6 (id=1998): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) write$P9_RREAD(r1, &(0x7f00000009c0)={0xb, 0x75, 0x1}, 0xb) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r2, 0x0, r0, 0x0, 0x10001, 0x2) 1.011770526s ago: executing program 3 (id=1999): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ef) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 886.579739ms ago: executing program 5 (id=2000): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0xfffffe14) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x0, {0x0, 0x14}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) dup3(r0, r3, 0x6700000000000000) 702.230414ms ago: executing program 3 (id=2001): openat$kvm(0xffffffffffffff9c, 0x0, 0x2200, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./tracing/events/enable\x00', 0x1, 0x3f00) 564.858567ms ago: executing program 3 (id=2002): socket$alg(0x26, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x48}}, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000180), 0x129102, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000100)={0x0, r2, 0x3, 0x0, 0x9, 0x7fffffffffffffff}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x71, 0x2, 0x2, 0x2d7, 0x8000000000000000, 0x8000000000000000, 0x5, 0x0, 0x4, 0x401, 0x2, 0x5, 0x8d], 0xeeee8000, 0x284e97}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x4a282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 252.476625ms ago: executing program 3 (id=2003): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000040)="2e9b3d0007e03cd65193a1e93daca63c86dd", 0x12}, {&(0x7f00000001c0)="d78d31402b512b3ead7c3bfa33d1853aa5b677db45ff1ee865a083dc64cc43d1be7a1e6e7109511d2fc5", 0x658}], 0x2) 27.58326ms ago: executing program 3 (id=2004): mkdir(&(0x7f0000000080)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='/dev/loop0,', 0xb) 0s ago: executing program 6 (id=2005): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000580)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_setup(0x10, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="043e1d", @ANYRES32=r2], 0x22) kernel console output (not intermixed with test programs): rw=2049, want=40976, limit=40427 [ 628.987422][ T8120] attempt to access beyond end of device [ 628.987422][ T8120] loop2: rw=2049, want=40976, limit=40427 [ 629.792368][ T8747] loop3: detected capacity change from 0 to 2048 [ 629.850970][ T8747] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 630.360939][ T8753] loop0: detected capacity change from 0 to 40427 [ 630.423200][ T8753] F2FS-fs (loop0): invalid crc value [ 630.442632][ T8753] F2FS-fs (loop0): Found nat_bits in checkpoint [ 630.486923][ T8753] F2FS-fs (loop0): Start checkpoint disabled! [ 630.534666][ T8753] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 630.602910][ T8766] device ip6gre2 entered promiscuous mode [ 631.563754][ T9] attempt to access beyond end of device [ 631.563754][ T9] loop0: rw=2049, want=40976, limit=40427 [ 633.606945][ T8802] loop4: detected capacity change from 0 to 2048 [ 633.730558][ T8802] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 634.404936][ T8805] loop2: detected capacity change from 0 to 40427 [ 634.514822][ T8805] F2FS-fs (loop2): invalid crc value [ 634.567480][ T8805] F2FS-fs (loop2): Found nat_bits in checkpoint [ 634.609060][ T8807] loop0: detected capacity change from 0 to 40427 [ 634.620623][ T8805] F2FS-fs (loop2): Start checkpoint disabled! [ 634.653368][ T8805] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 634.741788][ T8807] F2FS-fs (loop0): invalid crc value [ 634.866491][ T8807] F2FS-fs (loop0): Found nat_bits in checkpoint [ 634.907388][ T8807] F2FS-fs (loop0): Start checkpoint disabled! [ 635.135153][ T8807] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 635.619891][ T4306] attempt to access beyond end of device [ 635.619891][ T4306] loop2: rw=2049, want=40976, limit=40427 [ 635.922914][ T8821] md: could not open device unknown-block(1,0). [ 636.519758][ T8831] loop3: detected capacity change from 0 to 40427 [ 636.630328][ T8831] F2FS-fs (loop3): invalid crc value [ 636.657219][ T8831] F2FS-fs (loop3): Found nat_bits in checkpoint [ 636.697323][ T8831] F2FS-fs (loop3): Start checkpoint disabled! [ 636.718961][ T8831] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 637.084530][ T8851] loop1: detected capacity change from 0 to 40427 [ 637.248948][ T8851] F2FS-fs (loop1): invalid crc value [ 637.347115][ T8851] F2FS-fs (loop1): Found nat_bits in checkpoint [ 637.404950][ T8851] F2FS-fs (loop1): Start checkpoint disabled! [ 637.443892][ T8851] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 637.564073][ T8855] loop4: detected capacity change from 0 to 40427 [ 637.837402][ T8857] loop2: detected capacity change from 0 to 40427 [ 637.987818][ T8857] F2FS-fs (loop2): invalid crc value [ 637.994252][ T8855] F2FS-fs (loop4): invalid crc value [ 638.066669][ T8855] F2FS-fs (loop4): Found nat_bits in checkpoint [ 638.114489][ T8855] F2FS-fs (loop4): Start checkpoint disabled! [ 638.130420][ T8857] F2FS-fs (loop2): Found nat_bits in checkpoint [ 638.174397][ T8857] F2FS-fs (loop2): Start checkpoint disabled! [ 638.195602][ T8855] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 638.253767][ T8857] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 639.343498][ T154] attempt to access beyond end of device [ 639.343498][ T154] loop1: rw=2049, want=40976, limit=40427 [ 639.459706][ T144] attempt to access beyond end of device [ 639.459706][ T144] loop4: rw=2049, want=40976, limit=40427 [ 639.769905][ T8877] loop2: detected capacity change from 0 to 40427 [ 639.883370][ T8877] F2FS-fs (loop2): invalid crc value [ 639.940302][ T8877] F2FS-fs (loop2): Found nat_bits in checkpoint [ 639.989757][ T8877] F2FS-fs (loop2): Start checkpoint disabled! [ 640.053886][ T8877] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 641.867306][ T8908] netlink: 'syz.3.1255': attribute type 1 has an invalid length. [ 641.915811][ T8908] loop3: detected capacity change from 0 to 2048 [ 642.131841][ T8908] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 642.565818][ T8913] loop4: detected capacity change from 0 to 40427 [ 642.639742][ T8913] F2FS-fs (loop4): invalid crc value [ 642.655426][ T8913] F2FS-fs (loop4): Found nat_bits in checkpoint [ 642.706117][ T8913] F2FS-fs (loop4): Start checkpoint disabled! [ 642.759783][ T8913] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 642.852088][ T8915] loop0: detected capacity change from 0 to 40427 [ 643.027136][ T8915] F2FS-fs (loop0): invalid crc value [ 643.103488][ T8915] F2FS-fs (loop0): Found nat_bits in checkpoint [ 643.166284][ T8915] F2FS-fs (loop0): Start checkpoint disabled! [ 643.503847][ T8915] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 644.404895][ T4404] attempt to access beyond end of device [ 644.404895][ T4404] loop4: rw=2049, want=40976, limit=40427 [ 644.484612][ T8935] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1264'. [ 644.791383][ T4403] attempt to access beyond end of device [ 644.791383][ T4403] loop0: rw=2049, want=40976, limit=40427 [ 646.288660][ T8948] loop4: detected capacity change from 0 to 40427 [ 646.382887][ T8948] F2FS-fs (loop4): invalid crc value [ 646.425625][ T8948] F2FS-fs (loop4): Found nat_bits in checkpoint [ 646.473326][ T8948] F2FS-fs (loop4): Start checkpoint disabled! [ 646.502810][ T8948] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 646.846451][ T8954] loop3: detected capacity change from 0 to 40427 [ 647.085808][ T8954] F2FS-fs (loop3): invalid crc value [ 647.107076][ T8954] F2FS-fs (loop3): Found nat_bits in checkpoint [ 647.117908][ T8959] netlink: 'syz.4.1262': attribute type 1 has an invalid length. [ 647.158977][ T8954] F2FS-fs (loop3): Start checkpoint disabled! [ 647.185969][ T8954] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 647.911877][ T4403] attempt to access beyond end of device [ 647.911877][ T4403] loop4: rw=2049, want=40976, limit=40427 [ 648.107246][ T4403] attempt to access beyond end of device [ 648.107246][ T4403] loop3: rw=2049, want=45104, limit=40427 [ 657.620999][ T9040] loop3: detected capacity change from 0 to 40427 [ 657.702124][ T9040] F2FS-fs (loop3): invalid crc value [ 657.741518][ T9040] F2FS-fs (loop3): Found nat_bits in checkpoint [ 657.785733][ T9040] F2FS-fs (loop3): Start checkpoint disabled! [ 657.813787][ T9040] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 658.275708][ T9040] netlink: 'syz.3.1293': attribute type 1 has an invalid length. [ 660.459607][ T154] attempt to access beyond end of device [ 660.459607][ T154] loop3: rw=2049, want=40976, limit=40427 [ 661.409222][ T9068] loop4: detected capacity change from 0 to 40427 [ 661.509142][ T9068] F2FS-fs (loop4): invalid crc value [ 661.543500][ T9068] F2FS-fs (loop4): Found nat_bits in checkpoint [ 661.586911][ T9068] F2FS-fs (loop4): Start checkpoint disabled! [ 661.619823][ T9068] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 661.902189][ T4313] attempt to access beyond end of device [ 661.902189][ T4313] loop4: rw=2049, want=40976, limit=40427 [ 664.651158][ T9093] netlink: 'syz.1.1307': attribute type 1 has an invalid length. [ 664.977326][ T9093] loop1: detected capacity change from 0 to 2048 [ 665.035384][ T9093] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 667.348232][ T9113] netlink: 'syz.2.1313': attribute type 1 has an invalid length. [ 667.439716][ T9113] loop2: detected capacity change from 0 to 2048 [ 667.965523][ T9113] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 672.699409][ T9157] device syzkaller0 entered promiscuous mode [ 673.086200][ T9163] device syzkaller0 entered promiscuous mode [ 673.243202][ T9160] loop4: detected capacity change from 0 to 40427 [ 673.298857][ T9160] F2FS-fs (loop4): invalid crc value [ 673.314190][ T9160] F2FS-fs (loop4): Found nat_bits in checkpoint [ 673.363377][ T9160] F2FS-fs (loop4): Start checkpoint disabled! [ 673.456411][ T9160] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 674.724570][ T8120] attempt to access beyond end of device [ 674.724570][ T8120] loop4: rw=2049, want=40976, limit=40427 [ 675.222009][ T9168] loop2: detected capacity change from 0 to 40427 [ 675.350124][ T9168] F2FS-fs (loop2): invalid crc value [ 675.503826][ T9168] F2FS-fs (loop2): Found nat_bits in checkpoint [ 675.638211][ T9194] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1336'. [ 676.281167][ T9194] device ip6gre3 entered promiscuous mode [ 676.399773][ T9168] F2FS-fs (loop2): Start checkpoint disabled! [ 677.427771][ T9209] device syzkaller0 entered promiscuous mode [ 677.721702][ T9211] loop4: detected capacity change from 0 to 40427 [ 679.035178][ T9211] F2FS-fs (loop4): invalid crc value [ 679.046673][ T9211] F2FS-fs (loop4): Found nat_bits in checkpoint [ 679.104941][ T9211] F2FS-fs (loop4): Start checkpoint disabled! [ 679.150853][ T9211] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 679.495733][ T9226] loop2: detected capacity change from 0 to 40427 [ 679.577535][ T9226] F2FS-fs (loop2): invalid crc value [ 679.604853][ T9226] F2FS-fs (loop2): Found nat_bits in checkpoint [ 679.647329][ T9226] F2FS-fs (loop2): Start checkpoint disabled! [ 679.688152][ T9226] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 680.636525][ T4313] attempt to access beyond end of device [ 680.636525][ T4313] loop2: rw=2049, want=40976, limit=40427 [ 681.102802][ T9240] loop0: detected capacity change from 0 to 40427 [ 681.513318][ T9240] F2FS-fs (loop0): invalid crc value [ 683.357739][ T9240] F2FS-fs (loop0): Found nat_bits in checkpoint [ 683.399065][ T9240] F2FS-fs (loop0): Start checkpoint disabled! [ 683.421436][ T9240] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 683.773145][ T9264] netlink: 'syz.0.1350': attribute type 1 has an invalid length. [ 684.493510][ T154] attempt to access beyond end of device [ 684.493510][ T154] loop0: rw=2049, want=40976, limit=40427 [ 684.943332][ T4306] attempt to access beyond end of device [ 684.943332][ T4306] loop4: rw=2049, want=40976, limit=40427 [ 685.866063][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.874431][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.743147][ T9295] loop3: detected capacity change from 0 to 40427 [ 686.865197][ T9295] F2FS-fs (loop3): invalid crc value [ 686.890734][ T9295] F2FS-fs (loop3): Found nat_bits in checkpoint [ 686.939922][ T9295] F2FS-fs (loop3): Start checkpoint disabled! [ 686.971692][ T9295] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 688.034232][ T9311] netlink: 'syz.3.1364': attribute type 1 has an invalid length. [ 689.504224][ T4403] attempt to access beyond end of device [ 689.504224][ T4403] loop3: rw=2049, want=40976, limit=40427 [ 691.115991][ T9332] device syzkaller0 entered promiscuous mode [ 695.596681][ T9380] loop2: detected capacity change from 0 to 40427 [ 695.935074][ T9380] F2FS-fs (loop2): invalid crc value [ 695.950381][ T9380] F2FS-fs (loop2): Found nat_bits in checkpoint [ 695.981220][ T9380] F2FS-fs (loop2): Start checkpoint disabled! [ 696.762593][ T9380] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 702.418841][ T9433] loop1: detected capacity change from 0 to 40427 [ 702.748334][ T9435] loop2: detected capacity change from 0 to 40427 [ 702.760886][ T9437] loop0: detected capacity change from 0 to 40427 [ 702.805453][ T9433] F2FS-fs (loop1): invalid crc value [ 702.824672][ T9437] F2FS-fs (loop0): invalid crc value [ 702.824723][ T9433] F2FS-fs (loop1): Found nat_bits in checkpoint [ 702.845210][ T9435] F2FS-fs (loop2): invalid crc value [ 702.870911][ T9433] F2FS-fs (loop1): Start checkpoint disabled! [ 702.913991][ T9437] F2FS-fs (loop0): Found nat_bits in checkpoint [ 702.955555][ T9437] F2FS-fs (loop0): Start checkpoint disabled! [ 702.967588][ T9435] F2FS-fs (loop2): Found nat_bits in checkpoint [ 703.009141][ T9435] F2FS-fs (loop2): Start checkpoint disabled! [ 703.050312][ T9437] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 703.050662][ T9433] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 703.080863][ T9435] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 705.639563][ T4281] attempt to access beyond end of device [ 705.639563][ T4281] loop0: rw=2049, want=40976, limit=40427 [ 705.889162][ T9468] netlink: 'syz.4.1408': attribute type 1 has an invalid length. [ 705.973564][ T9468] loop4: detected capacity change from 0 to 2048 [ 706.268787][ T9468] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 707.891721][ T9472] device syzkaller0 entered promiscuous mode [ 708.513373][ T9488] netlink: 'syz.2.1412': attribute type 1 has an invalid length. [ 708.596441][ T9488] loop2: detected capacity change from 0 to 2048 [ 710.522775][ T9488] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 715.749040][ T9522] md: could not open device unknown-block(1,0). [ 716.969620][ T9535] gadgetfs: bound to dummy_udc driver [ 716.993492][ T9536] netlink: 'syz.1.1425': attribute type 1 has an invalid length. [ 717.356645][ T9536] loop1: detected capacity change from 0 to 2048 [ 717.643975][ T9536] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 718.834692][ T9549] device ip6gre2 entered promiscuous mode [ 720.186733][ T9557] loop3: detected capacity change from 0 to 40427 [ 720.303381][ T9557] F2FS-fs (loop3): invalid crc value [ 720.338709][ T9557] F2FS-fs (loop3): Found nat_bits in checkpoint [ 720.395099][ T9557] F2FS-fs (loop3): Start checkpoint disabled! [ 