last executing test programs: 25.378391864s ago: executing program 1 (id=917): r0 = socket(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='oom_adj\x00') fchdir(r1) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x20000046) write(r0, &(0x7f0000000240)="aefc0000", 0x4) 25.235583717s ago: executing program 1 (id=919): r0 = fsopen(&(0x7f0000000080)='hfs\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, 0x0, 0x0, 0x0) 25.160329199s ago: executing program 1 (id=920): r0 = syz_usb_connect(0x2, 0x68, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904fb00026c5d650009050402100000fa000905820240"], 0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r2 = socket$qrtr(0x2a, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r4, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0) connect$qrtr(r2, &(0x7f0000000040)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) readv(r1, &(0x7f0000001400)=[{&(0x7f0000000880)=""/240, 0xf0}, {0x0}], 0x2) syz_usb_control_io$printer(r0, 0x0, 0x0) 21.688421786s ago: executing program 1 (id=944): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x110) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)='./file0\x00') 21.5363741s ago: executing program 1 (id=947): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42}, 0x10) sendmsg$tipc(r1, &(0x7f00000008c0)={&(0x7f0000000600)=@name, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r2 = dup3(r0, r1, 0x0) socket$tipc(0x1e, 0x2, 0x0) write$UHID_INPUT(r2, 0x0, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r3, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) 19.603947062s ago: executing program 1 (id=960): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0xc00000000000018, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_mount_image$ocfs2(&(0x7f00000026c0), &(0x7f0000004780)='./file0\x00', 0x2010080, &(0x7f0000000340)=ANY=[@ANYBLOB="6a6f75726e616c5f6173796e635f636f6d6d69742c636f686572656e63793d66756c6c2c6572726f72733d636f6e74696e75652c6865617274626561743d6e6f6e652c6572726f72733d636f6e74696e75652c6e6f696e74722c67727071756f74612c001796fa694353e3807803df5ea6fd4d6e6a2613d336eb62b863dcd89e37b45f8bd04199a14c48b3e553e035ab300ba3c60c27682a8ab5656969d829535c0862f6e3a35f15fe4d50c0d5c74631344625d6224c436474bb101ff47a14c51e342ca291c09c35d9d31b06b6b86cb9dccae387b5f1e7c5e1d445d52845a3fa4c77234ea9d37c8a277c85e69a85cc6ffeb225bebbca91b569b80ee303c9a21c58db5d96fb87f1713e0e9b896e37becae2e7a978259a0847e9fb08dcb8b9f84f616463da2507db1b3489769e99"], 0x1, 0x4703, &(0x7f000000c7c0)="$eJzs212IXFcBB/BzZ1ezmybb/UibpOnHJBFctCybPlXrQ1yrNpo2H9pWU2Wd3Ww3q7M76+6MFgxSgyAKghIEFT+oCqUvtSAG+lKLUPADaRVKRdH6IlKogg8GbaArM3Nvdu6d2d7JTtLS9veDdvaee8+5Z/a/99w590wKseqphdXiwmqxtFSszN6/ekvxc5VybXEuFF4lr/X56c6VyEn2r50j7/vAR+65JYQ/HPvah9bW1tZC3XDo6EDLz+f/fXq29TVRyNSpt9u5taY/1h556edveaUj8pwIIexo61ddXwjhY78IYUsIYSQuG41fB0MI20IIUQjh0d/868cDvXShxdl7X3ju2JnD+85MPf7YMxfmj254YBTCd8u7b55ffHF/323Pv+MynR4AAF7RB48fufvo5IHwZBSGzvW3f17fGb8mn4/vfNun7nq4f33/Gt3pexVDBQAAgIz1+f9w9HKH9bpkZS1ZEnzigRN3PxWt7zexfX07dNeR298/eSBe/43a9t8aF/3zvX2NNdTsum92/XckU7/z+u/6eR7+6rO/XHrr5vuf9C8573CIChOp7UJhYiKEY1PN7V3R1kK5slp95/2V2tLJzZ/3jSKdf3b1fn1Bv9v8RzPV89b/d3/i8z8b7O/lHYyF7F9tfbvY/qdMB+n8Nx7Lf/KlqKv8xzL18vK/4+nt53+1pZd3kD0jlyKdf/NC3Nd6QLE5ANTz/2Z/fv47Mu3n5f/9qXOPntjE93/q48xwVO/rQGoEeDku3+ArTGSk828GkRo641/kRtf//zL5X5NpPy//Oyv/+N3ferj/bzT+j0/10uabRzr/ZhDF1BHr1/9IIf/6vzbTfl7+vz3152c/2dO9uj3/ev/H3f+7ks4/vhGnB8/Gb7Lb8X9npv28/HeN3ffQwib6/eHBuJ9DURhr+dbpufotbGh9vboxpanvXt7ESd4E0vk3f2upS2eo+dK4/ofzx/9dmfbz8n9oz9ffc7qn7/92Hv8njf9dSec/2Ci7lPxfyuS/O9N+Xv4/PP33v9x3mcf/+vZB+Xclnf/Wtv3rz38KXc3/rsvUz3v+s2/0qUf+2sP8P+lfct7k+U/yHGI8aj7/obN0/ldteFy39/89mXp51/+3/vP80/t7Gf+jAU8AepDOf1uzsMMEsNv8r8+0n5f/F+758sf/tIn5X+MT30CSf8v8f0uz/Kjxvyvp/Lc3C1P/GOrBxv8b9/+oPff/ZvK/IdN+Xv4XDk30f+Uy3//r/R/v8Cibdun8hzY8rp7/77u4/9+YqZeX/xf3/vTFm3v6/B/CpLn+pqXzv3rD4xrX/0B+/jdl6uXl/51v/PqJB3vo/9t7qEs2/+a9PnU5xZ/Nu53/FzPt5+X/o/HzZ/dfgfnfre7/XUnn31w1v5T8s/P/vZn28/L/3pEfrPRfgec/d8gfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgU0bj1+EQFSZS24XCxEQIY/H2rrA1mimdnJ4pV2Y/sxrCjri8GEaj+XJlplSeXliqnJybLpXLldkQron37wgD0Wq5Up1eLC1fe7GtwejUXGmlOjNXqoYQdsbl14ftSVszC9XF0nLj2KTOVVHps7VKtTRRW51bCbsvlm9LyudXKrXl6y62dXWhsrJ8qrQ0fXJh5d2Tk5OTYc/FPo9Ecw9U55aqzd4299brJHWHo5Y309h9Q8v5Pl2prSyVyo3yG1vqlCuzpXJLnZtazlddqS3Nlqpz0+XKfHK+YkvdlvfW2L033jceRlLvL6mbdTB+vf3Q8Y8eP3ygbX8xSue9VFucm9ze+W8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDeuJ29717dDCH3NrUII4WDyQxT/l3L23heeO3bm8L4zU48/9syF+aOdjgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVh535equjiOACfGd/7WiCltBFyGRgiojsJC/pFJJXXyJZtWge1SsigKDCMaFkQBEHtooKgVVD5F0QtXLaqNrVoYRBBxehMXu4IN7zQMed5YDgzzL1nvjBw78z5HA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD6cXbHYlfWXtq1eWnr7g+hMz/3fwhhNFne/7y3I/SEEL5+mTkdVmkLPU39v5mcGy9fNfm9t3/84fXRZO31F98trtsdknSo4XhnkqZDQ2vvf6O6M/hsejAJIY1dCFEsjD05UwshdMQuhCh+fpy/mP2+/xe7EKLo/3C3K7v/tdiFEMXW3Z/6avkzHtVzvn5hsPG/v9UjeBuP6KxDb09eeZe6qZX3Mn//T/LN+2A1zJ448v557CKIZnZu6mjsGgAAgL/rXIv8P2xZ3r9/OQk93eXc/1tT/t/b1P/q+f+Ke9tvjM20FUJsK41NZsfD+9rpc+M7NXD19uua8Z6qkv9Xm/y/2uT/1Sb/rzb5f7XJ/8m8kv9X0uObexZfxC6CaOT/AABQPYeOT0zVh0eyl/9NPzrLeX1f3tbzPP3BremBRw3jRvLDf9vhYxMHDg6P5Pe9PCC4sv5DunT2ez7fo7ktTDbNu2i1/kPv04X5a53lT9T/cP5GUV9xXes/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/2J17GgbBKAyj321F1EarogkLPwk+0MCIAKQwowEdTBiAgRBQwEDOWe5NnuUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnu9f5XXx/aUx0muNSFPZZdf+OZ5mP3PfDsv77HHjVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjYgQMZAAAAAGH+1nm0HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKcCAAD//wTsyzo=") read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x20000050) getdents(0xffffffffffffffff, 0x0, 0x0) lchown(0x0, 0x0, 0x0) 19.369026798s ago: executing program 32 (id=960): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0xc00000000000018, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_mount_image$ocfs2(&(0x7f00000026c0), &(0x7f0000004780)='./file0\x00', 0x2010080, &(0x7f0000000340)=ANY=[@ANYBLOB="6a6f75726e616c5f6173796e635f636f6d6d69742c636f686572656e63793d66756c6c2c6572726f72733d636f6e74696e75652c6865617274626561743d6e6f6e652c6572726f72733d636f6e74696e75652c6e6f696e74722c67727071756f74612c001796fa694353e3807803df5ea6fd4d6e6a2613d336eb62b863dcd89e37b45f8bd04199a14c48b3e553e035ab300ba3c60c27682a8ab5656969d829535c0862f6e3a35f15fe4d50c0d5c74631344625d6224c436474bb101ff47a14c51e342ca291c09c35d9d31b06b6b86cb9dccae387b5f1e7c5e1d445d52845a3fa4c77234ea9d37c8a277c85e69a85cc6ffeb225bebbca91b569b80ee303c9a21c58db5d96fb87f1713e0e9b896e37becae2e7a978259a0847e9fb08dcb8b9f84f616463da2507db1b3489769e99"], 0x1, 0x4703, &(0x7f000000c7c0)="$eJzs212IXFcBB/BzZ1ezmybb/UibpOnHJBFctCybPlXrQ1yrNpo2H9pWU2Wd3Ww3q7M76+6MFgxSgyAKghIEFT+oCqUvtSAG+lKLUPADaRVKRdH6IlKogg8GbaArM3Nvdu6d2d7JTtLS9veDdvaee8+5Z/a/99w590wKseqphdXiwmqxtFSszN6/ekvxc5VybXEuFF4lr/X56c6VyEn2r50j7/vAR+65JYQ/HPvah9bW1tZC3XDo6EDLz+f/fXq29TVRyNSpt9u5taY/1h556edveaUj8pwIIexo61ddXwjhY78IYUsIYSQuG41fB0MI20IIUQjh0d/868cDvXShxdl7X3ju2JnD+85MPf7YMxfmj254YBTCd8u7b55ffHF/323Pv+MynR4AAF7RB48fufvo5IHwZBSGzvW3f17fGb8mn4/vfNun7nq4f33/Gt3pexVDBQAAgIz1+f9w9HKH9bpkZS1ZEnzigRN3PxWt7zexfX07dNeR298/eSBe/43a9t8aF/3zvX2NNdTsum92/XckU7/z+u/6eR7+6rO/XHrr5vuf9C8573CIChOp7UJhYiKEY1PN7V3R1kK5slp95/2V2tLJzZ/3jSKdf3b1fn1Bv9v8RzPV89b/d3/i8z8b7O/lHYyF7F9tfbvY/qdMB+n8Nx7Lf/KlqKv8xzL18vK/4+nt53+1pZd3kD0jlyKdf/NC3Nd6QLE5ANTz/2Z/fv47Mu3n5f/9qXOPntjE93/q48xwVO/rQGoEeDku3+ArTGSk828GkRo641/kRtf//zL5X5NpPy//Oyv/+N3ferj/bzT+j0/10uabRzr/ZhDF1BHr1/9IIf/6vzbTfl7+vz3152c/2dO9uj3/ev/H3f+7ks4/vhGnB8/Gb7Lb8X9npv28/HeN3ffQwib6/eHBuJ9DURhr+dbpufotbGh9vboxpanvXt7ESd4E0vk3f2upS2eo+dK4/ofzx/9dmfbz8n9oz9ffc7qn7/92Hv8njf9dSec/2Ci7lPxfyuS/O9N+Xv4/PP33v9x3mcf/+vZB+Xclnf/Wtv3rz38KXc3/rsvUz3v+s2/0qUf+2sP8P+lfct7k+U/yHGI8aj7/obN0/ldteFy39/89mXp51/+3/vP80/t7Gf+jAU8AepDOf1uzsMMEsNv8r8+0n5f/F+758sf/tIn5X+MT30CSf8v8f0uz/Kjxvyvp/Lc3C1P/GOrBxv8b9/+oPff/ZvK/IdN+Xv4XDk30f+Uy3//r/R/v8Cibdun8hzY8rp7/77u4/9+YqZeX/xf3/vTFm3v6/B/CpLn+pqXzv3rD4xrX/0B+/jdl6uXl/51v/PqJB3vo/9t7qEs2/+a9PnU5xZ/Nu53/FzPt5+X/o/HzZ/dfgfnfre7/XUnn31w1v5T8s/P/vZn28/L/3pEfrPRfgec/d8gfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgU0bj1+EQFSZS24XCxEQIY/H2rrA1mimdnJ4pV2Y/sxrCjri8GEaj+XJlplSeXliqnJybLpXLldkQron37wgD0Wq5Up1eLC1fe7GtwejUXGmlOjNXqoYQdsbl14ftSVszC9XF0nLj2KTOVVHps7VKtTRRW51bCbsvlm9LyudXKrXl6y62dXWhsrJ8qrQ0fXJh5d2Tk5OTYc/FPo9Ecw9U55aqzd4299brJHWHo5Y309h9Q8v5Pl2prSyVyo3yG1vqlCuzpXJLnZtazlddqS3Nlqpz0+XKfHK+YkvdlvfW2L033jceRlLvL6mbdTB+vf3Q8Y8eP3ygbX8xSue9VFucm9ze+W8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDeuJ29717dDCH3NrUII4WDyQxT/l3L23heeO3bm8L4zU48/9syF+aOdjgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVh535equjiOACfGd/7WiCltBFyGRgiojsJC/pFJJXXyJZtWge1SsigKDCMaFkQBEHtooKgVVD5F0QtXLaqNrVoYRBBxehMXu4IN7zQMed5YDgzzL1nvjBw78z5HA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD6cXbHYlfWXtq1eWnr7g+hMz/3fwhhNFne/7y3I/SEEL5+mTkdVmkLPU39v5mcGy9fNfm9t3/84fXRZO31F98trtsdknSo4XhnkqZDQ2vvf6O6M/hsejAJIY1dCFEsjD05UwshdMQuhCh+fpy/mP2+/xe7EKLo/3C3K7v/tdiFEMXW3Z/6avkzHtVzvn5hsPG/v9UjeBuP6KxDb09eeZe6qZX3Mn//T/LN+2A1zJ448v557CKIZnZu6mjsGgAAgL/rXIv8P2xZ3r9/OQk93eXc/1tT/t/b1P/q+f+Ke9tvjM20FUJsK41NZsfD+9rpc+M7NXD19uua8Z6qkv9Xm/y/2uT/1Sb/rzb5f7XJ/8m8kv9X0uObexZfxC6CaOT/AABQPYeOT0zVh0eyl/9NPzrLeX1f3tbzPP3BremBRw3jRvLDf9vhYxMHDg6P5Pe9PCC4sv5DunT2ez7fo7ktTDbNu2i1/kPv04X5a53lT9T/cP5GUV9xXes/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/2J17GgbBKAyj321F1EarogkLPwk+0MCIAKQwowEdTBiAgRBQwEDOWe5NnuUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnu9f5XXx/aUx0muNSFPZZdf+OZ5mP3PfDsv77HHjVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjYgQMZAAAAAGH+1nm0HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKcCAAD//wTsyzo=") read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x20000050) getdents(0xffffffffffffffff, 