720.454475][ T9557] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 720.754987][ T9562] loop2: detected capacity change from 0 to 40427 [ 721.966120][ T9562] F2FS-fs (loop2): invalid crc value [ 721.983867][ T5415] attempt to access beyond end of device [ 721.983867][ T5415] loop3: rw=2049, want=40976, limit=40427 [ 722.023685][ T9562] F2FS-fs (loop2): Found nat_bits in checkpoint [ 722.103749][ T9562] F2FS-fs (loop2): Start checkpoint disabled! [ 722.180838][ T9575] netlink: 'syz.1.1438': attribute type 1 has an invalid length. [ 722.323008][ T9575] loop1: detected capacity change from 0 to 2048 [ 722.428433][ T9562] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 722.594172][ T9575] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 723.188997][ T9582] netlink: 'syz.2.1436': attribute type 1 has an invalid length. [ 725.610356][ T4281] attempt to access beyond end of device [ 725.610356][ T4281] loop2: rw=2049, want=40976, limit=40427 [ 727.905710][ T9608] loop3: detected capacity change from 0 to 40427 [ 728.011913][ T9608] F2FS-fs (loop3): invalid crc value [ 728.035930][ T9608] F2FS-fs (loop3): Found nat_bits in checkpoint [ 728.121941][ T9608] F2FS-fs (loop3): Start checkpoint disabled! [ 728.164300][ T9608] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 728.494784][ T9619] netlink: 'syz.3.1446': attribute type 1 has an invalid length. [ 729.133987][ T723] attempt to access beyond end of device [ 729.133987][ T723] loop3: rw=2049, want=40976, limit=40427 [ 729.422167][ T9632] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1451'. [ 729.458321][ T9632] device ip6gre2 entered promiscuous mode [ 729.795918][ T9635] loop3: detected capacity change from 0 to 40427 [ 729.897689][ T9635] F2FS-fs (loop3): invalid crc value [ 729.913102][ T9635] F2FS-fs (loop3): Found nat_bits in checkpoint [ 729.916786][ T9639] netlink: 'syz.2.1452': attribute type 1 has an invalid length. [ 729.956571][ T9635] F2FS-fs (loop3): Start checkpoint disabled! [ 729.966842][ T9639] loop2: detected capacity change from 0 to 2048 [ 729.975775][ T9635] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 730.010949][ T9639] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 731.230516][ T5415] attempt to access beyond end of device [ 731.230516][ T5415] loop3: rw=2049, want=40976, limit=40427 [ 731.846613][ T9654] loop0: detected capacity change from 0 to 40427 [ 731.927425][ T9654] F2FS-fs (loop0): invalid crc value [ 732.119218][ T9654] F2FS-fs (loop0): Found nat_bits in checkpoint [ 732.215913][ T9654] F2FS-fs (loop0): Start checkpoint disabled! [ 732.278590][ T9654] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 733.360047][ T9670] netlink: 'syz.1.1458': attribute type 1 has an invalid length. [ 733.453715][ T9670] loop1: detected capacity change from 0 to 2048 [ 733.849575][ T9670] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 734.019489][ T5415] attempt to access beyond end of device [ 734.019489][ T5415] loop0: rw=2049, want=40976, limit=40427 [ 734.502009][ T9674] loop1: detected capacity change from 0 to 40427 [ 734.601463][ T9674] F2FS-fs (loop1): invalid crc value [ 734.623332][ T9674] F2FS-fs (loop1): Found nat_bits in checkpoint [ 734.703061][ T9674] F2FS-fs (loop1): Start checkpoint disabled! [ 734.750181][ T9674] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 735.192811][ T9691] netlink: 'syz.1.1460': attribute type 1 has an invalid length. [ 735.773898][ T144] attempt to access beyond end of device [ 735.773898][ T144] loop1: rw=2049, want=40976, limit=40427 [ 737.988990][ T9716] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1467'. [ 740.668419][ T9734] loop3: detected capacity change from 0 to 40427 [ 740.721818][ T9734] F2FS-fs (loop3): invalid crc value [ 740.744590][ T9734] F2FS-fs (loop3): Found nat_bits in checkpoint [ 740.788285][ T9734] F2FS-fs (loop3): Start checkpoint disabled! [ 740.829348][ T9734] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 741.893306][ T4313] attempt to access beyond end of device [ 741.893306][ T4313] loop3: rw=2049, want=40976, limit=40427 [ 744.679075][ T9779] gadgetfs: bound to dummy_udc driver [ 744.740569][ T9764] loop4: detected capacity change from 0 to 40427 [ 747.304678][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.311640][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.715267][ T9832] overlayfs: failed to resolve './file0': -2 [ 750.783911][ T9834] loop2: detected capacity change from 0 to 40427 [ 750.945295][ T9834] F2FS-fs (loop2): invalid crc value [ 750.973861][ T9834] F2FS-fs (loop2): Found nat_bits in checkpoint [ 751.025208][ T9834] F2FS-fs (loop2): Start checkpoint disabled! [ 751.066216][ T9834] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 751.117995][ T9824] loop1: detected capacity change from 0 to 40427 [ 751.286578][ T9824] F2FS-fs (loop1): invalid crc value [ 751.768079][ T9854] netlink: 'syz.2.1503': attribute type 1 has an invalid length. [ 751.929053][ T9824] F2FS-fs (loop1): Failed to initialize F2FS segment manager (-4) [ 752.290257][ T4313] attempt to access beyond end of device [ 752.290257][ T4313] loop2: rw=2049, want=40976, limit=40427 [ 755.072872][ T9884] netlink: 'syz.2.1508': attribute type 1 has an invalid length. [ 755.097848][ T9884] loop2: detected capacity change from 0 to 2048 [ 755.391400][ T9885] netlink: 'syz.3.1515': attribute type 1 has an invalid length. [ 755.479569][ T9885] loop3: detected capacity change from 0 to 2048 [ 755.561369][ T9884] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 755.568731][ T9885] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 756.173640][ T9890] loop3: detected capacity change from 0 to 40427 [ 756.376521][ T9890] F2FS-fs (loop3): invalid crc value [ 756.432685][ T9890] F2FS-fs (loop3): Found nat_bits in checkpoint [ 756.477865][ T9890] F2FS-fs (loop3): Start checkpoint disabled! [ 756.518071][ T9890] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 756.834918][ T9901] overlayfs: missing 'lowerdir' [ 759.237724][ T9920] loop3: detected capacity change from 0 to 40427 [ 760.649655][ T9920] F2FS-fs (loop3): invalid crc value [ 760.680911][ T9920] F2FS-fs (loop3): Found nat_bits in checkpoint [ 760.730998][ T9920] F2FS-fs (loop3): Start checkpoint disabled! [ 760.782785][ T9920] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 763.844247][ T9952] loop2: detected capacity change from 0 to 40427 [ 763.905662][ T9952] F2FS-fs (loop2): invalid crc value [ 763.943765][ T9952] F2FS-fs (loop2): Found nat_bits in checkpoint [ 763.997758][ T9952] F2FS-fs (loop2): Start checkpoint disabled! [ 764.022740][ T9952] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 768.288852][T10003] overlayfs: missing 'workdir' [ 769.622614][T10014] loop2: detected capacity change from 0 to 40427 [ 769.684482][T10016] loop0: detected capacity change from 0 to 40427 [ 769.733075][T10014] F2FS-fs (loop2): invalid crc value [ 769.741516][T10016] F2FS-fs (loop0): invalid crc value [ 769.751628][T10014] F2FS-fs (loop2): Found nat_bits in checkpoint [ 769.802489][T10016] F2FS-fs (loop0): Found nat_bits in checkpoint [ 769.810728][T10014] F2FS-fs (loop2): Start checkpoint disabled! [ 769.848647][T10016] F2FS-fs (loop0): Start checkpoint disabled! [ 769.870708][T10016] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 769.880872][T10014] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 770.605215][T10025] netlink: 'syz.0.1548': attribute type 1 has an invalid length. [ 770.621878][T10024] netlink: 'syz.2.1549': attribute type 1 has an invalid length. [ 771.773332][ T4404] attempt to access beyond end of device [ 771.773332][ T4404] loop0: rw=2049, want=40976, limit=40427 [ 771.809462][ T723] attempt to access beyond end of device [ 771.809462][ T723] loop2: rw=2049, want=40976, limit=40427 [ 772.179179][T10033] netlink: 'syz.4.1553': attribute type 1 has an invalid length. [ 772.268256][T10033] loop4: detected capacity change from 0 to 2048 [ 772.482483][T10033] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 773.629759][T10045] loop0: detected capacity change from 0 to 2048 [ 774.643687][T10045] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 775.077466][T10051] device syzkaller0 entered promiscuous mode [ 776.064306][T10055] loop2: detected capacity change from 0 to 40427 [ 776.104373][T10055] F2FS-fs (loop2): invalid crc value [ 776.143130][T10055] F2FS-fs (loop2): Found nat_bits in checkpoint [ 776.235972][T10055] F2FS-fs (loop2): Start checkpoint disabled! [ 776.252196][T10055] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 776.688282][T10072] netlink: 'syz.2.1552': attribute type 1 has an invalid length. [ 779.336942][ T8120] attempt to access beyond end of device [ 779.336942][ T8120] loop2: rw=2049, want=40976, limit=40427 [ 781.029425][T10098] loop4: detected capacity change from 0 to 2048 [ 781.706778][T10098] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 781.831732][T10102] device syzkaller0 entered promiscuous mode [ 785.702767][T10152] loop4: detected capacity change from 0 to 40427 [ 785.731217][T10152] F2FS-fs (loop4): invalid crc value [ 785.751618][T10152] F2FS-fs (loop4): Found nat_bits in checkpoint [ 785.782010][T10152] F2FS-fs (loop4): Start checkpoint disabled! [ 785.794457][T10152] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 786.903455][T10164] loop1: detected capacity change from 0 to 40427 [ 786.958787][T10164] F2FS-fs (loop1): invalid crc value [ 787.310349][T10170] loop3: detected capacity change from 0 to 40427 [ 787.395146][T10164] F2FS-fs (loop1): Found nat_bits in checkpoint [ 787.443233][T10164] F2FS-fs (loop1): Start checkpoint disabled! [ 787.456701][T10170] F2FS-fs (loop3): invalid crc value [ 787.486134][T10170] F2FS-fs (loop3): Found nat_bits in checkpoint [ 787.519628][T10164] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 787.542624][T10170] F2FS-fs (loop3): Start checkpoint disabled! [ 787.580376][T10170] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 788.430268][ T8120] attempt to access beyond end of device [ 788.430268][ T8120] loop4: rw=2049, want=40976, limit=40427 [ 788.696164][ T4306] attempt to access beyond end of device [ 788.696164][ T4306] loop3: rw=2049, want=40976, limit=40427 [ 790.950843][T10220] loop4: detected capacity change from 0 to 40427 [ 791.039436][T10220] F2FS-fs (loop4): invalid crc value [ 791.065691][T10220] F2FS-fs (loop4): Found nat_bits in checkpoint [ 791.133846][T10220] F2FS-fs (loop4): Start checkpoint disabled! [ 791.473077][T10238] loop1: detected capacity change from 0 to 40427 [ 791.502907][T10220] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 791.561779][T10238] F2FS-fs (loop1): invalid crc value [ 791.589346][T10238] F2FS-fs (loop1): Found nat_bits in checkpoint [ 791.650030][T10238] F2FS-fs (loop1): Start checkpoint disabled! [ 791.816997][T10238] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 791.843012][T10220] netlink: 'syz.4.1600': attribute type 1 has an invalid length. [ 793.030301][ T144] attempt to access beyond end of device [ 793.030301][ T144] loop4: rw=2049, want=40976, limit=40427 [ 793.077784][ T3056] attempt to access beyond end of device [ 793.077784][ T3056] loop1: rw=2049, want=45104, limit=40427 [ 795.775030][T10297] netlink: 'syz.2.1617': attribute type 1 has an invalid length. [ 795.868385][T10297] loop2: detected capacity change from 0 to 2048 [ 796.030215][T10297] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 796.429349][T10298] device syzkaller0 entered promiscuous mode [ 798.964372][T10321] loop2: detected capacity change from 0 to 40427 [ 799.450102][T10321] F2FS-fs (loop2): invalid crc value [ 799.686074][T10321] F2FS-fs (loop2): Found nat_bits in checkpoint [ 799.723656][T10321] F2FS-fs (loop2): Start checkpoint disabled! [ 799.880966][T10321] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 803.269357][T10351] loop1: detected capacity change from 0 to 2048 [ 803.908178][T10104] attempt to access beyond end of device [ 803.908178][T10104] loop2: rw=2049, want=45104, limit=40427 [ 803.949611][T10351] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 804.190285][T10355] loop0: detected capacity change from 0 to 40427 [ 804.247143][T10355] F2FS-fs (loop0): invalid crc value [ 804.343690][T10355] F2FS-fs (loop0): Found nat_bits in checkpoint [ 804.452844][T10355] F2FS-fs (loop0): Start checkpoint disabled! [ 804.515588][T10355] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 805.647266][T10364] loop3: detected capacity change from 0 to 2048 [ 805.704517][T10364] UDF-fs: bad mount option "novrs" or missing value [ 805.893623][T10373] device syzkaller0 entered promiscuous mode [ 806.010305][ T8120] attempt to access beyond end of device [ 806.010305][ T8120] loop0: rw=2049, want=40976, limit=40427 [ 808.470923][T10411] loop0: detected capacity change from 0 to 64 [ 808.612901][T10415] FAULT_INJECTION: forcing a failure. [ 808.612901][T10415] name failslab, interval 1, probability 0, space 0, times 1 [ 808.712651][T10415] CPU: 0 PID: 10415 Comm: syz.4.1650 Not tainted syzkaller #0 [ 808.722675][T10415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 808.732762][T10415] Call Trace: [ 808.736303][T10415] [ 808.739702][T10415] dump_stack_lvl+0x188/0x250 [ 808.744920][T10415] ? show_regs_print_info+0x20/0x20 [ 808.750291][T10415] ? load_image+0x410/0x410 [ 808.754987][T10415] ? __lock_acquire+0x7b50/0x7b50 [ 808.760602][T10415] should_fail+0x383/0x4b0 [ 808.766262][T10415] should_failslab+0x5/0x20 [ 808.771515][T10415] slab_pre_alloc_hook+0x51/0xc0 [ 808.777920][T10415] __kmalloc+0x6b/0x340 [ 808.782362][T10415] ? __se_sys_memfd_create+0x142/0x450 [ 808.788145][T10415] ? strnlen_user+0x19b/0x250 [ 808.793579][T10415] __se_sys_memfd_create+0x142/0x450 [ 808.799455][T10415] ? lock_chain_count+0x20/0x20 [ 808.805733][T10415] ? __x64_sys_memfd_create+0x60/0x60 [ 808.812345][T10415] ? lockdep_hardirqs_on+0x94/0x140 [ 808.815385][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.819743][T10415] do_syscall_64+0x4c/0xa0 [ 808.819775][T10415] ? clear_bhb_loop+0x30/0x80 [ 808.836402][T10415] ? clear_bhb_loop+0x30/0x80 [ 808.841966][T10415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 808.849565][T10415] RIP: 0033:0x7f7fec51d0d9 [ 808.856873][T10415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.891577][T10415] RSP: 002b:00007f7fea774e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 808.912453][T10415] RAX: ffffffffffffffda RBX: 0000000000000150 RCX: 00007f7fec51d0d9 [ 808.927142][T10415] RDX: 00007f7fea774ee0 RSI: 0000000000000000 RDI: 00007f7fec5b4204 [ 808.941083][T10415] RBP: 0000200000000240 R08: 00000000ffffffff R09: 0000000000000000 [ 808.952946][T10415] R10: 0000000000000001 R11: 0000000000000202 R12: 00002000000001c0 [ 808.967549][T10415] R13: 00007f7fea774ee0 R14: 00007f7fea774ea0 R15: 0000200000000200 [ 808.977167][T10415] [ 808.985704][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.174851][T10420] udc-core: couldn't find an available UDC or it's busy [ 809.250527][T10420] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 809.538502][T10425] device syzkaller0 entered promiscuous mode [ 809.960762][T10439] trusted_key: encrypted_key: insufficient parameters specified [ 809.995933][T10442] udc-core: couldn't find an available UDC or it's busy [ 810.018974][T10442] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 810.112895][ T4239] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 810.145149][T10442] loop0: detected capacity change from 0 to 4096 [ 810.392736][ T5816] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 810.563111][ T4239] usb 4-1: LPM exit latency is zeroed, disabling LPM. [ 810.606137][T10451] loop2: detected capacity change from 0 to 256 [ 810.652653][ T5816] usb 2-1: Using ep0 maxpacket: 16 [ 810.674948][ T4239] usb 4-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 810.724037][ T4239] usb 4-1: config 1 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 810.747639][ T4239] usb 4-1: config 1 interface 0 has no altsetting 0 [ 810.832782][ T5816] usb 2-1: unable to get BOS descriptor or descriptor too short [ 810.918550][T10455] loop2: detected capacity change from 0 to 256 [ 810.943015][ T5816] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 810.969757][ T5816] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 810.976529][T10455] ======================================================= [ 810.976529][T10455] WARNING: The mand mount option has been deprecated and [ 810.976529][T10455] and is ignored by this kernel. Remove the mand [ 810.976529][T10455] option from the mount to silence this warning. [ 810.976529][T10455] ======================================================= [ 811.082930][ T4239] usb 4-1: string descriptor 0 read error: -22 [ 811.092729][ T4239] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b27, bcdDevice= 0.40 [ 811.144332][ T4239] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.253841][T10437] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 811.316375][T10459] loop0: detected capacity change from 0 to 40427 [ 811.358408][T10455] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1fe4a43c, utbl_chksum : 0xe619d30d) [ 811.399260][T10459] F2FS-fs (loop0): invalid crc value [ 811.542994][T10459] F2FS-fs (loop0): Found nat_bits in checkpoint [ 811.609362][T10437] loop3: detected capacity change from 0 to 4096 [ 811.617300][T10459] F2FS-fs (loop0): Start checkpoint disabled! [ 811.639694][T10459] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 811.662932][ T5816] usb 2-1: New USB device found, idVendor=0e41, idProduct=4249, bcdDevice= 0.40 [ 811.680276][T10437] ntfs3: Unknown parameter 'ò' [ 811.701375][ T5816] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.718823][ T5816] usb 2-1: Product: syz [ 811.749482][ T5816] usb 2-1: Manufacturer: syz [ 811.770948][ T5816] usb 2-1: SerialNumber: syz [ 811.982770][ T4239] usbhid 4-1:1.0: can't add hid device: -71 [ 811.989106][ T4239] usbhid: probe of 4-1:1.0 failed with error -71 [ 812.497804][ T5816] usb 2-1: 0:1 : does not exist [ 812.521778][ T5816] usb 2-1: unit 5 not found! [ 812.563721][ T5816] usb 2-1: cannot get ctl value: req = 0x83, wValue = 0x200, wIndex = 0x200, type = 4 [ 812.589573][ T4239] usb 4-1: USB disconnect, device number 2 [ 812.630242][ T5816] usb 2-1: 2:0: cannot get min/max values for control 2 (id 2) [ 812.842836][ T5816] usb 2-1: USB disconnect, device number 2 [ 812.858726][ T4262] attempt to access beyond end of device [ 812.858726][ T4262] loop0: rw=2049, want=40976, limit=40427 [ 812.988089][T10493] FAULT_INJECTION: forcing a failure. [ 812.988089][T10493] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 813.031544][T10493] CPU: 1 PID: 10493 Comm: syz.2.1670 Not tainted syzkaller #0 [ 813.041170][T10493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 813.052653][T10493] Call Trace: [ 813.056932][T10493] [ 813.062370][T10493] dump_stack_lvl+0x188/0x250 [ 813.067568][T10493] ? show_regs_print_info+0x20/0x20 [ 813.073068][T10493] ? load_image+0x410/0x410 [ 813.078333][T10493] ? __lock_acquire+0x7b50/0x7b50 [ 813.083484][T10493] should_fail+0x383/0x4b0 [ 813.087933][T10493] _copy_from_user+0x2e/0x170 [ 813.093892][T10493] __copy_msghdr_from_user+0xc9/0x630 [ 813.100175][T10493] ? verify_lock_unused+0x140/0x140 [ 813.105907][T10493] ? mark_lock+0x94/0x320 [ 813.110895][T10493] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 813.116301][T10493] ? __lock_acquire+0x13dc/0x7b50 [ 813.122185][T10493] ___sys_sendmsg+0x19a/0x2e0 [ 813.127432][T10493] ? __sys_sendmsg+0x290/0x290 [ 813.133952][T10493] __se_sys_sendmsg+0x1b7/0x2a0 [ 813.142744][T10493] ? __x64_sys_sendmsg+0x80/0x80 [ 813.149800][T10493] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 813.162135][T10493] ? lockdep_hardirqs_on+0x94/0x140 [ 813.172600][T10493] do_syscall_64+0x4c/0xa0 [ 813.179692][T10493] ? clear_bhb_loop+0x30/0x80 [ 813.188466][T10493] ? clear_bhb_loop+0x30/0x80 [ 813.195037][T10493] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 813.203626][T10493] RIP: 0033:0x7fc82a6df0d9 [ 813.209679][T10493] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 813.234467][T10493] RSP: 002b:00007fc828937028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 813.245334][T10493] RAX: ffffffffffffffda RBX: 00007fc82a966fa0 RCX: 00007fc82a6df0d9 [ 813.256106][T10493] RDX: 0000000000000004 RSI: 0000200000000740 RDI: 0000000000000003 [ 813.270446][T10493] RBP: 00007fc828937090 R08: 0000000000000000 R09: 0000000000000000 [ 813.282338][T10493] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 813.292321][T10493] R13: 00007fc82a967038 R14: 00007fc82a966fa0 R15: 00007ffc78157328 [ 813.304063][T10493] [ 814.684183][T10520] FAULT_INJECTION: forcing a failure. [ 814.684183][T10520] name failslab, interval 1, probability 0, space 0, times 0 [ 814.816382][T10520] CPU: 1 PID: 10520 Comm: syz.1.1676 Not tainted syzkaller #0 [ 814.825884][T10520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 814.839034][T10520] Call Trace: [ 814.843604][T10520] [ 814.847012][T10520] dump_stack_lvl+0x188/0x250 [ 814.854714][T10520] ? show_regs_print_info+0x20/0x20 [ 814.861688][T10520] ? load_image+0x410/0x410 [ 814.868770][T10520] ? __might_sleep+0xf0/0xf0 [ 814.874177][T10520] ? __lock_acquire+0x7b50/0x7b50 [ 814.879848][T10520] should_fail+0x383/0x4b0 [ 814.885200][T10520] should_failslab+0x5/0x20 [ 814.890050][T10520] slab_pre_alloc_hook+0x51/0xc0 [ 814.896353][T10520] __kmalloc+0x6b/0x340 [ 814.903446][T10520] ? tomoyo_realpath_from_path+0xed/0x5e0 [ 814.912026][T10520] tomoyo_realpath_from_path+0xed/0x5e0 [ 814.919060][T10520] tomoyo_path_number_perm+0x251/0x6b0 [ 814.927011][T10520] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 814.934452][T10520] ? ksys_write+0x1d4/0x260 [ 814.939728][T10520] security_file_ioctl+0x6c/0xa0 [ 814.945088][T10520] __se_sys_ioctl+0x48/0x170 [ 814.950096][T10520] do_syscall_64+0x4c/0xa0 [ 814.955167][T10520] ? clear_bhb_loop+0x30/0x80 [ 814.960652][T10520] ? clear_bhb_loop+0x30/0x80 [ 814.965366][T10520] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 814.971910][T10520] RIP: 0033:0x7f91a87a60d9 [ 814.976506][T10520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 814.997534][T10520] RSP: 002b:00007f91a69fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 815.006826][T10520] RAX: ffffffffffffffda RBX: 00007f91a8a2dfa0 RCX: 00007f91a87a60d9 [ 815.015524][T10520] RDX: 0000200000000540 RSI: 00000000c0d05604 RDI: 0000000000000003 [ 815.024602][T10520] RBP: 00007f91a69fe090 R08: 0000000000000000 R09: 0000000000000000 [ 815.032857][T10520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 815.041194][T10520] R13: 00007f91a8a2e038 R14: 00007f91a8a2dfa0 R15: 00007ffc109a3258 [ 815.049411][T10520] [ 815.062895][T10520] ERROR: Out of memory at tomoyo_realpath_from_path. [ 815.272628][ T4239] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 815.572761][ T4239] usb 5-1: Using ep0 maxpacket: 32 [ 816.022926][ T4239] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 816.055983][ T4239] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.077174][ T4239] usb 5-1: Product: syz [ 816.081576][T10541] loop2: detected capacity change from 0 to 4096 [ 816.086492][ T4239] usb 5-1: Manufacturer: syz [ 816.136916][ T4239] usb 5-1: SerialNumber: syz [ 816.356710][T10554] ksmbd: Unknown IPC event: 10, ignore. [ 816.419684][ T26] audit: type=1326 audit(1786725099.154:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10553 comm="syz.3.1685" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f084b6580d9 code=0x0 [ 816.628479][ T4239] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 816.688717][ T4239] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 816.703254][T10565] FAULT_INJECTION: forcing a failure. [ 816.703254][T10565] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 816.746553][ T4239] usb 5-1: USB disconnect, device number 2 [ 816.795686][T10565] CPU: 0 PID: 10565 Comm: syz.1.1688 Not tainted syzkaller #0 [ 816.803648][T10565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 816.814826][T10565] Call Trace: [ 816.818570][T10565] [ 816.821648][T10565] dump_stack_lvl+0x188/0x250 [ 816.826900][T10565] ? show_regs_print_info+0x20/0x20 [ 816.832905][T10565] ? load_image+0x410/0x410 [ 816.837708][T10565] ? __lock_acquire+0x7b50/0x7b50 [ 816.842983][T10565] should_fail+0x383/0x4b0 [ 816.847717][T10565] _copy_from_user+0x2e/0x170 [ 816.853369][T10565] __copy_msghdr_from_user+0xc9/0x630 [ 816.859683][T10565] ? verify_lock_unused+0x140/0x140 [ 816.865028][T10565] ? mark_lock+0x94/0x320 [ 816.869661][T10565] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 816.874978][T10565] ? __lock_acquire+0x13dc/0x7b50 [ 816.880144][T10565] ___sys_sendmsg+0x19a/0x2e0 [ 816.884948][T10565] ? __sys_sendmsg+0x290/0x290 [ 816.890344][T10565] __se_sys_sendmsg+0x1b7/0x2a0 [ 816.895511][T10565] ? __x64_sys_sendmsg+0x80/0x80 [ 816.900607][T10565] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 816.907001][T10565] ? lockdep_hardirqs_on+0x94/0x140 [ 816.912843][T10565] do_syscall_64+0x4c/0xa0 [ 816.917323][T10565] ? clear_bhb_loop+0x30/0x80 [ 816.922368][T10565] ? clear_bhb_loop+0x30/0x80 [ 816.927209][T10565] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 816.933265][T10565] RIP: 0033:0x7f91a87a60d9 [ 816.937887][T10565] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.958994][T10565] RSP: 002b:00007f91a69fe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 816.968213][T10565] RAX: ffffffffffffffda RBX: 00007f91a8a2dfa0 RCX: 00007f91a87a60d9 [ 816.976556][T10565] RDX: 0000000024000080 RSI: 00002000000000c0 RDI: 0000000000000003 [ 816.984775][T10565] RBP: 00007f91a69fe090 R08: 0000000000000000 R09: 0000000000000000 [ 816.992777][T10565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 817.000863][T10565] R13: 00007f91a8a2e038 R14: 00007f91a8a2dfa0 R15: 00007ffc109a3258 [ 817.009114][T10565] [ 817.193434][ T4181] udevd[4181]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 817.291513][T10577] FAULT_INJECTION: forcing a failure. [ 817.291513][T10577] name failslab, interval 1, probability 0, space 0, times 0 [ 817.386985][T10577] CPU: 1 PID: 10577 Comm: syz.1.1690 Not tainted syzkaller #0 [ 817.395108][T10577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 817.407060][T10577] Call Trace: [ 817.411581][T10577] [ 817.414678][T10577] dump_stack_lvl+0x188/0x250 [ 817.420941][T10577] ? show_regs_print_info+0x20/0x20 [ 817.426643][T10577] ? load_image+0x410/0x410 [ 817.431543][T10577] ? __might_sleep+0xf0/0xf0 [ 817.436760][T10577] ? __lock_acquire+0x7b50/0x7b50 [ 817.441988][T10577] should_fail+0x383/0x4b0 [ 817.446782][T10577] should_failslab+0x5/0x20 [ 817.452659][T10577] slab_pre_alloc_hook+0x51/0xc0 [ 817.458184][T10577] __kmalloc+0x6b/0x340 [ 817.462539][T10577] ? tomoyo_realpath_from_path+0xed/0x5e0 [ 817.468686][T10577] tomoyo_realpath_from_path+0xed/0x5e0 [ 817.474704][T10577] tomoyo_path_number_perm+0x251/0x6b0 [ 817.481998][T10577] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 817.487976][T10577] ? ksys_write+0x1d4/0x260 [ 817.492909][T10577] security_file_ioctl+0x6c/0xa0 [ 817.498358][T10577] __se_sys_ioctl+0x48/0x170 [ 817.503281][T10577] do_syscall_64+0x4c/0xa0 [ 817.508440][T10577] ? clear_bhb_loop+0x30/0x80 [ 817.513417][T10577] ? clear_bhb_loop+0x30/0x80 [ 817.518385][T10577] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 817.524323][T10577] RIP: 0033:0x7f91a87a60d9 [ 817.528921][T10577] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 817.549556][T10577] RSP: 002b:00007f91a69fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 817.558164][T10577] RAX: ffffffffffffffda RBX: 00007f91a8a2dfa0 RCX: 00007f91a87a60d9 [ 817.566485][T10577] RDX: 0000000000000000 RSI: 00000000000089e1 RDI: 0000000000000003 [ 817.574920][T10577] RBP: 00007f91a69fe090 R08: 0000000000000000 R09: 0000000000000000 [ 817.583094][T10577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 817.591227][T10577] R13: 00007f91a8a2e038 R14: 00007f91a8a2dfa0 R15: 00007ffc109a3258 [ 817.600402][T10577] [ 817.658999][T10577] ERROR: Out of memory at tomoyo_realpath_from_path. [ 818.238450][ T4239] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 818.561837][T10595] loop3: detected capacity change from 0 to 4096 [ 818.591799][T10587] loop4: detected capacity change from 0 to 32768 [ 818.696052][ T4239] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 818.712858][T10595] ntfs: volume version 3.1. [ 818.719585][ T4239] usb 3-1: can't read configurations, error -71 [ 818.722005][T10587] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 scanned by syz.4.1692 (10587) [ 818.863016][T10587] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 818.923153][T10587] BTRFS info (device loop4): metadata ratio 4 [ 818.930045][T10587] BTRFS warning (device loop4): the 'inode_cache' option is deprecated and has no effect since 5.11 [ 818.982577][T10587] BTRFS warning (device loop4): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 819.032810][T10587] BTRFS info (device loop4): trying to use backup root at mount time [ 819.040928][T10587] BTRFS info (device loop4): allowing degraded mounts [ 819.112715][T10587] BTRFS info (device loop4): turning on async discard [ 819.119864][T10587] BTRFS info (device loop4): turning off barriers [ 819.173245][T10587] BTRFS info (device loop4): disabling free space tree [ 819.202603][T10587] BTRFS info (device loop4): enabling ssd optimizations [ 819.209941][T10587] BTRFS info (device loop4): using spread ssd allocation scheme [ 819.242552][T10587] BTRFS info (device loop4): not using ssd optimizations [ 819.249823][T10587] BTRFS info (device loop4): not using spread ssd allocation scheme [ 819.352889][T10587] BTRFS error (device loop4): cannot disable free space tree [ 819.429741][T10602] netlink: 'syz.3.1698': attribute type 1 has an invalid length. [ 819.455194][T10602] loop3: detected capacity change from 0 to 2048 [ 819.707785][T10602] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 819.824665][T10587] BTRFS error (device loop4): open_ctree failed: -22 [ 820.033858][T10593] loop0: detected capacity change from 0 to 32768 [ 820.051720][T10587] FAULT_INJECTION: forcing a failure. [ 820.051720][T10587] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 820.102727][T10587] CPU: 0 PID: 10587 Comm: syz.4.1692 Not tainted syzkaller #0 [ 820.110926][T10587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 820.122330][ T4181] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 scanned by udevd (4181) [ 820.123367][T10587] Call Trace: [ 820.123403][T10587] [ 820.123412][T10587] dump_stack_lvl+0x188/0x250 [ 820.123440][T10587] ? show_regs_print_info+0x20/0x20 [ 820.123461][T10587] ? load_image+0x410/0x410 [ 820.123533][T10587] ? __lock_acquire+0x7b50/0x7b50 [ 820.179124][T10587] should_fail+0x383/0x4b0 [ 