0x0, 0x0) lchown(0x0, 0x0, 0x0) 6.832311008s ago: executing program 3 (id=1057): syz_io_uring_setup(0xefe, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, 0x0) syz_io_uring_modify_offsets$generic(r0, r1, 0x2c, 0x1000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000005c0)={@flat=@weak_binder={0x77622a85, 0x1000}, @flat=@binder={0x73622a85, 0x100b}, @flat=@weak_binder={0x77622a85, 0x100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000034c0)={0x2020}, 0xcac) 6.73908427s ago: executing program 3 (id=1058): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_NF_CALL_ARPTABLES={0x5, 0x26, 0x1}]}}}]}, 0x3c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'tunl0\x00', &(0x7f00000000c0)={'tunl0\x00', 0x0, 0x10, 0x1, 0xffff, 0x8, {{0xe, 0x4, 0x0, 0x2, 0x38, 0x68, 0x0, 0x3, 0x16, 0x0, @local, @private=0xa010100, {[@ssrr={0x89, 0x7, 0x71, [@private=0xa010101]}, @ra={0x94, 0x4}, @noop, @rr={0x7, 0x17, 0xcc, [@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100, @local, @local, @rand_addr=0x64010100]}]}}}}}) sendmsg$nl_route_sched_retired(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@deltfilter={0x54, 0x2d, 0x100, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xb, 0x9}, {0xc, 0xffff}, {0x3, 0xfff1}}, [@f_rsvp6={{0xa}, {0x24, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0x800, 0x10000, 0x800}, {0xfd, 0x7, 0x7}, 0x16, 0x0, 0x3}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4844}, 0x8001) ioctl$TCXONC(r2, 0x5608, 0x3) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001e80)=@newtaction={0x48, 0x31, 0x1, 0xfffffffd, 0x25dfdbfb, {0x0, 0x0, 0x11}, [{0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x3, {0x1, 0xc1cec2645649c048}}, {0xc}}}]}]}, 0xa3}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 6.683994381s ago: executing program 3 (id=1059): socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) times(0xfffffffffffffffc) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f00000000c0)='2\x00', 0x2) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc048aeca, &(0x7f0000000180)={0x6, 0x0, [{0x0, 0x0, 0x3fffffffffffe}, {0x303}, {0xb90, 0x0, 0x100000000}, {0xa11, 0x0, 0x66}, {0x9a7, 0x0, 0xf0a}, {0x809, 0x0, 0x4}]}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(0x0, 0x189, 0x2, 0x0, 0x0, 0xfffffff7) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ad5600008100", 0x6) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 6.056891365s ago: executing program 2 (id=1062): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000000)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000040)="05", 0x1}], 0x1, &(0x7f0000000340)=[@sndrcv={0x30, 0x84, 0x1, {0x2, 0x0, 0x41, 0x8, 0x2, 0xffffffff, 0x3, 0x7fffffff}}], 0x30}, 0x0) 5.81094894s ago: executing program 2 (id=1063): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$SNAPSHOT_FREE(r0, 0x3305) writev(r0, &(0x7f0000000340)=[{&(0x7f00000000c0)="1760b82fc7c9", 0x6}], 0x1) 5.452400638s ago: executing program 2 (id=1066): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB], &(0x7f0000000040)=""/249, 0x46, 0xf9, 0x6}, 0x28) 5.443244079s ago: executing program 2 (id=1067): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)={0x40, 0x8}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.430463159s ago: executing program 3 (id=1068): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000640)={0x0, 0xe, 0x1, "06"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) 3.227934918s ago: executing program 5 (id=1073): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) socket(0x10, 0x3, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665000000004400058005000500000000000500", @ANYRES8=r3], 0x7c}}, 0x0) 3.11242867s ago: executing program 5 (id=1074): syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file1\x00', 0x200000, &(0x7f0000000000)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00'], 0x47, 0xc11, &(0x7f0000000d00)="$eJzs3V1oXOl5B/DnnSOtRto00WYTb9Jm04GUxCi18VdsBZcgZxW1AccbIit0r6LRh51h5ZGR5MabtkFtSQu9Cd2b0psimi4t5KJX3V5WabaQUAol5CK9KAiaLHvRC10ECi0bhXPmHWlky7ayXlvS7u+3zP7PnHnO+P0YnzkCvzoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAER89nOXTp1OB90KAOBxujL5pVNnff8DwLvKVT//AwAAAAAAAAAAAADAYZeiiGORYujVzTRdPe+oX261b92eGp/Y+7DBFClqUVT15aN++szZc586f2G0m/c//u324Xh+8uqlxnOLN24uzS8vz881ptqt2cW5+X2/w8Mef6eRagAaN168NXft2nLjzMmzu16+Pfz6wJPHhi9eOHF+tFs7NT4xMdlT09f/lv/0u9xrhccTUUQzUrw5/EZqRkQtHn4sHvDZedQGq06MVJ2YGp+oOrLQarZXyhdTLVfVIho9B411x+gxzMVDGYtYLZtfNnik7N7kzeZSc2ZhvvHF5tJKa6W12E61TmvL/jSiFqMpYi0iNgbufrv+KOKjkeLlU5tpJiKK7jh8sloY/OD21B5BH/ehbGejP2KtdgTm7BAbiCKuRIqfvXY8Zssxy4/4eMQXynw14pUyPxORyg/GuYif7vE54mjqiyL+PVIsps00V50PuueVy19ufL59bbGntnteOfLfD4/TIT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25HiT579vWpdcVTr0t93cfQ9L/x275rxZx7wPmXtyYhYre1vTW5/XjqcauV/j6Bj7Es9ivhGXv/3RwfdGAAAAAAAAAAAAAAAAAAAgHe1Il6IFF85cTytRe89xVvt642rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzDsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KBbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIk5Fi/YV69XytFnE1In6+tbXVfUTEZpkP66D7CgAAAAAAAAAAAAAAAAAAAIdWKuJjkeLp/9tMjYi4Pfz6wJPHhi9eOHF+tIgiUlnSW//85NVLjecWb9xcml9enp9rTLVbs4tz8/v94+qXW+1bt6fGJx5JZx5o8BG3f7D+3OLNl5Za17+6sufrQ/VLM8srS83ZvV+OwahFTPfuGakaPDU+UTV6odVsV4em2j0aWIsY229nAAAAAAAAAAAAAAAAAAAAODSGUhGfixQ/+a9zqbtuvK+z5v9XOs+K7dpX/mDndwEs3JFdvb8/YD/bab8NHakW3jemxicmJnt29/XfXVq2KaUinokUn3j5Q9V6+BRDe66NL+veW9bdOJfrhn+trFvdVVUfmRqfaFxZbJ+4tLCwONtcac4szDcmbzZn9/2LAwAAAAAAAAAAAAAAAAAAAOA+hlIRP4oU//P3/5G6953P6//7Os961v//VrWEvlJPu3Nbtbb/vdXa/s72+y6ODn302XvtfxTr/8s2pVTENyPF2R99qLqffnf9//QdtWXdn0WKN579SK6rPVHWNbvd6bzjtdbC/Kmy9q8jxa+/2a2NqvZ6rn16p/Z0WTsYKf5yc3ftV3PtB3Zqz5S1xyPF9/5779oP7tSeLWt/Ein+6e8a3dqhsvb3c+2xndqTs4sLcw8a1nL+vxMp/vbK76Run+85/z2//2H1jtx215zff/vtmv/hnn2reV7/NM9/8wHzfz5SfKf+kVzXGfuZ/PpT1f935v8TkeI//2137bVc+/6d2tP77dZBK+f/25Hiu3/14+0+5/nPI7szQ73z/6t9u3P7U3JA8/9Uz77h3K7ZX3Is3o2WX/r6i82FhfklGzZs2NjeOOgzE49D+f3/55Hi/48VqXsdk7//39N5tnP997/f2Pn+v3hHbjug7//39+y7mK9a+vsi6is3bvY/E1FffunrJ1o3mtfnr8+3z5w+9elPnz996vT5/ie6F3c7W/seu3eCcv5/ECl++A8/3P45Zvf1397X/0N35LYDmv+ne/u067pm30PxrlTO/99Eiqc+++Ptnzfvd/3f/fn/+Md25/bfvwOa/w/07BvO7Wr9kmMBAAAAAAAAAABwlAylIv4iUvzuH/9m6q4h2s+//5u7I7cd0L//Otazb+4xrWvY9yADABwi5fXfByPFP299f3st9+7rv/iNbm3v9d+9HIb7/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFGXoog/jBRDr26m9YHyeUf9cqt96/bU+MTehw2mSFGLoqovH/XTZ86e+9T5C6PdvP/xb7cPx/OTVy81nlu8cXNpfnl5fq4x1W7NLs7N7/sdHvb4O41UA9C48eKtuWvXlhtnTp7d9fLt4dcHnjw2fPHCifOj3dqp8YmJyZ6avv63/KffJd1j/xNRxPcjxZvDb6TvDkTU4uHH4gGfnUdtsOrESNWJqfGJqiMLrWZ7pXwx1XJVLaLRc9BYd4wew1w8lLGI1bL5ZYNHyu5N3mwuNWcW5htfbC6ttFZai+1U67S27E8jajGaItYiYmPg7rfrjyK+GSlePrWZ/mUgouiOwyevTH7p1NkHt6f2CPq4D2U7G/0Ra7UjMGeH2EAU8Y+R4mevHY/vDUT0RecRH4/4QpmvRrxS5mciUvnBOBfx0z0+RxxNfVHEuUixmDbTawPl+aB7Xrn85cbn29cWe2q755Uj//3wOB3yc1M9ivhBdcbfTP/q7zUAAAAAAAAAAAAAAADAIVLEWqT4yonjqVofvL2muNW+3rjanFnoLOvrrv3rrpne2traaqROjuWczrmacy3nes6NnFHLx+ccyzmdczXnWs71nBs5o8jH5xzLOZ1zNedazvWcGzmjLx+fcyzndM7VnGs513Nu5IxDsnYPAAAAAAAAAAAAAAAAAAB4Z6lFUd3F/Vtf20xbA537S09HJ9fdD/Qd7xcBAAD//0kCdPc=") syz_mount_image$exfat(0x0, &(0x7f0000000080)='./bus\x00', 0x2480e, 0x0, 0xfd, 0x0, &(0x7f0000000000)) rename(0x0, &(0x7f00000000c0)='./bus\x00') 3.057774792s ago: executing program 5 (id=1075): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x16, 0x0, 0x4, 0xffff, 0x0, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001280)=[r1, r1], 0x0, 0x10, 0x10000}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xd, 0x5a87, 0x4, 0x3, 0x0, r1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000024c0), &(0x7f0000001280), 0x2, r2, 0x0, 0x8000000}, 0x27) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0xf0f046}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f00000002c0)=@ethtool_sfeatures={0x3b, 0x2, [{0xfe, 0x8000ffa1}, {0xfffffff9, 0x80500}]}}) 3.012591863s ago: executing program 5 (id=1076): add_key$keyring(&(0x7f0000000100), &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, 0x0, 0xee01, 0x0) keyctl$setperm(0x5, 0x0, 0x2008) keyctl$KEYCTL_MOVE(0x3, 0x0, 0x0, 0x0, 0x0) 2.928125635s ago: executing program 5 (id=1078): socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) times(0xfffffffffffffffc) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f00000000c0)='2\x00', 0x2) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc048aeca, &(0x7f0000000180)={0x6, 0x0, [{0x0, 0x0, 