820.186157][T10587] _copy_to_user+0x2e/0x130 [ 820.191860][T10587] simple_read_from_buffer+0xe3/0x150 [ 820.197743][T10587] proc_fail_nth_read+0x1a6/0x220 [ 820.203255][T10587] ? proc_fault_inject_write+0x310/0x310 [ 820.209285][T10587] ? fsnotify_perm+0x254/0x560 [ 820.214068][T10587] ? proc_fault_inject_write+0x310/0x310 [ 820.220154][T10587] vfs_read+0x2ff/0xd50 [ 820.224513][T10587] ? __lock_acquire+0x7b50/0x7b50 [ 820.229701][T10587] ? kernel_read+0x1e0/0x1e0 [ 820.234417][T10587] ? mutex_lock_nested+0x17/0x20 [ 820.239601][T10587] ? __fdget_pos+0x2bf/0x370 [ 820.244814][T10587] ? ksys_read+0x70/0x260 [ 820.249390][T10587] ksys_read+0x153/0x260 [ 820.253670][T10587] ? vfs_write+0xd70/0xd70 [ 820.258303][T10587] ? lockdep_hardirqs_on+0x94/0x140 [ 820.264013][T10587] do_syscall_64+0x4c/0xa0 [ 820.268886][T10587] ? clear_bhb_loop+0x30/0x80 [ 820.274458][T10587] ? clear_bhb_loop+0x30/0x80 [ 820.279343][T10587] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 820.285832][T10587] RIP: 0033:0x7f7fec4dd90e [ 820.290363][T10587] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 820.310815][T10587] RSP: 002b:00007f7fea774fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 820.319283][T10587] RAX: ffffffffffffffda RBX: 00007f7fea7756c0 RCX: 00007f7fec4dd90e [ 820.327797][T10587] RDX: 000000000000000f RSI: 00007f7fea7750a0 RDI: 0000000000000003 [ 820.336501][T10587] RBP: 00007f7fea775090 R08: 0000000000000000 R09: 0000000000000000 [ 820.344955][T10587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 820.353261][T10587] R13: 00007f7fec7a5038 R14: 00007f7fec7a4fa0 R15: 00007fff42512648 [ 820.361339][T10587] [ 820.483096][T10608] loop1: detected capacity change from 0 to 8 [ 820.521057][T10608] squashfs: Unknown parameter '”' [ 820.543641][T10611] Invalid ELF header magic: != ELF [ 820.555877][T10593] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 820.572723][T10593] BTRFS warning (device loop0): the 'inode_cache' option is deprecated and has no effect since 5.11 [ 820.630061][T10593] BTRFS warning (device loop0): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 820.682759][T10593] BTRFS info (device loop0): trying to use backup root at mount time [ 820.728720][T10608] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1694'. [ 820.736998][T10593] BTRFS info (device loop0): allowing degraded mounts [ 820.774675][T10593] BTRFS warning (device loop0): the 'inode_cache' option is deprecated and has no effect since 5.11 [ 820.830690][T10593] BTRFS info (device loop0): turning on async discard [ 820.910215][T10593] BTRFS info (device loop0): turning off barriers [ 820.952333][T10593] BTRFS info (device loop0): disabling free space tree [ 821.011822][T10593] BTRFS error (device loop0): cannot disable free space tree [ 821.069217][T10593] BTRFS error (device loop0): open_ctree failed: -22 [ 821.861476][T10631] FAULT_INJECTION: forcing a failure. [ 821.861476][T10631] name failslab, interval 1, probability 0, space 0, times 0 [ 821.948680][T10631] CPU: 0 PID: 10631 Comm: syz.0.1707 Not tainted syzkaller #0 [ 821.956689][T10631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 821.968886][T10631] Call Trace: [ 821.972349][T10631] [ 821.975276][T10631] dump_stack_lvl+0x188/0x250 [ 821.979991][T10631] ? show_regs_print_info+0x20/0x20 [ 821.985871][T10631] ? load_image+0x410/0x410 [ 821.990391][T10631] ? __might_sleep+0xf0/0xf0 [ 821.995071][T10631] ? __lock_acquire+0x7b50/0x7b50 [ 822.001471][T10631] should_fail+0x383/0x4b0 [ 822.006133][T10631] should_failslab+0x5/0x20 [ 822.011729][T10631] slab_pre_alloc_hook+0x51/0xc0 [ 822.017314][T10631] __kmalloc+0x6b/0x340 [ 822.021732][T10631] ? load_msg+0x38/0x380 [ 822.026063][T10631] load_msg+0x38/0x380 [ 822.030672][T10631] do_msgsnd+0x1a1/0x10e0 [ 822.035102][T10631] ? __might_sleep+0xf0/0xf0 [ 822.039883][T10631] ? __might_fault+0xb7/0x110 [ 822.044790][T10631] ? __lock_acquire+0x7b50/0x7b50 [ 822.050825][T10631] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 822.056806][T10631] ? ksys_msgsnd+0xa0/0xa0 [ 822.061305][T10631] ? __might_fault+0xb3/0x110 [ 822.066002][T10631] ? __x64_sys_msgsnd+0xe5/0x110 [ 822.071054][T10631] do_syscall_64+0x4c/0xa0 [ 822.076039][T10631] ? clear_bhb_loop+0x30/0x80 [ 822.080824][T10631] ? clear_bhb_loop+0x30/0x80 [ 822.085513][T10631] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 822.091543][T10631] RIP: 0033:0x7f2927d160d9 [ 822.096061][T10631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 822.116084][T10631] RSP: 002b:00007f2925f6e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000045 [ 822.124695][T10631] RAX: ffffffffffffffda RBX: 00007f2927f9dfa0 RCX: 00007f2927d160d9 [ 822.133292][T10631] RDX: 0000000000000df9 RSI: 0000200000000140 RDI: 0000000000000000 [ 822.142495][T10631] RBP: 00007f2925f6e090 R08: 0000000000000000 R09: 0000000000000000 [ 822.151045][T10631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 822.159210][T10631] R13: 00007f2927f9e038 R14: 00007f2927f9dfa0 R15: 00007ffc75f05498 [ 822.167758][T10631] [ 822.237340][ T4262] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.394470][ T4262] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.532852][ T4226] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 822.575979][ T4262] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.761014][ T4262] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.782073][T10649] FAULT_INJECTION: forcing a failure. [ 822.782073][T10649] name failslab, interval 1, probability 0, space 0, times 0 [ 822.824646][T10649] CPU: 1 PID: 10649 Comm: syz.1.1713 Not tainted syzkaller #0 [ 822.826878][T10651] loop3: detected capacity change from 0 to 128 [ 822.832255][T10649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 822.848960][T10649] Call Trace: [ 822.852545][T10649] [ 822.855504][T10649] dump_stack_lvl+0x188/0x250 [ 822.860316][T10649] ? show_regs_print_info+0x20/0x20 [ 822.865664][T10649] ? load_image+0x410/0x410 [ 822.870749][T10649] ? __might_sleep+0xf0/0xf0 [ 822.875720][T10649] ? __lock_acquire+0x7b50/0x7b50 [ 822.880868][T10649] should_fail+0x383/0x4b0 [ 822.885495][T10649] should_failslab+0x5/0x20 [ 822.890065][T10649] slab_pre_alloc_hook+0x51/0xc0 [ 822.895053][T10649] __kmalloc+0x6b/0x340 [ 822.899284][T10649] ? tomoyo_realpath_from_path+0xed/0x5e0 [ 822.905087][T10649] tomoyo_realpath_from_path+0xed/0x5e0 [ 822.910721][T10649] tomoyo_path_number_perm+0x251/0x6b0 [ 822.916373][T10649] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 822.921915][T10649] ? ksys_write+0x1d4/0x260 [ 822.926633][T10649] security_file_ioctl+0x6c/0xa0 [ 822.931736][T10649] __se_sys_ioctl+0x48/0x170 [ 822.936318][T10649] do_syscall_64+0x4c/0xa0 [ 822.941443][T10649] ? clear_bhb_loop+0x30/0x80 [ 822.946236][T10649] ? clear_bhb_loop+0x30/0x80 [ 822.951012][T10649] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 822.956904][T10649] RIP: 0033:0x7f91a87a60d9 [ 822.961587][T10649] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 822.981590][T10649] RSP: 002b:00007f91a69fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 822.990012][T10649] RAX: ffffffffffffffda RBX: 00007f91a8a2dfa0 RCX: 00007f91a87a60d9 [ 822.998093][T10649] RDX: 0000200000001900 RSI: 000000000000541c RDI: 0000000000000005 [ 823.006593][T10649] RBP: 00007f91a69fe090 R08: 0000000000000000 R09: 0000000000000000 [ 823.015009][T10649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 823.023167][T10649] R13: 00007f91a8a2e038 R14: 00007f91a8a2dfa0 R15: 00007ffc109a3258 [ 823.031986][T10649] [ 823.044943][T10651] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 823.049218][T10649] ERROR: Out of memory at tomoyo_realpath_from_path. [ 823.090252][T10649] input: syz0 as /devices/virtual/input/input6 [ 823.090799][T10651] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 823.113288][ T4226] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 823.135994][ T4226] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 823.158760][T10649] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 823.171496][ T4226] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 823.184050][T10649] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 823.186972][ T4226] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 823.229258][T10649] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 823.251108][T10649] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 823.291660][ T26] audit: type=1800 audit(1786725106.024:3): pid=10659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1706" name="file1" dev="loop3" ino=104 res=0 errno=0 [ 823.335873][ T4226] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 823.358594][ T4226] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 823.381405][ T4226] usb 3-1: Product: syz [ 823.404655][ T4226] usb 3-1: Manufacturer: syz [ 823.463995][ T4226] cdc_wdm 3-1:1.0: skipping garbage [ 823.482651][ T4226] cdc_wdm 3-1:1.0: skipping garbage [ 823.505194][T10661] udc-core: couldn't find an available UDC or it's busy [ 823.525858][ T4226] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 823.531816][T10661] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 823.534547][ T4226] cdc_wdm 3-1:1.0: Unknown control protocol [ 823.736905][T10636] chnl_net:caif_netlink_parms(): no params data found [ 823.967470][T10636] bridge0: port 1(bridge_slave_0) entered blocking state [ 824.070008][T10636] bridge0: port 1(bridge_slave_0) entered disabled state [ 824.121557][T10636] device bridge_slave_0 entered promiscuous mode [ 824.155543][T10636] bridge0: port 2(bridge_slave_1) entered blocking state [ 824.192602][T10636] bridge0: port 2(bridge_slave_1) entered disabled state [ 824.201917][T10636] device bridge_slave_1 entered promiscuous mode [ 824.339746][T10677] binder: BINDER_SET_CONTEXT_MGR already set [ 824.346803][T10677] binder: 10669:10677 ioctl 4018620d 200000004a80 returned -16 [ 824.530774][ T4230] Bluetooth: hci2: command 0x0409 tx timeout [ 824.833915][ T4230] usb 3-1: USB disconnect, device number 4 [ 824.952402][T10683] loop1: detected capacity change from 0 to 512 [ 825.163191][T10636] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 825.199604][T10683] loop1: detected capacity change from 0 to 4096 [ 825.229365][T10636] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 825.375645][T10636] team0: Port device team_slave_0 added [ 825.458267][T10636] team0: Port device team_slave_1 added [ 825.686690][T10636] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 825.710203][T10636] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 825.790950][T10636] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 825.915968][T10636] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 825.969091][T10636] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 826.101697][T10636] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 826.328800][T10636] device hsr_slave_0 entered promiscuous mode [ 826.359582][T10721] FAULT_INJECTION: forcing a failure. [ 826.359582][T10721] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 826.379335][T10636] device hsr_slave_1 entered promiscuous mode [ 826.429641][T10636] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 826.448013][T10721] CPU: 0 PID: 10721 Comm: syz.1.1725 Not tainted syzkaller #0 [ 826.455606][T10721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 826.465853][T10721] Call Trace: [ 826.469233][T10721] [ 826.472303][T10721] dump_stack_lvl+0x188/0x250 [ 826.477118][T10721] ? show_regs_print_info+0x20/0x20 [ 826.482797][T10721] ? load_image+0x410/0x410 [ 826.487416][T10721] ? __lock_acquire+0x7b50/0x7b50 [ 826.492534][T10721] should_fail+0x383/0x4b0 [ 826.497073][T10721] _copy_from_user+0x2e/0x170 [ 826.501949][T10721] __copy_msghdr_from_user+0xc9/0x630 [ 826.507475][T10721] ? verify_lock_unused+0x140/0x140 [ 826.512786][T10721] ? mark_lock+0x94/0x320 [ 826.517144][T10721] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 826.522588][T10721] ? __lock_acquire+0x13dc/0x7b50 [ 826.527942][T10721] ___sys_sendmsg+0x19a/0x2e0 [ 826.532741][T10721] ? __sys_sendmsg+0x290/0x290 [ 826.537653][T10721] __se_sys_sendmsg+0x1b7/0x2a0 [ 826.538793][T10636] Cannot create hsr debugfs directory [ 826.542632][T10721] ? __x64_sys_sendmsg+0x80/0x80 [ 826.542660][T10721] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 826.542690][T10721] ? lockdep_hardirqs_on+0x94/0x140 [ 826.542719][T10721] do_syscall_64+0x4c/0xa0 [ 826.542735][T10721] ? clear_bhb_loop+0x30/0x80 [ 826.575273][T10721] ? clear_bhb_loop+0x30/0x80 [ 826.579114][T10730] loop2: detected capacity change from 0 to 256 [ 826.580061][T10721] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 826.592290][T10721] RIP: 0033:0x7f91a87a60d9 [ 826.596828][T10721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 826.598493][T10730] exfat: Deprecated parameter 'namecase' [ 826.616740][T10721] RSP: 002b:00007f91a69fe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 826.616770][T10721] RAX: ffffffffffffffda RBX: 00007f91a8a2dfa0 RCX: 00007f91a87a60d9 [ 826.616782][T10721] RDX: 0000000000000020 RSI: 0000200000000140 RDI: 0000000000000005 [ 826.616792][T10721] RBP: 00007f91a69fe090 R08: 0000000000000000 R09: 0000000000000000 [ 826.616803][T10721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 826.616812][T10721] R13: 00007f91a8a2e038 R14: 00007f91a8a2dfa0 R15: 00007ffc109a3258 [ 826.616837][T10721] [ 826.680088][ T4230] Bluetooth: hci2: command 0x041b tx timeout [ 826.690117][T10730] exfat: Deprecated parameter 'namecase' [ 826.717188][T10722] device bridge1 entered promiscuous mode [ 826.750475][T10730] exFAT-fs (loop2): failed to load upcase table (idx : 0x00000c00, chksum : 0x54b6a122, utbl_chksum : 0xe619d30d) [ 826.765669][T10722] team0: Port device bridge1 added [ 826.884043][T10722] bridge0: port 3(team0) entered blocking state [ 826.901116][T10722] bridge0: port 3(team0) entered disabled state [ 826.911949][T10722] device team0 entered promiscuous mode [ 826.918464][T10722] device team_slave_0 entered promiscuous mode [ 826.928229][T10722] device team_slave_1 entered promiscuous mode [ 826.956361][T10722] bridge0: port 3(team0) entered blocking state [ 826.963323][T10722] bridge0: port 3(team0) entered forwarding state [ 827.330786][T10745] loop1: detected capacity change from 0 to 40427 [ 827.349208][T10748] loop0: detected capacity change from 0 to 2048 [ 828.219938][T10748] 9pnet: Insufficient options for proto=fd [ 828.448888][T10748] loop0: detected capacity change from 0 to 4096 [ 828.543872][T10636] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 828.592002][T10748] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 828.621110][ T4262] device hsr_slave_0 left promiscuous mode [ 828.667474][ T4262] device hsr_slave_1 left promiscuous mode [ 828.683922][ T4262] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 828.726614][ T4262] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 828.746825][ T4495] Bluetooth: hci2: command 0x040f tx timeout [ 828.793625][ T4262] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 828.833943][T10765] loop2: detected capacity change from 0 to 512 [ 828.850224][ T4262] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 828.926026][T10769] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1730'. [ 828.965882][T10765] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 828.994439][ T4262] device bridge_slave_1 left promiscuous mode [ 829.043132][ T4262] bridge0: port 