0x3fffffffffffe}, {0x303}, {0xb90, 0x0, 0x100000000}, {0xa11, 0x0, 0x66}, {0x9a7, 0x0, 0xf0a}, {0x809, 0x0, 0x4}]}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(0x0, 0x189, 0x2, 0x0, 0x0, 0xfffffff7) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ad5600008100", 0x6) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 2.927688344s ago: executing program 0 (id=1079): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='uid_map\x00') fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(0x0, 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) lchown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r6 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) chdir(&(0x7f0000000000)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00') write$uinput_user_dev(r6, &(0x7f0000000800)={'syz0\x00', {0x0, 0x0, 0x4cf5}, 0x3, [0x0, 0x0, 0x2, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x4, 0xfffffffd, 0x0, 0x0, 0x7, 0x4, 0x0, 0x1a8, 0x0, 0x10000000, 0x7, 0x0, 0xfffffffe, 0x0, 0xfffffff4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004, 0xfffffffc, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x10000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x4, 0xffff, 0x8000000, 0x1, 0x0, 0x2, 0x0, 0xfffffff4, 0x0, 0x0, 0x40, 0x1, 0x9, 0x0, 0x1, 0x40007ff, 0x8, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x4, 0x689, 0x0, 0xffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1fc, 0x3, 0x0, 0x81, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xb, 0x0, 0x0, 0x0, 0x1000000, 0xfffffffd, 0xb7, 0x807ffff, 0x0, 0x2, 0x0, 0x5b7f28b1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x1, 0x0, 0xa481, 0x0, 0x2, 0x0, 0xb, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x9d2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x80000001, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3b6, 0x7, 0x3, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0xffffff45, 0x200], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x1007, 0x1000, 0x0, 0x0, 0x5, 0x54, 0x5e68, 0x0, 0x0, 0xfffffffd, 0x8, 0x0, 0x80, 0x16b, 0x0, 0x0, 0x0, 0x85, 0xfffffffc, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000001, 0x0, 0x0, 0x7]}, 0x45c) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) 1.995675415s ago: executing program 0 (id=1082): pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x34611d41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005468a9fe52386e52000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000da0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000f7ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bb33ea699a80e3f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) dup2(r5, r3) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 1.864210018s ago: executing program 4 (id=1085): r0 = socket$tipc(0x1e, 0x5, 0x0) getpeername$tipc(r0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x38, r4, 0x2, 0x70bd29, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x3, 0x5a}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x7}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x6c}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x1000}]}, 0x38}, 0x1, 0x0, 0x0, 0xecd5d968e7d69fec}, 0x800) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x34}, 0x2}, 0x1c, 0x0}, 0x40051) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.767911451s ago: executing program 5 (id=1086): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904"], 0x0) syz_usb_connect$uac2(0x2, 0x84, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0xff, 0x4b4, 0x931e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x72, 0x3, 0x1, 0x7, 0x0, 0x2, {0x8, 0xb, 0x2, 0x0, 0x1, 0xc, 0x20, 0x3}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xff23, 0x7, 0x9, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x0, 0x0, 0x5, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x0, 0x3, 0x1, {0x8, 0x25, 0x1, 0x80, 0x30, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0xfe, 0x6, 0xe, {0x8, 0x25, 0x1, 0x2, 0xc, 0x0, 0x6}}}}}}}}]}}, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)={0x2afc0, 0x1c1, 0x6}, 0x18) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 1.718717571s ago: executing program 4 (id=1087): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x20000000) 1.664736503s ago: executing program 4 (id=1088): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r4, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xf000, 0xffff}, {}, {0x7, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x0) 1.554325215s ago: executing program 4 (id=1089): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a000000080000000200000fffffffff0e00000000000000030000000700000003000000fdffffff00000000000000002e000af661a3902707559757c004de957f80f8c0bfc6d024d9d21b27f504374f1c364bb559daf1302bd4c726b70b18ee55c99a"], &(0x7f0000000040)=""/249, 0x46, 0xf9, 0x6}, 0x28) 1.553762166s ago: executing program 4 (id=1090): syz_open_dev$loop(0x0, 0xffff, 0x109041) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x400000, 0x0) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0xfffd, 0x40000000009}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$vbi(&(0x7f00000002c0), 0x1, 0x2) ioctl$VIDIOC_S_STD(r1, 0x40085618, &(0x7f0000000300)) open(0x0, 0x0, 0x109) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) futex(&(0x7f000000cffc)=0x1, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc) 1.131696785s ago: executing program 0 (id=1091): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42}, 0x10) sendmsg$tipc(r1, &(0x7f00000008c0)={&(0x7f0000000600)=@name, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r2 = dup3(r0, r1, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) write$UHID_INPUT(r2, 0x0, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) 1.057089026s ago: executing program 0 (id=1092): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0xc) r3 = openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r4, 0x114, 0x3, &(0x7f00000007c0), 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x4, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040000}, 0x80) 992.905888ms ago: executing program 2 (id=1093): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='uid_map\x00') fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(0x0, 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) lchown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r6 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) chdir(&(0x7f0000000000)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00') write$uinput_user_dev(r6, &(0x7f0000000800)={'syz0\x00', {0x0, 0x0, 0x4cf5}, 0x3, [0x0, 0x0, 0x2, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x4, 0xfffffffd, 0x0, 0x0, 0x7, 0x4, 0x0, 0x1a8, 0x0, 0x10000000, 0x7, 0x0, 0xfffffffe, 0x0, 0xfffffff4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004, 0xfffffffc, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x10000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x4, 0xffff, 0x8000000, 0x1, 0x0, 0x2, 0x0, 0xfffffff4, 0x0, 0x0, 0x40, 0x1, 0x9, 0x0, 0x1, 0x40007ff, 0x8, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x4, 0x689, 0x0, 0xffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1fc, 0x3, 0x0, 0x81, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xb, 0x0, 0x0, 0x0, 0x1000000, 0xfffffffd, 0xb7, 0x807ffff, 0x0, 0x2, 0x0, 0x5b7f28b1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x1, 0x0, 0xa481, 0x0, 0x2, 0x0, 0xb, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x9d2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x80000001, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3b6, 0x7, 0x3, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0xffffff45, 0x200], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x1007, 0x1000, 0x0, 0x0, 0x5, 0x54, 0x5e68, 0x0, 0x0, 0xfffffffd, 0x8, 0x0, 0x80, 0x16b, 0x0, 0x0, 0x0, 0x85, 0xfffffffc, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000001, 0x0, 0x0, 0x7]}, 0x45c) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) 926.118979ms ago: executing program 0 (id=1094): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)={0x28, r1, 0x401, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0xc0b0) 887.62543ms ago: executing program 3 (id=1095): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) 797.362552ms ago: executing program 0 (id=1096): socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) times(0xfffffffffffffffc) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f00000000c0)='2\x00', 0x2) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc048aeca, &(0x7f0000000180)={0x6, 0x0, [{0x0, 0x0, 0x3fffffffffffe}, {0x303}, {0xb90, 0x0, 0x100000000}, {0xa11, 0x0, 0x66}, {0x9a7, 0x0, 0xf0a}, {0x809, 0x0, 0x4}]}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(0x0, 0x189, 0x2, 0x0, 0x0, 0xfffffff7) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ad5600008100", 0x6) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 56.594189ms ago: executing program 2 (id=1097): r0 = socket$tipc(0x1e, 0x5, 