2(bridge_slave_1) entered disabled state [ 829.105464][T10765] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 1, start 00000702) [ 829.147255][ T4262] device bridge_slave_0 left promiscuous mode [ 829.187855][ T4262] bridge0: port 1(bridge_slave_0) entered disabled state [ 829.283872][ T4262] device veth1_macvtap left promiscuous mode [ 829.319567][ T4262] device veth0_macvtap left promiscuous mode [ 829.327583][ T4262] device veth1_vlan left promiscuous mode [ 829.336185][ T4262] device veth0_vlan left promiscuous mode [ 829.439982][T10777] input: syz0 as /devices/virtual/input/input8 [ 829.709191][ T4262] team0 (unregistering): Port device team_slave_1 removed [ 829.740448][ T4262] team0 (unregistering): Port device team_slave_0 removed [ 829.761792][ T4262] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 829.783850][ T4262] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 829.881168][ T4262] bond0 (unregistering): Released all slaves [ 829.969106][T10636] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 829.982351][T10636] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 829.992942][T10636] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 830.012422][ T4187] ntfs3: loop0: ntfs_evict_inode r=5 failed, -22. [ 830.307874][T10796] FAULT_INJECTION: forcing a failure. [ 830.307874][T10796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 830.357085][T10636] 8021q: adding VLAN 0 to HW filter on device bond0 [ 830.370845][T10796] CPU: 1 PID: 10796 Comm: syz.1.1738 Not tainted syzkaller #0 [ 830.378589][T10796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 830.389299][T10796] Call Trace: [ 830.392695][T10796] [ 830.396310][T10796] dump_stack_lvl+0x188/0x250 [ 830.401819][T10796] ? show_regs_print_info+0x20/0x20 [ 830.408538][T10796] ? load_image+0x410/0x410 [ 830.413072][T10796] ? __lock_acquire+0x7b50/0x7b50 [ 830.418855][T10796] should_fail+0x383/0x4b0 [ 830.425490][T10796] _copy_from_user+0x2e/0x170 [ 830.430902][T10796] rfkill_fop_write+0x13c/0x560 [ 830.435981][T10796] ? rfkill_fop_read+0x560/0x560 [ 830.440939][T10796] ? common_file_perm+0x100/0x1c0 [ 830.446510][T10796] ? fsnotify_perm+0x5d/0x560 [ 830.451654][T10796] ? security_file_permission+0x75/0xa0 [ 830.457502][T10796] ? rfkill_fop_read+0x560/0x560 [ 830.462653][T10796] vfs_write+0x304/0xd70 [ 830.467203][T10796] ? file_end_write+0x250/0x250 [ 830.472210][T10796] ? __fget_files+0x402/0x470 [ 830.477227][T10796] ? __fdget_pos+0x1e2/0x370 [ 830.481939][T10796] ? ksys_write+0x70/0x260 [ 830.486384][T10796] ksys_write+0x153/0x260 [ 830.490744][T10796] ? __ia32_sys_read+0x80/0x80 [ 830.495569][T10796] ? lockdep_hardirqs_on+0x94/0x140 [ 830.501497][T10796] do_syscall_64+0x4c/0xa0 [ 830.509670][T10796] ? clear_bhb_loop+0x30/0x80 [ 830.515705][T10796] ? clear_bhb_loop+0x30/0x80 [ 830.520937][T10796] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 830.527303][T10796] RIP: 0033:0x7f91a87a60d9 [ 830.532182][T10796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 830.552757][T10796] RSP: 002b:00007f91a69fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 830.561319][T10796] RAX: ffffffffffffffda RBX: 00007f91a8a2dfa0 RCX: 00007f91a87a60d9 [ 830.569561][T10796] RDX: 0000000000000008 RSI: 0000200000000340 RDI: 0000000000000003 [ 830.577646][T10796] RBP: 00007f91a69fe090 R08: 0000000000000000 R09: 0000000000000000 [ 830.586010][T10796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 830.594367][T10796] R13: 00007f91a8a2e038 R14: 00007f91a8a2dfa0 R15: 00007ffc109a3258 [ 830.602544][T10796] [ 830.633939][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 830.647167][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 830.752106][T10806] udc-core: couldn't find an available UDC or it's busy [ 830.759328][T10806] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 831.042916][T10636] 8021q: adding VLAN 0 to HW filter on device team0 [ 831.129240][ T4495] Bluetooth: hci2: command 0x0419 tx timeout [ 831.341921][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 831.477931][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 831.677605][ T4373] bridge0: port 1(bridge_slave_0) entered blocking state [ 831.685248][ T4373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 831.998127][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 832.147495][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 832.305448][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 832.430890][ T4373] bridge0: port 2(bridge_slave_1) entered blocking state [ 832.438288][ T4373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 833.002963][ T4404] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 833.188769][ T4404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 833.382136][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 833.532696][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 833.594299][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 833.636625][T10816] loop1: detected capacity change from 0 to 4096 [ 833.718394][T10816] ntfs3: loop1: Different NTFS' sector size (2048) and media sector size (512) [ 833.747099][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 833.786285][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 834.649405][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 834.658487][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 834.670005][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 834.681711][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 835.056392][T10826] loop2: detected capacity change from 0 to 4096 [ 835.188717][T10104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 835.247710][T10104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 835.373539][T10636] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 835.414843][T10826] ntfs: (device loop2): check_mft_mirror(): $MFT and $MFTMirr (record 46) do not match. Run ntfsfix or chkdsk. [ 835.490082][T10856] overlayfs: failed to resolve './file0': -2 [ 835.497880][T10826] ntfs: (device loop2): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 835.903257][T10826] ntfs: volume version 3.1. [ 836.020223][T10826] capability: warning: `syz.2.1743' uses deprecated v2 capabilities in a way that may be insecure [ 836.109495][T10829] binder_alloc: 10824: pid 10824 spamming oneway? 2 buffers allocated for a total size of 5120 [ 837.314105][T10826] binder: BINDER_SET_CONTEXT_MGR already set [ 837.322029][T10826] binder: 10824:10826 ioctl 4018620d 200000000100 returned -16 [ 837.664520][T10888] kAFS: bad VL server IP address [ 837.739297][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 837.759305][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 837.854318][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 837.876213][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 837.926655][T10884] loop2: detected capacity change from 0 to 2048 [ 837.928660][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 837.948088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 837.989143][T10636] device veth0_vlan entered promiscuous mode [ 837.998943][T10884] UDF-fs: error (device loop2): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 838.036918][T10636] device veth1_vlan entered promiscuous mode [ 838.107486][T10884] UDF-fs: error (device loop2): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 838.139470][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 838.150379][T10884] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 838.162932][ T4230] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 838.177532][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 838.183171][T10884] UDF-fs: Scanning with blocksize 512 failed [ 838.219003][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 838.226785][T10884] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 838.243686][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 838.298880][T10636] device veth0_macvtap entered promiscuous mode [ 838.342122][T10636] device veth1_macvtap entered promiscuous mode [ 838.422809][ T4230] usb 2-1: Using ep0 maxpacket: 8 [ 838.429087][T10636] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 838.481650][T10636] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 838.486579][T10906] loop3: detected capacity change from 0 to 512 [ 838.509729][T10636] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 838.538424][T10906] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 838.546668][T10636] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 838.582048][T10636] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 838.602986][T10906] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 838.609815][T10636] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 838.632952][ T4230] usb 2-1: unable to get BOS descriptor or descriptor too short [ 838.653682][T10636] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 838.841197][T10906] EXT4-fs error (device loop3): ext4_orphan_get:1432: comm syz.3.1759: bad orphan inode 131083 [ 838.946838][T10906] EXT4-fs (loop3): mounted filesystem without journal. Opts: stripe=0x000000000000003d,init_itable,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 839.573396][T10922] overlayfs: failed to resolve './file0': -2 [ 839.724498][T10921] loop0: detected capacity change from 0 to 40427 [ 839.772982][ T4230] usb 2-1: string descriptor 0 read error: -22 [ 839.779530][ T4230] usb 2-1: New USB device found, idVendor=0499, idProduct=1509, bcdDevice= 0.40 [ 839.864235][T10921] F2FS-fs (loop0): invalid crc value [ 839.881903][T10921] F2FS-fs (loop0): Found nat_bits in checkpoint [ 839.919393][ T4230] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.056666][T10921] F2FS-fs (loop0): Start checkpoint disabled! [ 840.078338][ T4281] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 840.117324][ T4281] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 840.125148][T10921] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 840.157134][ T4230] usb 2-1: 1:1: invalid format type 0x1002 is detected, processed as PCM [ 840.177532][T10921] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1761'. [ 840.200042][ T4281] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 840.209423][ T4230] usb 2-1: 1:1 : sample bitwidth 252 in over sample bytes 4 [ 840.290029][ T4281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 840.350729][T10636] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 840.408394][T10636] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 840.416905][T10894] udc-core: couldn't find an available UDC or it's busy [ 840.429406][T10894] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 840.439587][T10636] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 840.445988][T10894] loop1: detected capacity change from 0 to 256 [ 840.467960][T10636] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 840.497822][T10636] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 840.543126][T10636] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 840.573273][T10636] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 840.589689][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 840.607721][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 840.656332][T10636] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 840.671438][T10636] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 840.682113][T10636] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 840.697020][T10636] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 840.863991][ T4230] usb 2-1: failed to enable PITCH for EP 0x1 [ 840.882758][ T4230] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 840.901448][T10939] loop3: detected capacity change from 0 to 512 [ 840.960544][ T8120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 840.995226][ T8120] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 841.015682][T10939] EXT4-fs (loop3): Ignoring removed bh option [ 841.071417][ T4230] usb 2-1: USB disconnect, device number 3 [ 841.086612][T10939] EXT4-fs error (device loop3): ext4_orphan_get:1406: comm syz.3.1763: inode #13: comm syz.3.1763: iget: illegal inode # [ 841.101571][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 841.149406][ T8120] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 841.171621][T10939] EXT4-fs (loop3): Remounting filesystem read-only [ 841.243425][T10939] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.1763: couldn't read orphan inode 13 (err -117) [ 841.294678][ T8120] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 841.339332][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 841.378180][T10939] EXT4-fs (loop3): Remounting filesystem read-only [ 841.440762][T10939] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=remount-ro,dioread_lock,auto_da_alloc,stripe=0x00000000000000f0,journal_ioprio=0x0000000000000001,bh,noblock_validity,. Quota mode: none. [ 841.715429][T10960] loop2: detected capacity change from 0 to 64 [ 841.724067][T10961] EXT4-fs error (device loop3): ext4_resize_begin:61: comm syz.3.1763: resize_inode disabled but reserved GDT blocks non-zero [ 841.767733][T10961] EXT4-fs (loop3): Remounting filesystem read-only [ 843.274789][T10962] EXT4-fs error (device loop3): ext4_lookup:1862: inode #2: comm syz.3.1763: deleted inode referenced: 15 [ 843.289738][T10961] can: request_module (can-proto-5) failed. [ 843.325042][T10982] netlink: 'syz.0.1771': attribute type 4 has an invalid length. [ 843.353803][T10962] EXT4-fs (loop3): Remounting filesystem read-only [ 843.405205][T10961] EXT4-fs error (device loop3): ext4_lookup:1862: inode #2: comm syz.3.1763: deleted inode referenced: 15 [ 843.426312][T10986] binder: BINDER_SET_CONTEXT_MGR already set [ 843.433297][T10986] binder: 10977:10986 ioctl 4018620d 200000004a80 returned -16 [ 844.318951][T10961] EXT4-fs (loop3): Remounting filesystem read-only [ 845.739172][T11017] gadgetfs: bound to dummy_udc driver [ 846.011184][T11024] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1779'. [ 846.490862][T11010] loop5: detected capacity change from 0 to 32768 [ 846.652613][T10999] loop0: detected capacity change from 0 to 40427 [ 846.693327][T11033] gadgetfs: bound to dummy_udc driver [ 846.705256][T11033] FAULT_INJECTION: forcing a failure. [ 846.705256][T11033] name failslab, interval 1, probability 0, space 0, times 0 [ 846.720023][T11033] CPU: 1 PID: 11033 Comm: syz.1.1780 Not tainted syzkaller #0 [ 846.729423][T11033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 846.740616][T11033] Call Trace: [ 846.744005][T11033] [ 846.747257][T11033] dump_stack_lvl+0x188/0x250 [ 846.752160][T11033] ? show_regs_print_info+0x20/0x20 [ 846.757556][T11033] ? load_image+0x410/0x410 [ 846.762170][T10999] F2FS-fs (loop0): invalid crc value [ 846.762587][T11033] ? __might_sleep+0xf0/0xf0 [ 846.762656][T11033] ? __lock_acquire+0x7b50/0x7b50 [ 846.762681][T11033] should_fail+0x383/0x4b0 [ 846.762703][T11033] should_failslab+0x5/0x20 [ 846.762720][T11033] slab_pre_alloc_hook+0x51/0xc0 [ 846.762741][T11033] kmem_cache_alloc_trace+0x47/0x290 [ 846.801312][T11033] ? kobject_uevent_env+0x275/0x890 [ 846.807040][T11033] kobject_uevent_env+0x275/0x890 [ 846.812363][T11033] usb_gadget_unregister_driver+0x15d/0x4c0 [ 846.818875][T11033] dev_release+0x82/0x1f0 [ 846.824583][T11033] ? dev_open+0x1b0/0x1b0 [ 846.828946][T11033] __fput+0x212/0x8c0 [ 846.834250][T11033] task_work_run+0x125/0x1a0 [ 