0x0) getpeername$tipc(r0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x38, r4, 0x2, 0x70bd29, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x3, 0x5a}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x7}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x6c}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x1000}]}, 0x38}, 0x1, 0x0, 0x0, 0xecd5d968e7d69fec}, 0x800) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x34}, 0x2}, 0x1c, 0x0}, 0x40051) ioctl$KVM_RUN(r5, 0xae80, 0x0) 158.14µs ago: executing program 4 (id=1098): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000300)='./bus\x00', 0x21081e, &(0x7f0000000080)={[{@grpquota}, {@nogrpid}, {@quota}, {@stripe={'stripe', 0x3d, 0x2}}]}, 0x1, 0x51b, &(0x7f0000001000)="$eJzs3c9vI1cdAPDveOPEyaZNWnoABO3SFha0WufHtqtqD1BOCKFKiB5B2obEG0Wx4yh2ShP2sD1zRaISJzjyB3DuiTsXBDcu5YDEjwjUICExaMbj1Ju1s9FmY2fjz0cazXvzHH+/L9bMi1/seQGMrWsR8SAiJiPivYiYK44nxRZvd7bscZ8e3F89PLi/mkSavvuPJG/PjkXPz2SuFs9ZiYgffCfix8mjcVt7+5sr9Xptp6gvtBvbC629/ZsbjZX12nptK/vh24tv3Xpz+an19ZXGZFH68ie/f/CNn2ZpzRZHevvxJJJOl/sdj4jyUZzMRER87yzBLpArRX8mR50IT6QUES9GxKv5+T8XV/JXEwC4zNJ0LtK53joAcNmV8jmwpFQt5gJmo1SqVjtzeC/FTKnebLVv3Gvubq11/kyYj3Lp3ka9tljMFc5HOcnqS3n5s/pypz7Vrd+KiBci4udT03m9utqsr43yDx8AGGNXj43//57qjP8AwCVXGXUCAMDQGf8BYPwY/wFg/Bj/AWD8dMb/6VGnAQAM0Ynv/90PCAAuJfP/ADBWvv/OO9mWHhb3v157f293s/n+zbVaa7Pa2F2trjZ3tqvrzeZ6fs+exuOer95sbi+9EbsfzH9zu9VeaO3t3200d7fad/P7et+tlfNH9b1VNgAwJC+88vGfkmxEvjOdb9GzlkN5pJkB56006gSAkbky6gSAkTnTp3sqPhsEz7IzvMc3PQCXRJ8leh9S6fcFoTRN007pf+k55QWcn+tfMP8P46pn/t+ngGHMmP+H8WUGH8ZXmianXfM/TvtAAOBiM8cPDPj//4vF/jfFPwd+tHb8ER+dZ1YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwsXXX/60Wa4HPRqlUrUY8FxHzUU7ubdRrixHxfET8cao8ldWXRpwzAHBWpb8mxfpf1+den32o6eWrR8XJiPjJL9/9xQcr7fbOHyImk39OdY+3PyqOLw8/ewDgZNl7/e44ne973sh/enB/tbsNM6e/fTsiKp34hweTcXgUfyIm8n0lyhEx86+kqHckPXMXZ/Hgw4j4fL/+JzGbz4F0Vj49Hj+L/dxQ45ceil/K2zr77HfxuaeQC4ybj7Prz9v9zr9SXMv3/c//Sn6FOrvi+pc91ephfg38LH73+ndlwPXv2mljvPG773ZK04+2fRjxxYmIbuzDnutPN34yIP7rp4z/5y+9/OqgtvRXEdfjTt/4vbEW2o3thdbe/s2Nxsp6bb22tbx8e+n24lu33lxeyOeoFwaPBn+/c+P5QW1Z/2eif/8rj+n/V0/Z/1//970ffuWE+F9/rV/8Urx0QvxsTPzaKeOvzPy2Mqgti782oP+Pe/1vnDL+J3/Zf2TZcABgdFp7+5sr9Xpt51kvzJY7Hboo+SicRyF7hS9AGn0L3xpWrMno3/Sz1zqnwLGmNH2iWIOuGE9j1g24CI5O+oj4z6iTAQAAAAAAAAAAAAAA+hrGN5ZG3UcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAur/8HAAD//5enzt4=") bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a000000080000000200000fffffffff0e00000000000000030000000700000003000000fdffffff00000000000000002e000af661a3902707559757c004de957f80f8c0bfc6d024d9d21b27f504374f1c364bb559daf1302bd4c726b70b18ee55c99a2cc625af85b48bb2b72383943a3f25764fdfc3a127314ce78f92e1adcd67abca6f1c0111fed36d819a10200f523fcb367af66fc2c5cfa63c9eda16fdd75666b1720f662579add5dd7c48643147599f1520922dd16f5b72d5ec217db73d11341c028bcb4d6fbe83750fb49ab4e8516e8eccd61ac678c0"], &(0x7f0000000040)=""/249, 0x46, 0x8c, 0x6}, 0x20) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_fuse_handle_req(r3, &(0x7f0000006300)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deff00", 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x22110039, 0x1000, 0x0, 0x7ff, 0x58, 0x0, 0x0, 0x6, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) open$dir(&(0x7f0000000040)='./file0\x00', 0x2080, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) mkdir(&(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x100) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) request_key(&(0x7f0000000340)='user\x00', 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) timer_delete(0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000010c0)=ANY=[@ANYBLOB="94000000", @ANYRES16=r5, @ANYBLOB="010000000000000000000a0000008000048013000100"], 0x94}}, 0x0) socket$inet6(0xa, 0x3, 0x6) 0s ago: executing program 3 (id=1099): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) ioctl$KDGKBDIACR(r0, 0x4b52, &(0x7f0000000100)=""/60) kernel console output (not intermixed with test programs): 250][ T2380] gspca_sq905: sq905_command: usb_control_msg failed (-71) [ 91.361586][ T2380] sq905: probe of 1-1:0.0 failed with error -71 [ 91.387091][ T2380] usb 1-1: USB disconnect, device number 7 [ 91.422051][ T4233] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 91.436748][ T4233] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 91.448921][ T4233] usb 3-1: Product: syz [ 91.453264][ T4233] usb 3-1: Manufacturer: syz [ 91.458052][ T4233] usb 3-1: SerialNumber: syz [ 91.491547][ T5105] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 91.577080][ T5116] binder: BINDER_SET_CONTEXT_MGR already set [ 91.584331][ T5116] binder: 5115:5116 ioctl 4018620d 200000004a80 returned -16 [ 91.715329][ T5105] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 92.785346][ T13] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 92.901295][ T4233] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 92.931242][ T4233] asix: probe of 3-1:2.88 failed with error -71 [ 92.956856][ T4233] usb 3-1: USB disconnect, device number 7 [ 93.254868][ T5157] binder: BINDER_SET_CONTEXT_MGR already set [ 93.278509][ T5157] binder: 5156:5157 ioctl 4018620d 200000004a80 returned -16 [ 93.432196][ T13] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 93.461677][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.480149][ T13] usb 5-1: Product: syz [ 93.485092][ T13] usb 5-1: Manufacturer: syz [ 93.517699][ T13] usb 5-1: SerialNumber: syz [ 93.537635][ T13] usb 5-1: config 0 descriptor?? [ 93.542962][ T7] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 93.931399][ T7] usb 4-1: unable to get BOS descriptor or descriptor too short [ 94.012253][ T7] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 94.031409][ T13] usb 5-1: atusb_control_msg: req 0x21 val 0x0 idx 0x1e, error -71 [ 94.042917][ T7] usb 4-1: can't read configurations, error -71 [ 94.062480][ T13] usb 5-1: Firmware version (0.0) predates our first public release. [ 94.104797][ T13] usb 5-1: Please update to version 0.2 or newer [ 94.139472][ T13] usb 5-1: atusb_probe: initialization failed, error = -71 [ 94.182260][ T13] atusb: probe of 5-1:0.0 failed with error -71 [ 94.239394][ T13] usb 5-1: USB disconnect, device number 7 [ 95.028155][ T5191] binder: BINDER_SET_CONTEXT_MGR already set [ 95.030730][ T5200] device syzkaller0 entered promiscuous mode [ 95.065163][ T5191] binder: 5187:5191 ioctl 4018620d 200000004a80 returned -16 [ 95.103066][ T5200] tipc: Enabled bearer , priority 0 [ 95.130634][ T5199] tipc: Resetting bearer [ 95.185383][ T5199] tipc: Disabling bearer [ 95.288014][ T5213] input: syz0 as /devices/virtual/input/input8 [ 95.671184][ T21] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 96.041951][ T21] usb 4-1: unable to get BOS descriptor or descriptor too short [ 96.110903][ T5240] device syzkaller0 entered promiscuous mode [ 96.111388][ T21] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 96.127087][ T5240] tipc: Enabled bearer , priority 0 [ 96.134890][ T21] usb 4-1: can't read configurations, error -71 [ 96.156337][ T5239] tipc: Resetting bearer [ 96.178993][ T5239] tipc: Disabling bearer [ 96.344777][ T5250] tipc: Enabled bearer , priority 0 [ 96.352833][ T5250] device syzkaller0 entered promiscuous mode [ 96.364332][ T5250] tipc: Resetting bearer [ 96.404821][ T5249] tipc: Resetting bearer [ 96.420358][ T5249] tipc: Disabling bearer [ 96.751154][ T4310] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 96.764317][ T5275] device syzkaller0 entered promiscuous mode [ 96.782780][ T5275] tipc: Started in network mode [ 96.816528][ T5275] tipc: Node identity 029916fe6d9e, cluster identity 4711 [ 96.836428][ T5275] tipc: Enabled bearer , priority 0 [ 96.859926][ T5274] tipc: Resetting bearer [ 96.903180][ T5274] tipc: Disabling bearer [ 97.001143][ T4310] usb 2-1: Using ep0 maxpacket: 32 [ 97.131757][ T4310] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 97.148195][ T4310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.173087][ T4310] usb 2-1: config 0 descriptor?? [ 97.214518][ T4310] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 97.317370][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.323859][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.329977][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.336126][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.342240][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.348341][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.354488][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.359503][ T5290] tipc: Enabled bearer , priority 0 [ 97.360560][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.373445][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.374790][ T5290] device syzkaller0 entered promiscuous mode [ 97.379534][ T5286] tc action pedit 'at' offset 5 out of bounds [ 97.379763][ T5286] 0: reclassify loop, rule prio 0, protocol 800 [ 97.408080][ T5290] tipc: Resetting bearer [ 97.420278][ T5289] tipc: Resetting bearer [ 97.437386][ T5289] tipc: Disabling bearer [ 97.624147][ T5304] input: syz1 as /devices/virtual/input/input9 [ 99.191198][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.641333][ T4310] gspca_vc032x: reg_w err -71 [ 100.646295][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.820069][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.826742][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.832130][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.837527][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.842896][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.848325][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.853876][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.859259][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.864604][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.869963][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.875320][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.880700][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.886072][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.891660][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.896958][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.898329][ T5331] binder: BINDER_SET_CONTEXT_MGR already set [ 100.903287][ T4310] gspca_vc032x: I2c Bus Busy Wait 00 [ 100.914044][ T4310] gspca_vc032x: Unknown sensor... [ 100.918599][ T5331] binder: 5330:5331 ioctl 4018620d 200000004a80 returned -16 [ 100.919132][ T4310] vc032x: probe of 2-1:0.0 failed with error -22 [ 100.935860][ T4310] usb 2-1: USB disconnect, device number 6 [ 101.061138][ T1109] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 101.128528][ T5341] tipc: Enabled bearer , priority 0 [ 101.167680][ T5341] device syzkaller0 entered promiscuous mode [ 101.206295][ T5341] tipc: Resetting bearer [ 101.215442][ T5339] tipc: Resetting bearer [ 101.228202][ T5339] tipc: Disabling bearer [ 101.301271][ T1109] usb 4-1: Using ep0 maxpacket: 8 [ 101.421296][ T1109] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.432794][ T1109] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.442824][ T1109] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 101.455824][ T1109] usb 4-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 101.465287][ T1109] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.474703][ T1109] usb 4-1: config 0 descriptor?? [ 101.531202][ T4310] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 101.538859][ T4233] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 101.821161][ T4310] usb 2-1: Using ep0 maxpacket: 16 [ 101.941348][ T4233] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 101.949600][ T4233] usb 3-1: config 0 has no interface number 0 [ 101.964082][ T1109] dragonrise 0003:0079:0006.0007: unknown main item tag 0x0 [ 101.990405][ T1109] dragonrise 0003:0079:0006.0007: unknown main item tag 0x0 [ 102.002682][ T1109] dragonrise 0003:0079:0006.0007: unknown main item tag 0x0 [ 102.010029][ T1109] dragonrise 0003:0079:0006.0007: unknown main item tag 0x0 [ 102.034014][ T1109] dragonrise 0003:0079:0006.0007: unknown main item tag 0x0 [ 102.043380][ T1109] dragonrise 0003:0079:0006.0007: unbalanced collection at end of report description [ 102.056541][ T1109] dragonrise 0003:0079:0006.0007: parse failed [ 102.059307][ T5355] device syzkaller0 entered promiscuous mode [ 102.062834][ T1109] dragonrise: probe of 0003:0079:0006.0007 failed with error -22 [ 102.111384][ T4310] usb 2-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 102.121360][ T4233] usb 3-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 102.131836][ T4233] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.139924][ T4310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.161836][ T4233] usb 3-1: Product: syz [ 102.166033][ T4233] usb 3-1: Manufacturer: syz [ 102.170636][ T4233] usb 3-1: SerialNumber: syz [ 102.176150][ T4310] usb 2-1: Product: syz [ 102.180341][ T4310] usb 2-1: Manufacturer: syz [ 102.185612][ T4310] usb 2-1: SerialNumber: syz [ 102.209823][ T4310] usb 2-1: config 0 descriptor?? [ 102.216202][ T4233] usb 3-1: config 0 descriptor?? [ 102.263197][ T4233] usb 3-1: selecting invalid altsetting 1 [ 102.271435][ T4310] ssu100 2-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 102.528316][ T4233] dvb_ttusb_budget: ttusb_init_controller: error [ 102.535175][ T4233] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 102.607805][ T4233] DVB: Unable to find symbol stv0299_attach() [ 102.658118][ T4233] DVB: Unable to find symbol tda8083_attach() [ 102.667346][ T4233] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 102.672028][ T7] usb 4-1: USB disconnect, device number 9 [ 102.689184][ T4233] usb 3-1: USB disconnect, device number 8 [ 102.880844][ T5375] binder: BINDER_SET_CONTEXT_MGR already set [ 102.907564][ T5375] binder: 5374:5375 ioctl 4018620d 200000004a80 returned -16 [ 103.124168][ T5393] tipc: Enabled bearer , priority 0 [ 103.134916][ T5393] device syzkaller0 entered promiscuous mode [ 103.179041][ T5393] tipc: Resetting bearer [ 103.249673][ T5392] tipc: Resetting bearer [ 103.320832][ T5392] tipc: Disabling bearer [ 103.591295][ T4233] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 103.671684][ T4310] ssu100: probe of 2-1:0.0 failed with error -71 [ 103.685320][ T4310] usb 2-1: USB disconnect, device number 7 [ 103.841166][ T4233] usb 3-1: Using ep0 maxpacket: 8 [ 103.961290][ T4233] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.983050][ T4233] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.016064][ T4233] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 104.021357][ T5423] netlink: 'syz.0.377': attribute type 2 has an invalid length. [ 104.030091][ T4233] usb 3-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 104.049572][ T4233] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.059034][ T5423] netlink: 119 bytes leftover after parsing attributes in process `syz.0.377'. [ 104.075710][ T4233] usb 3-1: config 0 descriptor?? [ 104.332446][ T4310] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 104.366056][ T1109] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 104.563064][ T4233] dragonrise 0003:0079:0006.0008: unknown main item tag 0x0 [ 104.570668][ T4233] dragonrise 0003:0079:0006.0008: unknown main item tag 0x0 [ 104.578792][ T4233] dragonrise 0003:0079:0006.0008: unknown main item tag 0x0 [ 104.587652][ T4233] dragonrise 0003:0079:0006.0008: unknown main item tag 0x0 [ 104.595276][ T4233] dragonrise 0003:0079:0006.0008: unknown main item tag 0x0 [ 104.602818][ T26] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 104.610397][ T4233] dragonrise 0003:0079:0006.0008: unbalanced collection at end of report description [ 104.620999][ T4233] dragonrise 0003:0079:0006.0008: parse failed [ 104.627444][ T4233] dragonrise: probe of 0003:0079:0006.0008 failed with error -22 [ 104.691425][ T4310] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 104.700296][ T4310] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 104.710848][ T4310] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 104.720045][ T4310] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 104.731439][ T4310] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 104.771237][ T1109] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.781655][ T1109] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 104.790666][ T1109] usb 1-1: config 1 has no interface number 0 [ 104.797833][ T1109] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 104.809216][ T1109] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 104.820060][ T1109] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 104.829265][ T1109] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 104.861266][ T4310] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 104.870549][ T4310] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 104.878883][ T4310] usb 4-1: Product: syz [ 104.883433][ T4310] usb 4-1: Manufacturer: syz [ 104.932635][ T4310] cdc_wdm 4-1:1.0: skipping garbage [ 104.938037][ T4310] cdc_wdm 4-1:1.0: skipping garbage [ 104.947624][ T4310] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 104.953900][ T4310] cdc_wdm 4-1:1.0: Unknown control protocol [ 104.971174][ T26] usb 5-1: unable to get BOS descriptor or descriptor too short [ 105.031215][ T26] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 105.031303][ T1109] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 105.039084][ T26] usb 5-1: can't read configurations, error -71 [ 105.048084][ T1109] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.048108][ T1109] usb 1-1: Product: syz [ 105.048119][ T1109] usb 1-1: Manufacturer: syz [ 105.072389][ T1109] usb 1-1: SerialNumber: syz [ 105.091454][ T5426] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 105.270895][ T4228] usb 3-1: USB disconnect, device number 9 [ 105.296826][ T5445] input: syz1 as /devices/virtual/input/input10 [ 105.371406][ T13] usb 4-1: USB disconnect, device number 10 [ 105.379762][ T5447] tipc: Enabled bearer , priority 0 [ 105.393805][ T5447] device syzkaller0 entered