846.839529][T11033] exit_to_user_mode_loop+0x10f/0x130 [ 846.845645][T11033] exit_to_user_mode_prepare+0xee/0x180 [ 846.852808][T11033] syscall_exit_to_user_mode+0x16/0x40 [ 846.858555][T11033] do_syscall_64+0x58/0xa0 [ 846.863968][T11033] ? clear_bhb_loop+0x30/0x80 [ 846.870206][T11033] ? clear_bhb_loop+0x30/0x80 [ 846.876059][T11033] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 846.882830][T11033] RIP: 0033:0x7f91a87a60d9 [ 846.887649][T11033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.910765][T11033] RSP: 002b:00007f91a69dd028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 846.920498][T11033] RAX: 0000000000000000 RBX: 00007f91a8a2e090 RCX: 00007f91a87a60d9 [ 846.929455][T11033] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000005 [ 846.938662][T11033] RBP: 00007f91a69dd090 R08: 0000000000000000 R09: 0000000000000000 [ 846.947454][T11033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.956004][T11033] R13: 00007f91a8a2e128 R14: 00007f91a8a2e090 R15: 00007ffc109a3258 [ 846.964101][T11033] [ 847.026022][T10999] F2FS-fs (loop0): Found nat_bits in checkpoint [ 847.092256][T11010] JBD2: Ignoring recovery information on journal [ 848.045962][T11010] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 848.141205][T11024] loop2: detected capacity change from 0 to 32768 [ 848.253349][T11024] XFS (loop2): sunit and swidth options incompatible with the noalign option [ 848.460166][T10636] ocfs2: Unmounting device (7,5) on (node local) [ 849.877302][ T2289] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 850.307213][ T2289] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 850.317248][ T2289] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 850.333062][ T2289] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 850.351203][ T2289] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 850.492947][ T2289] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 850.531211][ T2289] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 850.564326][ T2289] usb 2-1: Product: syz [ 850.569548][ T2289] usb 2-1: Manufacturer: syz [ 850.667362][ T2289] cdc_wdm 2-1:1.0: skipping garbage [ 850.679796][ T2289] cdc_wdm 2-1:1.0: skipping garbage [ 850.711003][T11095] device syzkaller0 entered promiscuous mode [ 850.722867][ T2289] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 850.729187][ T2289] cdc_wdm 2-1:1.0: Unknown control protocol [ 850.952575][T11103] loop0: detected capacity change from 0 to 16 [ 851.071917][T11103] erofs: (device loop0): mounted with root inode @ nid 36. [ 852.058332][ T5416] usb 2-1: USB disconnect, device number 4 [ 854.215229][T11149] device syzkaller0 entered promiscuous mode [ 854.457581][T11159] udc-core: couldn't find an available UDC or it's busy [ 854.464935][T11159] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 854.622226][T11158] fuse: Bad value for 'fd' [ 854.661426][T11158] loop0: detected capacity change from 0 to 512 [ 854.759510][T11123] loop5: detected capacity change from 0 to 32768 [ 854.780406][T11158] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.1807: inode has both inline data and extents flags [ 854.800051][T11158] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.1807: couldn't read orphan inode 15 (err -117) [ 854.818911][T11158] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 854.867739][T11123] BTRFS: device fsid 3a492a15-ac49-4ce6-945e-cef7a687c6c9 devid 1 transid 8 /dev/loop5 scanned by syz.5.1799 (11123) [ 854.981305][T11123] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 855.027104][T11123] BTRFS error (device loop5): unrecognized mount option 'hash' [ 855.053775][T11123] BTRFS error (device loop5): open_ctree failed: -22 [ 857.032133][T11194] binder: BINDER_SET_CONTEXT_MGR already set [ 857.039233][T11194] binder: 11189:11194 ioctl 4018620d 200000004a80 returned -16 [ 857.838950][T11201] device syzkaller0 entered promiscuous mode [ 857.986276][T11176] loop1: detected capacity change from 0 to 32768 [ 859.247255][T11235] loop0: detected capacity change from 0 to 128 [ 859.350119][T11235] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 859.414708][T11235] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 860.068278][T11239] loop5: detected capacity change from 0 to 32768 [ 860.712085][T11239] loop5: detected capacity change from 0 to 32768 [ 860.763383][T11239] jfs: Unrecognized mount option "./file1" or missing value [ 862.970752][T11338] device bridge1 entered promiscuous mode [ 863.020998][T11338] team0: Port device bridge1 added [ 863.313928][T11353] binder: BINDER_SET_CONTEXT_MGR already set [ 863.320031][T11353] binder: 11337:11353 ioctl 4018620d 200000004a80 returned -16 [ 863.951156][T11357] loop0: detected capacity change from 0 to 128 [ 864.076410][T11357] VFS: Found a Xenix FS (block size = 1024) on device loop0 [ 864.439476][T11366] binder: BINDER_SET_CONTEXT_MGR already set [ 864.445842][T11366] binder: 11362:11366 ioctl 4018620d 200000004a80 returned -16 [ 864.951356][ T4187] sysv_free_block: flc_count > flc_size [ 864.990272][ T4187] sysv_free_block: flc_count > flc_size [ 865.011868][ T4187] sysv_free_block: flc_count > flc_size [ 865.018273][ T4187] sysv_free_block: flc_count > flc_size [ 865.025528][ T4187] sysv_free_block: flc_count > flc_size [ 865.031200][ T4187] sysv_free_block: flc_count > flc_size [ 865.036998][ T4187] sysv_free_block: flc_count > flc_size [ 865.042926][ T4187] sysv_free_block: flc_count > flc_size [ 865.048917][ T4187] sysv_free_block: flc_count > flc_size [ 865.054695][ T4187] sysv_free_block: flc_count > flc_size [ 865.082647][ T4187] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 867.035326][T11391] netlink: 'syz.0.1843': attribute type 2 has an invalid length. [ 867.149761][T11391] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1843'. [ 868.517600][T11412] binder: BINDER_SET_CONTEXT_MGR already set [ 868.523954][T11412] binder: 11404:11412 ioctl 4018620d 200000004a80 returned -16 [ 870.186063][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.195270][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.550171][T11431] program syz.3.1854 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 871.667707][T11451] loop3: detected capacity change from 0 to 2048 [ 872.032395][T11460] binder: BINDER_SET_CONTEXT_MGR already set [ 872.039699][T11460] binder: 11454:11460 ioctl 4018620d 200000004a80 returned -16 [ 873.685485][T11472] device bridge1 entered promiscuous mode [ 873.748131][T11472] team0: Port device bridge1 added [ 873.886672][T11463] loop2: detected capacity change from 0 to 32768 [ 873.914273][T11463] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 scanned by syz.2.1861 (11463) [ 873.999691][T11463] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 874.039970][T11463] BTRFS info (device loop2): metadata ratio 4 [ 874.066109][T11463] BTRFS warning (device loop2): the 'inode_cache' option is deprecated and has no effect since 5.11 [ 874.102416][T11463] BTRFS warning (device loop2): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 874.131839][T11463] BTRFS info (device loop2): trying to use backup root at mount time [ 874.156971][T11463] BTRFS info (device loop2): allowing degraded mounts [ 874.177829][T11463] BTRFS info (device loop2): turning on async discard [ 874.193279][T11463] BTRFS info (device loop2): turning off barriers [ 874.208026][T11463] BTRFS info (device loop2): disabling free space tree [ 874.224783][T11463] BTRFS info (device loop2): enabling ssd optimizations [ 874.245244][T11463] BTRFS info (device loop2): using spread ssd allocation scheme [ 874.270595][T11463] BTRFS info (device loop2): not using ssd optimizations [ 874.291812][T11463] BTRFS info (device loop2): not using spread ssd allocation scheme [ 874.318382][T11463] BTRFS error (device loop2): cannot disable free space tree [ 874.342041][T11463] BTRFS error (device loop2): open_ctree failed: -22 [ 875.619667][T11517] FAULT_INJECTION: forcing a failure. [ 875.619667][T11517] name failslab, interval 1, probability 0, space 0, times 0 [ 875.762199][T11517] CPU: 1 PID: 11517 Comm: syz.2.1873 Not tainted syzkaller #0 [ 875.769798][T11517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 875.780237][T11517] Call Trace: [ 875.783551][T11517] [ 875.786505][T11517] dump_stack_lvl+0x188/0x250 [ 875.791400][T11517] ? show_regs_print_info+0x20/0x20 [ 875.796792][T11517] ? load_image+0x410/0x410 [ 875.801572][T11517] ? __might_sleep+0xf0/0xf0 [ 875.806351][T11517] ? __lock_acquire+0x7b50/0x7b50 [ 875.811582][T11517] should_fail+0x383/0x4b0 [ 875.816889][T11517] should_failslab+0x5/0x20 [ 875.821593][T11517] slab_pre_alloc_hook+0x51/0xc0 [ 875.826838][T11517] __kmalloc_node+0x6d/0x3a0 [ 875.831729][T11517] ? kvmalloc_node+0x84/0x130 [ 875.837145][T11517] kvmalloc_node+0x84/0x130 [ 875.842466][T11517] generic_map_update_batch+0x3a7/0x7d0 [ 875.848751][T11517] ? rcu_read_unlock+0x90/0x90 [ 875.853903][T11517] ? __fdget+0x18b/0x210 [ 875.858181][T11517] ? rcu_read_unlock+0x90/0x90 [ 875.863123][T11517] bpf_map_do_batch+0x475/0x5f0 [ 875.868015][T11517] ? bpf_lsm_key_permission+0x10/0x10 [ 875.873955][T11517] __sys_bpf+0x671/0x6f0 [ 875.878665][T11517] ? bpf_link_show_fdinfo+0x380/0x380 [ 875.884275][T11517] __x64_sys_bpf+0x78/0x90 [ 875.889016][T11517] do_syscall_64+0x4c/0xa0 [ 875.894365][T11517] ? clear_bhb_loop+0x30/0x80 [ 875.899191][T11517] ? clear_bhb_loop+0x30/0x80 [ 875.904052][T11517] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 875.910538][T11517] RIP: 0033:0x7fc82a6df0d9 [ 875.915248][T11517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 875.936996][T11517] RSP: 002b:00007fc828916028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 875.945653][T11517] RAX: ffffffffffffffda RBX: 00007fc82a967090 RCX: 00007fc82a6df0d9 [ 875.953820][T11517] RDX: 0000000000000038 RSI: 0000200000000800 RDI: 000000000000001a [ 875.961822][T11517] RBP: 00007fc828916090 R08: 0000000000000000 R09: 0000000000000000 [ 875.970210][T11517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 875.978685][T11517] R13: 00007fc82a967128 R14: 00007fc82a967090 R15: 00007ffc78157328 [ 875.987769][T11517] [ 876.209705][T11507] loop3: detected capacity change from 0 to 32768 [ 877.269795][T11507] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by syz.3.1871 (11507) [ 877.372777][T11507] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 877.432627][T11507] BTRFS info (device loop3): metadata ratio 4 [ 877.456573][T11507] BTRFS warning (device loop3): the 'inode_cache' option is deprecated and has no effect since 5.11 [ 877.492063][T11507] BTRFS warning (device loop3): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 877.517358][T11507] BTRFS info (device loop3): trying to use backup root at mount time [ 877.540787][T11507] BTRFS info (device loop3): allowing degraded mounts [ 877.547973][T11507] BTRFS info (device loop3): turning on async discard [ 877.555182][T11507] BTRFS info (device loop3): turning off barriers [ 877.561748][T11507] BTRFS info (device loop3): disabling free space tree [ 877.568982][T11507] BTRFS info (device loop3): enabling ssd optimizations [ 877.575989][T11507] BTRFS info (device loop3): using spread ssd allocation scheme [ 877.584108][T11507] BTRFS info (device loop3): not using ssd optimizations [ 877.592224][T11507] BTRFS info (device loop3): not using spread ssd allocation scheme [ 877.598216][T11527] 8021q: adding VLAN 0 to HW filter on device bond1 [ 877.601247][T11507] BTRFS error (device loop3): cannot disable free space tree [ 877.619159][T11507] BTRFS error (device loop3): open_ctree failed: -22 [ 877.629559][T11527] team0: Port device bond1 added [ 877.648963][T11525] loop5: detected capacity change from 0 to 4096 [ 877.680344][T11525] ntfs: (device loop5): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 877.706358][T11525] ntfs: (device loop5): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 877.720985][ T5415] team0: Failed to send port change of device bond1 via netlink (err -105) [ 877.756888][T11525] ntfs: (device loop5): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 877.802659][T11525] ntfs: (device loop5): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 877.856547][T11525] ntfs: (device loop5): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 877.906911][T11525] ntfs: volume version 3.1. [ 877.916362][T11525] ntfs: (device loop5): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 877.965665][T11525] ntfs: (device loop5): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 878.019469][T11525] ntfs: (device loop5): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 878.088347][T11525] ntfs: (device loop5): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 878.120631][T11525] ntfs: (device loop5): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 878.318069][T11545] binder: BINDER_SET_CONTEXT_MGR already set [ 878.325066][T11545] binder: 11538:11545 ioctl 4018620d 200000004a80 returned -16 [ 878.995597][T11525] 9pnet: Insufficient options for proto=fd [ 879.507483][T11567] input: syz0 as /devices/virtual/input/input9 [ 879.608981][T11570] loop0: detected capacity change from 0 to 256 [ 879.621347][T11567] FAULT_INJECTION: forcing a failure. [ 879.621347][T11567] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 879.642933][T11567] CPU: 0 PID: 11567 Comm: syz.2.1886 Not tainted syzkaller #0 [ 879.651567][T11567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 879.662868][T11567] Call Trace: [ 879.666382][T11567] [ 879.669742][T11567] dump_stack_lvl+0x188/0x250 [ 879.674465][T11567] ? show_regs_print_info+0x20/0x20 [ 879.680041][T11567] ? load_image+0x410/0x410 [ 879.685297][T11567] ? __lock_acquire+0x7b50/0x7b50 [ 879.690545][T11567] should_fail+0x383/0x4b0 [ 879.692092][T11573] device bridge2 entered promiscuous mode [ 879.695161][T11567] _copy_from_user+0x2e/0x170 [ 879.695193][T11567] iovec_from_user+0x142/0x370 [ 879.695214][T11567] __import_iovec+0x70/0x490 [ 879.695229][T11567] ? __lock_acquire+0x13dc/0x7b50 [ 879.695254][T11567] import_iovec+0x6f/0xa0 [ 879.695276][T11567] ___sys_sendmsg+0x1fd/0x2e0 [ 879.695301][T11567] ? __sys_sendmsg+0x290/0x290 [ 879.709142][T11573] team0: Port device bridge2 added [ 879.711033][T11567] __se_sys_sendmsg+0x1b7/0x2a0 [ 879.745404][T11567] ? __x64_sys_sendmsg+0x80/0x80 [ 879.750468][T11567] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 879.756467][T11567] ? lockdep_hardirqs_on+0x94/0x140 [ 879.762190][T11567] do_syscall_64+0x4c/0xa0 [ 879.766787][T11567] ? clear_bhb_loop+0x30/0x80 [ 879.771623][T11567] ? clear_bhb_loop+0x30/0x80 [ 879.776658][T11567] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 879.783478][T11567] RIP: 0033:0x7fc82a6df0d9 [ 879.787906][T11567] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 879.809578][T11567] RSP: 002b:00007fc828937028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 879.820318][T11567] RAX: ffffffffffffffda RBX: 00007fc82a966fa0 RCX: 00007fc82a6df0d9 [ 879.828302][T11567] RDX: 0000000000000080 RSI: 00002000000001c0 RDI: 0000000000000007 [ 879.836432][T11567] RBP: 00007fc828937090 R08: 0000000000000000 R09: 0000000000000000 [ 879.844614][T11567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 879.853526][T11567] R13: 00007fc82a967038 R14: 00007fc82a966fa0 R15: 00007ffc78157328 [ 879.862143][T11567] [ 879.921203][T11570] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x1fe4a43c, utbl_chksum : 0xe619d30d) [ 879.964926][T11575] input: syz0 as /devices/virtual/input/input10 [ 880.003310][T11578] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 880.028117][T11578] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 880.045545][T11578] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 880.063365][T11578] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 880.154292][T11582] FAULT_INJECTION: forcing a failure. [ 880.154292][T11582] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 880.263944][T11582] CPU: 1 PID: 11582 Comm: syz.5.1888 Not tainted syzkaller #0 [ 880.271591][T11582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 880.283194][T11582] Call Trace: [ 880.286765][T11582] [ 880.290188][T11582] dump_stack_lvl+0x188/0x250 [ 880.295191][T11582] ? show_regs_print_info+0x20/0x20 [ 880.300623][T11582] ? load_image+0x410/0x410 [ 880.305572][T11582] ? __lock_acquire+0x7b50/0x7b50 [ 880.311042][T11582] ? __lock_acquire+0x13dc/0x7b50 [ 880.316750][T11582] should_fail+0x383/0x4b0 [ 880.321917][T11582] strncpy_from_user+0x32/0x350 [ 880.326880][T11582] bpf_prog_load+0x1fd/0x14e0 [ 880.331590][T11582] ? map_freeze+0x360/0x360 [ 880.336203][T11582] ? __might_fault+0xb7/0x110 [ 880.340941][T11582] ? __might_fault+0xb3/0x110 [ 880.345827][T11582] ? bpf_lsm_bpf+0x5/0x10 [ 880.350671][T11582] ? security_bpf+0x7a/0xa0 [ 880.355186][T11582] __sys_bpf+0x532/0x6f0 [ 880.359715][T11582] ? bpf_link_show_fdinfo+0x380/0x380 [ 880.365203][T11582] __x64_sys_bpf+0x78/0x90 [ 880.369809][T11582] do_syscall_64+0x4c/0xa0 [ 880.374312][T11582] ? clear_bhb_loop+0x30/0x80 [ 880.379344][T11582] ? clear_bhb_loop+0x30/0x80 [ 880.384050][T11582] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 880.390192][T11582] RIP: 0033:0x7f353a18e0d9 [ 880.395387][T11582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.416015][T11582] RSP: 002b:00007f3538366028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 880.425883][T11582] RAX: ffffffffffffffda RBX: 00007f353a416180 RCX: 00007f353a18e0d9 [ 880.434186][T11582] RDX: 0000000000000090 RSI: 00002000000000c0 RDI: 0000000000000005 [ 880.442518][T11582] RBP: 00007f3538366090 R08: 0000000000000000 R09: 0000000000000000 [ 880.451341][T11582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 880.460489][T11582] R13: 00007f353a416218 R14: 00007f353a416180 R15: 00007ffca1a8af48 [ 880.469029][T11582] [ 881.480008][T11600] binder: BINDER_SET_CONTEXT_MGR already set [ 881.486750][T11600] binder: 11589:11600 ioctl 4018620d 200000004a80 returned -16 [ 881.507743][ T6472] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 882.272962][ T6472] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 882.281881][ T6472] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 882.488621][T11611] device syzkaller0 entered promiscuous mode [ 882.506122][ T6472] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 882.519148][ T6472] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 882.683606][ T6472] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 882.728271][ T6472] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 882.793694][ T6472] usb 2-1: Product: syz [ 882.834051][ T6472] usb 2-1: Manufacturer: syz [ 883.011807][ T6472] cdc_wdm 2-1:1.0: skipping garbage [ 883.042163][ T6472] cdc_wdm 2-1:1.0: skipping garbage [ 883.154363][ T6472] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 883.160681][ T6472] cdc_wdm 2-1:1.0: Unknown control protocol [ 883.575975][ T6472] usb 2-1: USB disconnect, device number 5 [ 884.284542][T11633] device bridge3 entered promiscuous mode [ 884.327912][T11633] team0: Port device bridge3 added [ 884.387124][T11639] netlink: 'syz.1.1904': attribute type 21 has an invalid length. [ 884.417503][T11639] netlink: 'syz.1.1904': attribute type 1 has an invalid length. [ 884.422280][T11642] syz.2.1906: vmalloc error: size 70368744177852, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 884.445663][T11639] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1904'. [ 884.496054][T11642] CPU: 1 PID: 11642 Comm: syz.2.1906 Not tainted syzkaller #0 [ 884.503767][T11642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 884.513930][T11642] Call Trace: [ 884.517218][T11642] [ 884.520423][T11642] dump_stack_lvl+0x188/0x250 [ 884.525134][T11642] ? rcu_lock_release+0x5/0x20 [ 884.530018][T11642] ? show_regs_print_info+0x20/0x20 [ 884.535255][T11642] ? load_image+0x410/0x410 [ 884.539971][T11642] warn_alloc+0x245/0x320 [ 884.544397][T11642] ? zone_watermark_ok_safe+0x250/0x250 [ 884.550159][T11642] ? __mutex_lock_common+0x435/0x2400 [ 884.556226][T11642] ? tomoyo_path_number_perm+0x5f7/0x6b0 [ 884.562316][T11642] __vmalloc_node_range+0x2b1/0x8b0 [ 884.567915][T11642] ? dvb_dvr_do_ioctl+0x12a/0x220 [ 884.573325][T11642] vmalloc+0x75/0x80 [ 884.577489][T11642] ? dvb_dvr_do_ioctl+0x12a/0x220 [ 884.582769][T11642] dvb_dvr_do_ioctl+0x12a/0x220 [ 884.588173][T11642] dvb_usercopy+0x191/0x2b0 [ 884.592862][T11642] ? dvb_dvr_release+0x3d0/0x3d0 [ 884.597803][T11642] ? dvb_generic_ioctl+0xb0/0xb0 [ 884.603009][T11642] ? dvb_dvr_poll+0x230/0x230 [ 884.607806][T11642] dvb_dvr_ioctl+0x25/0x30 [ 884.612617][T11642] __se_sys_ioctl+0xfa/0x170 [ 884.617409][T11642] do_syscall_64+0x4c/0xa0 [ 884.622029][T11642] ? clear_bhb_loop+0x30/0x80 [ 884.626738][T11642] ? clear_bhb_loop+0x30/0x80 [ 884.631943][T11642] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 884.638166][T11642] RIP: 0033:0x7fc82a6df0d9 [ 884.643280][T11642] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 884.663775][T11642] RSP: 002b:00007fc828937028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 884.672294][T11642] RAX: ffffffffffffffda RBX: 00007fc82a966fa0 RCX: 00007fc82a6df0d9 [ 884.680668][T11642] RDX: 00004000000000bc RSI: 0000000000006f2d RDI: 0000000000000007 [ 884.688850][T11642] RBP: 00007fc82a776024 R08: 0000000000000000 R09: 0000000000000000 [ 884.696923][T11642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 884.705066][T11642] R13: 00007fc82a967038 R14: 00007fc82a966fa0 R15: 00007ffc78157328 [ 884.713507][T11642] [ 884.800963][T11642] Mem-Info: [ 884.806526][T11642] active_anon:318 inactive_anon:9578 isolated_anon:0 [ 884.806526][T11642] active_file:25832 inactive_file:36605 isolated_file:0 [ 884.806526][T11642] unevictable:768 dirty:423 writeback:0 [ 884.806526][T11642] slab_reclaimable:21497 slab_unreclaimable:95672 [ 884.806526][T11642] mapped:33814 shmem:4486 pagetables:801 bounce:0 [ 884.806526][T11642] kernel_misc_reclaimable:0 [ 884.806526][T11642] free:1362430 free_pcp:8795 free_cma:0 [ 884.884060][T11642] Node 0 active_anon:1240kB inactive_anon:37800kB active_file:103124kB inactive_file:146420kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:135256kB dirty:1692kB writeback:0kB shmem:15864kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11096kB pagetables:3204kB all_unreclaimable? no [ 884.931813][T11642] Node 1 active_anon:32kB inactive_anon:512kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2080kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no [ 884.966155][T11642] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 885.001452][T11642] lowmem_reserve[]: 0 2539 2540 2540 2540 [ 885.007735][T11642] Node 0 DMA32 free:1513672kB min:34784kB low:43480kB high:52176kB reserved_highatomic:0KB active_anon:1240kB inactive_anon:37764kB active_file:103124kB inactive_file:146420kB unevictable:1536kB writepending:1716kB present:3129332kB managed:2606516kB mlocked:0kB bounce:0kB free_pcp:31160kB local_pcp:11060kB free_cma:0kB [ 885.086328][T11642] lowmem_reserve[]: 0 0 0 0 0 [ 885.101595][T11642] Node 0 Normal free:8kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:660kB mlocked:0kB bounce:0kB free_pcp:24kB local_pcp:12kB free_cma:0kB [ 885.178345][T11642] lowmem_reserve[]: 0 0 0 0 0 [ 885.199693][T11642] Node 1 Normal free:3920520kB min:55108kB low:68884kB high:82660kB reserved_highatomic:0KB active_anon:32kB inactive_anon:512kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:6012kB local_pcp:1108kB free_cma:0kB [ 885.350606][T11642] lowmem_reserve[]: 0 0 0 0 0 [ 885.390504][T11642] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 885.429431][T11642] Node 0 DMA32: 290*4kB (UME) 259*8kB (UME) 432*16kB (UME) 714*32kB (UME) 335*64kB (UME) 196*128kB (UME) 82*256kB (UM) 50*512kB (UME) 35*1024kB (UME) 11*2048kB (ME) 326*4096kB (UM) = 1519776kB [ 885.453962][T11642] Node 0 Normal: 2*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 885.470686][ T4236] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 885.482400][T11642] Node 1 Normal: 110*4kB (UME) 38*8kB (UME) 28*16kB (UME) 149*32kB (UME) 65*64kB (UME) 24*128kB (UE) 15*256kB (UME) 0*512kB 2*1024kB (UE) 1*2048kB (M) 952*4096kB (M) = 3920520kB [ 885.563843][T11658] overlayfs: missing 'lowerdir' [ 886.169733][T11642] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 886.190218][T11642] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 886.200719][T11642] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 886.211745][T11642] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 886.221656][T11642] 66925 total pagecache pages [ 886.229439][T11642] 0 pages in swap cache [ 886.233995][T11642] Swap cache stats: add 1031, delete 1031, find 0/1 [ 886.241244][T11642] Free swap = 124448kB [ 886.318976][ T4236] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.332568][T11642] Total swap = 124996kB [ 886.337065][T11642] 2097051 pages RAM [ 886.370941][T11642] 0 pages HighMem/MovableOnly [ 886.399375][T11642] 411499 pages reserved [ 886.459494][T11642] 0 pages cma reserved [ 886.673784][T11674] netlink: 'syz.5.1916': attribute type 1 has an invalid length. [ 886.757597][T11674] loop5: detected capacity change from 0 to 2048 [ 886.907455][T11672] loop0: detected capacity change from 0 to 512 [ 887.337699][T11672] EXT4-fs (loop0): Mount option "noacl" will be removed by 3.5 [ 887.337699][T11672] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 887.337699][T11672] [ 887.357372][T11674] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 887.435791][ T4236] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 887.454603][T11672] EXT4-fs error (device loop0): ext4_expand_extra_isize_ea:2759: inode #11: comm syz.0.1917: corrupted xattr block 95 [ 887.580692][T11672] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2809: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 887.596694][T11672] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.1917: bg 0: block 7: invalid block bitmap [ 887.633020][T11672] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 887.649258][T11672] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2925: inode #11: comm syz.0.1917: corrupted xattr block 95 [ 887.756865][T11672] EXT4-fs warning (device loop0): ext4_evict_inode:304: xattr delete (err -117) [ 887.781431][T11672] EXT4-fs (loop0): 1 orphan inode deleted [ 887.787829][T11672] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,jqfmt=vfsv0,noacl,,errors=continue. Quota mode: none. [ 887.875569][ T4236] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.135099][T11669] chnl_net:caif_netlink_parms(): no params data found [ 888.536894][T11669] bridge0: port 1(bridge_slave_0) entered blocking state [ 888.566731][T11700] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 888.621210][T11669] bridge0: port 1(bridge_slave_0) entered disabled state [ 888.661915][T11669] device bridge_slave_0 entered promiscuous mode [ 888.672354][ T2289] Bluetooth: hci3: command 0x0409 tx timeout [ 888.761926][T11669] bridge0: port 2(bridge_slave_1) entered blocking state [ 888.805157][T11669] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.843173][T11669] device bridge_slave_1 entered promiscuous mode [ 888.899110][T11669] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 888.950478][T11669] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 889.091350][T11708] overlayfs: missing 'lowerdir' [ 889.732692][ T4229] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 889.766145][T11669] team0: Port device team_slave_0 added [ 889.835741][T11669] team0: Port device team_slave_1 added [ 889.914894][T11669] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 889.951723][T11669] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 890.034612][T11669] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 890.067697][T11669] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 890.076272][T11669] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 890.105665][ T4229] usb 6-1: not running at top speed; connect to a high speed hub [ 890.114711][T11669] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 890.192878][ T4229] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 890.208585][ T4229] usb 6-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 890.222897][ T4229] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 890.278694][T11669] device hsr_slave_0 entered promiscuous mode [ 890.290010][ T4229] usb 6-1: Found UVC 1.00 device (0000:0000) [ 890.303768][ T4229] usb 6-1: No streaming interface found for terminal 2. [ 890.382745][T11669] device hsr_slave_1 entered promiscuous mode [ 890.560273][ T4229] usb 6-1: USB disconnect, device number 2 [ 890.742649][ T4230] Bluetooth: hci3: command 0x041b tx timeout [ 890.907998][T11669] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 890.945880][T11669] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 891.008559][T11669] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 891.031092][T11669] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 891.230717][T11785] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 891.377762][T11792] jffs2: notice: (11792) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 891.413927][ T4236] device hsr_slave_0 left promiscuous mode [ 891.457592][ T4236] device hsr_slave_1 left promiscuous mode [ 891.481528][ T4236] device bridge_slave_1 left promiscuous mode [ 891.498466][ T4236] bridge0: port 2(bridge_slave_1) entered disabled state [ 891.543340][ T4236] device bridge_slave_0 left promiscuous mode [ 891.588125][ T4236] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.642042][ T4236] device veth1_macvtap left promiscuous mode [ 891.656568][ T4236] device veth0_macvtap left promiscuous mode [ 891.672290][ T4236] device veth1_vlan left promiscuous mode [ 891.679026][ T4236] device veth0_vlan left promiscuous mode [ 891.780758][ T4236] team0 (unregistering): Port device bond1 removed [ 891.796581][ T4236] bond1 (unregistering): Released all slaves [ 891.811705][ T4236] team0 (unregistering): Port device bridge1 removed [ 891.832598][ T4230] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 891.966832][ T4236] team0 (unregistering): Port device team_slave_1 removed [ 891.987875][ T4236] team0 (unregistering): Port device team_slave_0 removed [ 892.008790][ T4236] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 892.029636][ T4236] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 892.099977][ T4236] bond0 (unregistering): Released all slaves [ 892.198158][ T4230] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 892.208238][ T4230] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 892.218686][ T4230] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 892.228098][ T4230] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 892.239645][ T4230] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 892.301950][T11669] 8021q: adding VLAN 0 to HW filter on device