promiscuous mode [ 105.412591][ T5447] tipc: Resetting bearer [ 105.420255][ T5446] tipc: Resetting bearer [ 105.435270][ T5446] tipc: Disabling bearer [ 105.581221][ T1109] cdc_ncm 1-1:1.1: bind() failure [ 105.593400][ T1109] usb 1-1: USB disconnect, device number 8 [ 105.917412][ T4189] Bluetooth: hci0: unknown advertising packet type: 0x71 [ 105.917471][ T4189] Bluetooth: hci0: Malicious advertising data. [ 106.329292][ T5483] tipc: Cannot configure node identity twice [ 106.448988][ T5489] device syzkaller0 entered promiscuous mode [ 106.471904][ T4228] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 106.500850][ T5489] tipc: Enabled bearer , priority 0 [ 106.524372][ T5488] tipc: Resetting bearer [ 106.550007][ T5488] tipc: Disabling bearer [ 106.634005][ T5500] netlink: 'syz.3.406': attribute type 2 has an invalid length. [ 106.653558][ T5500] netlink: 119 bytes leftover after parsing attributes in process `syz.3.406'. [ 106.674636][ T5504] netlink: 16 bytes leftover after parsing attributes in process `syz.1.408'. [ 106.731643][ T4228] usb 1-1: Using ep0 maxpacket: 8 [ 106.883779][ T4228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.913939][ T4228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.941318][ T13] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 106.971345][ T1109] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 106.993190][ T4228] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 107.078841][ T4228] usb 1-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 107.180721][ T4228] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.372014][ T13] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 107.372177][ T1109] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 107.391340][ T13] usb 5-1: config 0 has no interface number 0 [ 107.451873][ T4228] usb 1-1: config 0 descriptor?? [ 107.580660][ T1109] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 107.593561][ T13] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 107.595618][ T5513] input: syz1 as /devices/virtual/input/input11 [ 107.627329][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.635985][ T1109] usb 4-1: config 1 has no interface number 0 [ 107.642544][ T13] usb 5-1: Product: syz [ 107.647656][ T1109] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 107.660122][ T13] usb 5-1: Manufacturer: syz [ 107.664774][ T13] usb 5-1: SerialNumber: syz [ 107.669966][ T1109] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 107.682324][ T13] usb 5-1: config 0 descriptor?? [ 107.687414][ T1109] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 107.696779][ T1109] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 107.924713][ T1109] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 107.934107][ T1109] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.942219][ T1109] usb 4-1: Product: syz [ 107.946575][ T1109] usb 4-1: Manufacturer: syz [ 107.951254][ T1109] usb 4-1: SerialNumber: syz [ 107.971442][ T5500] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 108.031195][ T2380] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 108.032775][ T4228] dragonrise 0003:0079:0006.0009: unknown main item tag 0x0 [ 108.046516][ T4228] dragonrise 0003:0079:0006.0009: unknown main item tag 0x0 [ 108.054069][ T4228] dragonrise 0003:0079:0006.0009: unknown main item tag 0x0 [ 108.061649][ T4228] dragonrise 0003:0079:0006.0009: unknown main item tag 0x0 [ 108.069541][ T4228] dragonrise 0003:0079:0006.0009: unknown main item tag 0x0 [ 108.077248][ T4228] dragonrise 0003:0079:0006.0009: unbalanced collection at end of report description [ 108.090117][ T4228] dragonrise 0003:0079:0006.0009: parse failed [ 108.096447][ T4228] dragonrise: probe of 0003:0079:0006.0009 failed with error -22 [ 108.136963][ T5519] netlink: 8 bytes leftover after parsing attributes in process `syz.4.407'. [ 108.451900][ T1109] cdc_ncm 4-1:1.1: bind() failure [ 108.468347][ T1109] usb 4-1: USB disconnect, device number 11 [ 108.551367][ T2380] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 108.560749][ T2380] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.575066][ T2380] usb 2-1: Product: syz [ 108.579314][ T2380] usb 2-1: Manufacturer: syz [ 108.587813][ T2380] usb 2-1: SerialNumber: syz [ 108.600187][ T2380] usb 2-1: config 0 descriptor?? [ 108.741662][ T4233] usb 1-1: USB disconnect, device number 9 [ 108.826744][ T5528] tipc: Enabled bearer , priority 0 [ 108.835067][ T5528] device syzkaller0 entered promiscuous mode [ 108.854305][ T2380] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 108.866413][ T5528] tipc: Resetting bearer [ 108.883709][ T5527] tipc: Resetting bearer [ 108.897139][ T5527] tipc: Disabling bearer [ 109.134291][ T5538] device syzkaller0 entered promiscuous mode [ 109.187920][ T5538] tipc: Enabled bearer , priority 0 [ 109.209549][ T5537] tipc: Resetting bearer [ 109.234206][ T5537] tipc: Disabling bearer [ 109.682166][ T13] asix: probe of 5-1:0.251 failed with error -71 [ 109.733740][ T13] usb 5-1: USB disconnect, device number 10 [ 109.954781][ T5559] netlink: 'syz.4.427': attribute type 2 has an invalid length. [ 109.979011][ T5559] netlink: 119 bytes leftover after parsing attributes in process `syz.4.427'. [ 110.019957][ T5563] tipc: Enabled bearer , priority 0 [ 110.028954][ T5563] device syzkaller0 entered promiscuous mode [ 110.079797][ T5563] tipc: Resetting bearer [ 110.120111][ T5562] tipc: Resetting bearer [ 110.152418][ T5562] tipc: Disabling bearer [ 110.811149][ T26] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 110.846467][ T4229] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 110.972448][ T4228] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 111.061162][ T26] usb 4-1: Using ep0 maxpacket: 32 [ 111.104900][ T4229] usb 5-1: Using ep0 maxpacket: 8 [ 111.181435][ T26] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 111.206373][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.232648][ T26] usb 4-1: config 0 descriptor?? [ 111.273559][ T26] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 111.281439][ T4229] usb 5-1: unable to get BOS descriptor or descriptor too short [ 111.371356][ T2380] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -71 [ 111.381577][ T4229] usb 5-1: config 4 has an invalid interface number: 147 but max is 0 [ 111.399246][ T4229] usb 5-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 111.408614][ T4228] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 111.409252][ T2380] usb 2-1: USB disconnect, device number 8 [ 111.417058][ T4229] usb 5-1: config 4 has no interface number 0 [ 111.417182][ T4228] usb 3-1: config 0 has no interface number 0 [ 111.579031][ T5599] input: syz1 as /devices/virtual/input/input12 [ 111.591581][ T4229] usb 5-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 111.607271][ T4229] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.616140][ T4229] usb 5-1: Product: syz [ 111.620563][ T4229] usb 5-1: Manufacturer: syz [ 111.625908][ T4229] usb 5-1: SerialNumber: syz [ 111.641852][ T4228] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 111.651506][ T4228] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.660536][ T4228] usb 3-1: Product: syz [ 111.665822][ T4228] usb 3-1: Manufacturer: syz [ 111.670617][ T4228] usb 3-1: SerialNumber: syz [ 111.678581][ T4228] usb 3-1: config 0 descriptor?? [ 111.878972][ T5575] binder: 5574:5575 ioctl c0306201 0 returned -14 [ 111.898562][ T5602] device syzkaller0 entered promiscuous mode [ 111.925014][ T5602] tipc: Enabled bearer , priority 0 [ 111.969727][ T5601] tipc: Resetting bearer [ 112.006966][ T5601] tipc: Disabling bearer [ 112.033705][ T5604] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 112.158396][ T5607] netlink: 8 bytes leftover after parsing attributes in process `syz.1.443'. [ 112.179793][ T5603] netlink: 8 bytes leftover after parsing attributes in process `syz.2.435'. [ 112.271416][ T4229] usb 5-1: Found UVC 0.02 device syz (04f2:b746) [ 112.285078][ T4229] usb 5-1: No valid video chain found. [ 112.320459][ T4229] usb 5-1: USB disconnect, device number 11 [ 112.939637][ T5626] tipc: Enabled bearer , priority 0 [ 112.960355][ T5626] device syzkaller0 entered promiscuous mode [ 113.017024][ T5626] tipc: Resetting bearer [ 113.047147][ T5625] tipc: Resetting bearer [ 113.079743][ T5625] tipc: Disabling bearer [ 113.174827][ T5629] usb usb7: usbfs: process 5629 (syz.4.450) did not claim interface 0 before use [ 113.440177][ T5633] netlink: 'syz.1.453': attribute type 2 has an invalid length. [ 113.466547][ T5633] netlink: 119 bytes leftover after parsing attributes in process `syz.1.453'. [ 113.721350][ T4228] asix: probe of 3-1:0.251 failed with error -71 [ 113.753444][ T4228] usb 3-1: USB disconnect, device number 10 [ 113.911539][ T26] gspca_vc032x: reg_r err -32 [ 113.923688][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 113.940945][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 113.958042][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 113.973678][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 113.986378][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.000278][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.014941][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.038023][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.051534][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.067171][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.099973][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.108735][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.123733][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.129854][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.152186][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.157625][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.164358][ T26] gspca_vc032x: I2c Bus Busy Wait 00 [ 114.169786][ T26] gspca_vc032x: Unknown sensor... [ 114.175136][ T26] vc032x: probe of 4-1:0.0 failed with error -22 [ 114.334203][ T5661] tipc: Enabled bearer , priority 0 [ 114.343402][ T5661] device syzkaller0 entered promiscuous mode [ 114.358891][ T5661] tipc: Resetting bearer [ 114.366382][ T5660] tipc: Resetting bearer [ 114.378628][ T5660] tipc: Disabling bearer [ 114.401165][ T4228] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 114.751361][ T4229] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 114.791316][ T4228] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 114.800179][ T4228] usb 1-1: config 0 has no interface number 0 [ 114.807508][ T4228] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.819350][ T4228] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.833028][ T4228] usb 1-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 114.843681][ T4228] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.859304][ T4228] usb 1-1: config 0 descriptor?? [ 115.171439][ T4229] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 115.180059][ T4229] usb 2-1: config 0 has no interface number 0 [ 115.365184][ T4228] input: HID 04d9:a055 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.1/0003:04D9:A055.000A/input/input13 [ 115.376913][ T4229] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 115.386208][ T4229] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.394245][ T4229] usb 2-1: Product: syz [ 115.398421][ T4229] usb 2-1: Manufacturer: syz [ 115.403084][ T4229] usb 2-1: SerialNumber: syz [ 115.408815][ T4229] usb 2-1: config 0 descriptor?? [ 115.411195][ T4310] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 115.455182][ T4229] usb 2-1: selecting invalid altsetting 1 [ 115.461546][ T4229] dvb_ttusb_budget: ttusb_init_controller: error [ 115.467996][ T4229] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 115.486917][ T4228] holtek_kbd 0003:04D9:A055.000A: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.0-1/input1 [ 115.513949][ T4229] DVB: Unable to find symbol stv0299_attach() [ 115.565587][ T21] usb 4-1: USB disconnect, device number 12 [ 115.587275][ T1109] usb 1-1: USB disconnect, device number 10 [ 115.612748][ T4229] DVB: Unable to find symbol tda8083_attach() [ 115.619483][ T4229] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 115.672916][ T5670] fido_id[5670]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 115.712805][ T26] usb 2-1: USB disconnect, device number 9 [ 115.781608][ T4310] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 115.793805][ T4310] usb 3-1: config 0 has no interface number 0 [ 116.161397][ T4310] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 116.170494][ T4310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.180526][ T4310] usb 3-1: Product: syz [ 116.190650][ T4310] usb 3-1: Manufacturer: syz [ 116.196969][ T4310] usb 3-1: SerialNumber: syz [ 116.259288][ T4310] usb 3-1: config 0 descriptor?? [ 116.367463][ T26] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 116.751808][ T26] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 116.786224][ T26] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 116.800511][ T26] usb 5-1: config 1 has no interface number 0 [ 116.832879][ T26] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 116.881591][ T26] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 116.990820][ T26] usb 5-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 117.062311][ T26] usb 5-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.161116][ T1109] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 117.291475][ T26] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 117.300894][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.316220][ T26] usb 5-1: Product: syz [ 117.320417][ T26] usb 5-1: Manufacturer: syz [ 117.327552][ T26] usb 5-1: SerialNumber: syz [ 117.362578][ T5679] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 117.534519][ T4233] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 117.571886][ T1109] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 117.589783][ T1109] usb 4-1: config 0 has no interface number 0 [ 117.598680][ T1109] usb 4-1: config 0 interface 8 altsetting 0 has an invalid endpoint with address 0x9F, skipping [ 117.626903][ T5728] IPVS: dh: FWM 3 0x00000003 - no destination available [ 117.689993][ T5730] netlink: 76 bytes leftover after parsing attributes in process `syz.0.488'. [ 117.732080][ T1109] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 117.736922][ T5732] input: syz1 as /devices/virtual/input/input14 [ 117.748930][ T1109] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 117.762311][ T1109] usb 4-1: Product: syz [ 117.771548][ T1109] usb 4-1: SerialNumber: syz [ 117.790831][ T1109] usb 4-1: config 0 descriptor?? [ 117.853364][ T1109] usbhid 4-1:0.8: couldn't find an input interrupt endpoint [ 117.901328][ T4233] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 117.909411][ T4233] usb 2-1: config 0 has no interface number 0 [ 117.926884][ T4233] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.945817][ T4233] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.966119][ T4233] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 117.990500][ T4233] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.033853][ T4233] usb 2-1: config 0 descriptor?? [ 118.041248][ T26] cdc_ncm 5-1:1.1: bind() failure [ 118.056695][ T26] usb 5-1: USB disconnect, device number 12 [ 118.195370][ T4310] asix: probe of 3-1:0.251 failed with error -71 [ 118.240541][ T4310] usb 3-1: USB disconnect, device number 11 [ 118.299915][ T1109] usb 4-1: USB disconnect, device number 13 [ 118.520843][ T4233] input: HID 04d9:a055 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.1/0003:04D9:A055.000B/input/input15 [ 118.606379][ T4233] holtek_kbd 0003:04D9:A055.000B: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.1-1/input1 [ 118.748158][ T4229] usb 2-1: USB disconnect, device number 10 [ 119.007189][ T5744] fido_id[5744]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 119.142961][ T5752] tipc: Enabled bearer , priority 0 [ 119.157701][ T5752] device syzkaller0 entered promiscuous mode [ 119.208336][ T5752] tipc: Resetting bearer [ 119.266222][ T5751] tipc: Resetting bearer [ 119.304452][ T5751] tipc: Disabling bearer [ 119.363711][ T5756] kvm [5755]: vcpu2, guest rIP: 0x18e vmx_set_msr: BTF|LBR in IA32_DEBUGCTLMSR 0xa, nop [ 119.621376][ T4233] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 119.771161][ T4229] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 119.881145][ T4233] usb 3-1: Using ep0 maxpacket: 16 [ 120.001364][ T4233] usb 3-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 180, changing to 11 [ 120.027993][ T4233] usb 3-1: config 0 interface 0 has no altsetting 0 [ 120.049911][ T4233] usb 3-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 120.059412][ T4233] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.120966][ T4233] usb 3-1: config 0 descriptor?? [ 120.171313][ T4229] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.410715][ T4229] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 120.420163][ T4229] usb 1-1: config 1 has no interface number 0 [ 120.426710][ T4229] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 120.438889][ T4229] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 120.450438][ T4229] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 120.460610][ T4229] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 120.601325][ T4233] usbhid 3-1:0.0: can't add hid device: -71 [ 120.607617][ T4233] usbhid: probe of 3-1:0.0 failed with error -71 [ 120.644091][ T4229] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 120.648597][ T4233] usb 3-1: USB disconnect, device number 12 [ 120.660789][ T4229] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.681134][ T4229] usb 1-1: Product: syz [ 120.699015][ T4229] usb 1-1: Manufacturer: syz [ 120.711078][ T4229] usb 1-1: SerialNumber: syz [ 120.741375][ T5774] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 121.073626][ T5806] tipc: Enabled bearer , priority 0 [ 121.081865][ T5806] device