bond0 [ 892.350300][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 892.364497][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 892.372904][ T4230] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 892.379209][T11669] 8021q: adding VLAN 0 to HW filter on device team0 [ 892.406888][ T4230] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 892.416742][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 892.424744][ T4230] usb 3-1: Product: syz [ 892.432593][ T4230] usb 3-1: Manufacturer: syz [ 892.473417][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 892.497296][ T4230] cdc_wdm 3-1:1.0: skipping garbage [ 892.522843][ T5415] bridge0: port 1(bridge_slave_0) entered blocking state [ 892.530295][ T5415] bridge0: port 1(bridge_slave_0) entered forwarding state [ 892.533670][ T4230] cdc_wdm 3-1:1.0: skipping garbage [ 892.564126][T11824] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1953'. [ 892.582367][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 892.584932][ T4230] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 892.601320][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 892.622115][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 892.630800][ T4230] cdc_wdm 3-1:1.0: Unknown control protocol [ 892.641208][ T5415] bridge0: port 2(bridge_slave_1) entered blocking state [ 892.648762][ T5415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 892.709689][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 892.770029][T11835] jffs2: notice: (11835) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 892.778578][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 892.824983][ T4230] Bluetooth: hci3: command 0x040f tx timeout [ 892.877588][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 892.906392][ T2289] usb 3-1: USB disconnect, device number 5 [ 892.923192][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 892.961648][ T5415] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 892.985131][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 893.007899][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 893.026768][ T4229] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 893.046301][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 893.067226][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 893.092684][T10104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 893.101284][T10104] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 893.137508][T11669] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 893.272681][ T4229] usb 4-1: Using ep0 maxpacket: 8 [ 893.392782][ T4229] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 893.412433][ T4229] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 893.462569][ T4229] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 893.508734][ T4229] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 893.549683][ T4229] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 893.618193][ T4229] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 893.651231][ T4229] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.653489][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 893.697604][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 893.729442][T11669] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 893.864385][ T6684] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 893.943253][ T4229] usb 4-1: usb_control_msg returned -32 [ 893.959947][ T4229] usbtmc 4-1:16.0: can't read capabilities [ 894.049763][T11890] jffs2: notice: (11890) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 894.146269][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 894.146353][ T26] audit: type=1400 audit(1786725176.884:4): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=11891 comm="syz.0.1969" [ 894.274061][ T6684] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 894.308414][ T6684] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 894.332813][T11905] usbtmc 4-1:16.0: INITIATE_ABORT_BULK_OUT returned 0 [ 894.352941][ T6684] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 894.356437][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 894.429357][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 894.474574][ T6684] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 894.497363][ T6684] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 894.524574][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 894.549672][ T6684] usb 3-1: Manufacturer: syz [ 894.557398][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 894.578114][ T7] usb 4-1: USB disconnect, device number 3 [ 894.585731][ T6684] usb 3-1: config 0 descriptor?? [ 894.618908][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 894.648629][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 894.672110][ T6684] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 894.681235][T11669] device veth0_vlan entered promiscuous mode [ 894.735382][T11669] device veth1_vlan entered promiscuous mode [ 894.869916][T11669] device veth0_macvtap entered promiscuous mode [ 894.905028][ T2289] Bluetooth: hci3: command 0x0419 tx timeout [ 894.914761][ T7] usb 3-1: USB disconnect, device number 6 [ 894.949950][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 894.964919][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 895.013679][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 895.058625][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 895.109127][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 895.131071][T11936] xt_connbytes: Forcing CT accounting to be enabled [ 895.141822][T11669] device veth1_macvtap entered promiscuous mode [ 895.159074][T11936] Cannot find set identified by id 0 to match [ 895.244240][T11669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.287580][T11669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.319398][T11669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.334867][T11669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.356330][T11669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.385992][T11669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.403889][T11669] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 895.419238][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 895.475429][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 895.509107][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 895.535625][T11669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.562551][T11669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.591907][T11958] overlayfs: fs on './cgroup' does not support file handles, falling back to index=off,nfs_export=off. [ 895.603678][T11669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.630904][T11955] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1982'. [ 895.646485][T11669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.651456][T11955] jffs2: notice: (11955) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 895.668942][T11669] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.721406][T11669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.764224][T11669] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 895.777358][T11669] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 895.817377][T11669] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 895.848452][T11669] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 895.880905][T11669] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 895.930158][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 895.950617][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 896.081456][T11965] device syzkaller0 entered promiscuous mode [ 896.359193][ T8120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 896.393946][ T8120] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 896.437139][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 896.458112][T11979] tc action pedit offset 0 out of bounds [ 896.465907][ T8120] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 896.509836][ T8120] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 896.602078][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 896.765657][T11988] syz.3.1990 uses obsolete (PF_INET,SOCK_PACKET) [ 896.859458][T11993] device syzkaller0 entered promiscuous mode [ 896.914060][T11992] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 896.921193][T11992] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 896.994875][ T5816] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 897.021577][ T5816] Bluetooth: hci2: Injecting HCI hardware error event [ 897.042891][T11992] vhci_hcd vhci_hcd.0: Device attached [ 897.053173][ T4192] Bluetooth: hci2: hardware error 0x00 [ 897.217295][ T2289] usb 6-1: new low-speed USB device number 3 using dummy_hcd [ 897.334872][ T4251] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 897.623761][ T2289] usb 6-1: config 0 has no interfaces? [ 897.630433][ T2289] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 897.671586][ T2289] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.723884][ T2289] usb 6-1: config 0 descriptor?? [ 897.983312][T11994] vhci_hcd: connection closed [ 897.983810][ T1345] usb 6-1: USB disconnect, device number 3 [ 897.992092][ T4262] vhci_hcd: stop threads [ 898.041492][ T4262] vhci_hcd: release socket [ 898.058456][ T4262] vhci_hcd: disconnect device [ 898.538779][T12032] jffs2: notice: (12032) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 898.645127][T12039] overlayfs: overlapping lowerdir path [ 899.550102][T12060] divide error: 0000 [#1] PREEMPT SMP KASAN [ 899.556219][T12060] CPU: 1 PID: 12060 Comm: syz.3.2004 Not tainted syzkaller #0 [ 899.563775][T12060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 899.574198][T12060] RIP: 0010:block2mtd_setup2+0x5b0/0xd90 [ 899.580032][T12060] Code: 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 80 3c 28 00 4c 8b 7c 24 18 74 08 4c 89 f7 e8 38 97 91 fc 49 8b 06 49 63 cf 48 99 <48> f7 f9 49 89 d6 31 ff 48 89 d6 e8 40 78 4c fc 4d 85 f6 0f 85 98 [ 899.600020][T12060] RSP: 0018:ffffc90002e1f9e0 EFLAGS: 00010246 [ 899.606110][T12060] RAX: 0000000000000000 RBX: 1ffff1100c053002 RCX: 0000000000000000 [ 899.614413][T12060] RDX: 0000000000000000 RSI: 0000000000700000 RDI: 0000000001f00000 [ 899.622994][T12060] RBP: ffffc90002e1fbd0 R08: ffff8880205c84af R09: 1ffff110040b9095 [ 899.631566][T12060] R10: dffffc0000000000 R11: ffffed10040b9096 R12: ffffc90002e1fa60 [ 899.640133][T12060] R13: dffffc0000000000 R14: ffff888145bacd60 R15: 0000000000000000 [ 899.649343][T12060] FS: 00007f08498b06c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 899.658557][T12060] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 899.665249][T12060] CR2: 000000110c380485 CR3: 00000000775d5000 CR4: 00000000003506e0 [ 899.673615][T12060] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 899.682998][T12060] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 899.690992][T12060] Call Trace: [ 899.694283][T12060] [ 899.697220][T12060] ? block2mtd_setup+0x40/0x40 [ 899.702326][T12060] ? __mutex_lock_common+0x435/0x2400 [ 899.707845][T12060] ? read_lock_is_recursive+0x10/0x10 [ 899.713252][T12060] block2mtd_setup+0x1f/0x40 [ 899.717949][T12060] param_attr_store+0x20a/0x300 [ 899.722916][T12060] ? param_attr_show+0x170/0x170 [ 899.727988][T12060] ? sysfs_kf_read+0x350/0x350 [ 899.733710][T12060] module_attr_store+0x5b/0x80 [ 899.738860][T12060] kernfs_fop_write_iter+0x3a8/0x500 [ 899.744189][T12060] vfs_write+0x748/0xd70 [ 899.748631][T12060] ? file_end_write+0x250/0x250 [ 899.753559][T12060] ? mutex_lock_nested+0x17/0x20 [ 899.758595][T12060] ? __fdget_pos+0x2bf/0x370 [ 899.763210][T12060] ? ksys_write+0x70/0x260 [ 899.768008][T12060] ksys_write+0x153/0x260 [ 899.772713][T12060] ? __ia32_sys_read+0x80/0x80 [ 899.778028][T12060] ? lockdep_hardirqs_on+0x94/0x140 [ 899.784764][T12060] do_syscall_64+0x4c/0xa0 [ 899.789252][T12060] ? clear_bhb_loop+0x30/0x80 [ 899.793952][T12060] ? clear_bhb_loop+0x30/0x80 [ 899.798654][T12060] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 899.804776][T12060] RIP: 0033:0x7f084b6580d9 [ 899.809296][T12060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 899.829648][T12060] RSP: 002b:00007f08498b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 899.838439][T12060] RAX: ffffffffffffffda RBX: 00007f084b8dffa0 RCX: 00007f084b6580d9 [ 899.846432][T12060] RDX: 000000000000000b RSI: 00002000000001c0 RDI: 0000000000000003 [ 899.854590][T12060] RBP: 00007f084b6ef024 R08: 0000000000000000 R09: 0000000000000000 [ 899.862836][T12060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 899.870917][T12060] R13: 00007f084b8e0038 R14: 00007f084b8dffa0 R15: 00007ffdb5f821c8 [ 899.879286][T12060] [ 899.882325][T12060] Modules linked in: [ 899.895188][T12066] ip_tables: iptables: counters copy to user failed while replacing table [ 899.906896][T12068] netlink: 'syz.2.2008': attribute type 1 has an invalid length. [ 899.957072][T12070] PM: hibernation: Marking nosave pages: [mem 0x00000000-0x00000fff] [ 899.971479][T12068] device bond1 entered promiscuous mode [ 899.978894][T12068] 8021q: adding VLAN 0 to HW filter on device bond1 [ 899.996605][T12073] 8021q: adding VLAN 0 to HW filter on device bond1 [ 900.003884][T12060] ---[ end trace 90e4712f354cb685 ]--- [ 900.009046][T12070] PM: hibernation: Marking nosave pages: [mem 0x0009f000-0x000fffff] [ 900.011497][T12060] RIP: 0010:block2mtd_setup2+0x5b0/0xd90 [ 900.029296][T12073] bond1: (slave ip6gre3): The slave device specified does not support setting the MAC address [ 900.043246][T12070] PM: hibernation: Marking nosave pages: [mem 0xbfffd000-0xffffffff] [ 900.058141][T12060] Code: 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 80 3c 28 00 4c 8b 7c 24 18 74 08 4c 89 f7 e8 38 97 91 fc 49 8b 06 49 63 cf 48 99 <48> f7 f9 49 89 d6 31 ff 48 89 d6 e8 40 78 4c fc 4d 85 f6 0f 85 98 [ 900.082802][T12073] bond1: (slave ip6gre3): Setting fail_over_mac to active for active-backup mode [ 900.117138][T12073] bond1: (slave ip6gre3): making interface the new active one [ 900.135396][T12060] RSP: 0018:ffffc90002e1f9e0 EFLAGS: 00010246 [ 900.147407][T12073] device ip6gre3 entered promiscuous mode [ 900.175053][T12073] bond1: (slave ip6gre3): Enslaving as an active interface with an up link [ 900.184741][T12060] RAX: 0000000000000000 RBX: 1ffff1100c053002 RCX: 0000000000000000 [ 900.196478][T12060] RDX: 0000000000000000 RSI: 0000000000700000 RDI: 0000000001f00000 [ 900.213087][T12060] RBP: ffffc90002e1fbd0 R08: ffff8880205c84af R09: 1ffff110040b9095 [ 900.229489][T12077] bond2 (unregistering): Released all slaves [ 900.236207][T12060] R10: dffffc0000000000 R11: ffffed10040b9096 R12: ffffc90002e1fa60 [ 900.244735][T12060] R13: dffffc0000000000 R14: ffff888145bacd60 R15: 0000000000000000 [ 900.253107][T12060] FS: 00007f08498b06c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 [ 900.266676][T12060] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 900.270540][ T3056] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 900.273628][T12060] CR2: 00005562c28d5950 CR3: 00000000775d5000 CR4: 00000000003506f0 [ 900.273651][T12060] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 900.273663][T12060] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 900.308966][T12060] Kernel panic - not syncing: Fatal exception [ 900.316438][T12060] Kernel Offset: disabled [ 900.321133][T12060] Rebooting in 86400 seconds..