syzkaller0 entered promiscuous mode [ 121.098246][ T5806] tipc: Resetting bearer [ 121.106222][ T5805] tipc: Resetting bearer [ 121.118290][ T5805] tipc: Disabling bearer [ 121.241213][ T4233] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 121.431506][ T4229] cdc_ncm 1-1:1.1: bind() failure [ 121.452113][ T4229] usb 1-1: USB disconnect, device number 11 [ 121.623923][ T4233] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 121.630470][ T5834] tipc: Enabled bearer , priority 0 [ 121.632399][ T4233] usb 4-1: config 0 has no interface number 0 [ 121.642542][ T5834] device syzkaller0 entered promiscuous mode [ 121.648282][ T4233] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.665390][ T4233] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 121.668296][ T5834] tipc: Resetting bearer [ 121.675583][ T4233] usb 4-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 121.696435][ T4233] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.707490][ T5832] tipc: Resetting bearer [ 121.714205][ T4233] usb 4-1: config 0 descriptor?? [ 121.725772][ T5832] tipc: Disabling bearer [ 121.756963][ T5836] netlink: 'syz.4.525': attribute type 1 has an invalid length. [ 122.110273][ T5860] netlink: 'syz.2.532': attribute type 1 has an invalid length. [ 122.222315][ T4233] input: HID 04d9:a055 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:04D9:A055.000C/input/input16 [ 122.328367][ T4233] holtek_kbd 0003:04D9:A055.000C: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.3-1/input1 [ 122.408559][ T7] usb 4-1: USB disconnect, device number 14 [ 122.506365][ T5869] fido_id[5869]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 122.864622][ T5886] tipc: Enabled bearer , priority 0 [ 122.872837][ T5886] device syzkaller0 entered promiscuous mode [ 122.895937][ T5886] tipc: Resetting bearer [ 122.903867][ T5885] tipc: Resetting bearer [ 122.935618][ T5885] tipc: Disabling bearer [ 123.080909][ T5902] netlink: 'syz.2.545': attribute type 1 has an invalid length. [ 123.116142][ T7] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 123.251128][ T4228] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 123.411233][ T7] usb 2-1: Using ep0 maxpacket: 8 [ 123.561490][ T7] usb 2-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 123.617900][ T7] usb 2-1: config 0 interface 0 has no altsetting 0 [ 123.644068][ T7] usb 2-1: New USB device found, idVendor=05ac, idProduct=0320, bcdDevice= 0.00 [ 123.654060][ T4228] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 123.667041][ T4228] usb 5-1: config 0 has no interface number 0 [ 123.699748][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.722787][ T7] usb 2-1: config 0 descriptor?? [ 123.872337][ T4228] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 123.888146][ T4228] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.909223][ T4228] usb 5-1: Product: syz [ 123.909247][ T4228] usb 5-1: Manufacturer: syz [ 123.909262][ T4228] usb 5-1: SerialNumber: syz [ 123.913753][ T4228] usb 5-1: config 0 descriptor?? [ 124.195345][ T5927] tipc: Enabled bearer , priority 0 [ 124.209256][ T5927] device syzkaller0 entered promiscuous mode [ 124.234867][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.246360][ T4229] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 124.260310][ T5927] tipc: Resetting bearer [ 124.272136][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.279686][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.293753][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.303574][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.311488][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.318905][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.327019][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.334798][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.343222][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.359191][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.367943][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.375859][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.384058][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.391777][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.399187][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.408760][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.426738][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.443313][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.463458][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.470991][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.502441][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.510154][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.531261][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.538705][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.563521][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.580362][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.603233][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.610664][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.630896][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.638757][ T4229] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 124.651213][ T4229] usb 4-1: config 0 has no interface number 0 [ 124.664252][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.681260][ T4229] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 124.701347][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.708869][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.718688][ T4229] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 124.741317][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.749729][ T4229] usb 4-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 124.758939][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.781235][ T4229] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.789468][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.798644][ T4229] usb 4-1: config 0 descriptor?? [ 124.811073][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.818651][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.831212][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.838646][ T7] hid-generic 0003:05AC:0320.000D: unknown main item tag 0x0 [ 124.882801][ T7] hid-generic 0003:05AC:0320.000D: hidraw0: USB HID v0.81 Device [HID 05ac:0320] on usb-dummy_hcd.1-1/input0 [ 124.923697][ T7] usb 2-1: USB disconnect, device number 11 [ 124.968719][ T5926] tipc: Resetting bearer [ 124.992452][ T5926] tipc: Disabling bearer [ 125.038588][ T5929] fido_id[5929]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 125.103582][ T25] audit: type=1326 audit(1783671533.902:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5930 comm="syz.1.555" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f59b4fdde59 code=0x0 [ 125.140383][ T5933] netlink: 12 bytes leftover after parsing attributes in process `syz.2.556'. [ 125.315437][ T4229] input: HID 04d9:a055 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:04D9:A055.000E/input/input17 [ 125.438929][ T4229] holtek_kbd 0003:04D9:A055.000E: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.3-1/input1 [ 125.522284][ T7] usb 4-1: USB disconnect, device number 15 [ 125.608454][ T5936] fido_id[5936]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 126.008693][ T5940] netlink: 'syz.2.558': attribute type 1 has an invalid length. [ 126.031340][ T4228] asix: probe of 5-1:0.251 failed with error -71 [ 126.054013][ T5943] fuse: Bad value for 'group_id' [ 126.074933][ T4228] usb 5-1: USB disconnect, device number 13 [ 126.125970][ T5949] capability: warning: `syz.3.562' uses deprecated v2 capabilities in a way that may be insecure [ 126.209377][ T5951] binder: 5950:5951 ioctl 4018620d 0 returned -22 [ 126.387170][ T5963] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 126.833388][ T5983] tipc: Enabled bearer , priority 0 [ 126.840735][ T5983] device syzkaller0 entered promiscuous mode [ 126.849914][ T5983] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 126.864376][ T5983] tipc: Resetting bearer [ 126.871876][ T5982] tipc: Resetting bearer [ 126.901124][ T5982] tipc: Disabling bearer [ 126.907583][ T5985] binder: 5984:5985 ioctl 4018620d 0 returned -22 [ 126.991217][ T4228] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 127.401767][ T4228] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 127.458943][ T4228] usb 3-1: config 0 has no interface number 0 [ 127.505314][ T4228] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.535998][ T6013] fuse: Bad value for 'group_id' [ 127.545370][ T4228] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.557369][ T4228] usb 3-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 127.587090][ T4228] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.601461][ T6015] binder: 6014:6015 ioctl 4018620d 0 returned -22 [ 127.620232][ T4228] usb 3-1: config 0 descriptor?? [ 127.867841][ T6027] tipc: Enabled bearer , priority 0 [ 127.876765][ T6027] device syzkaller0 entered promiscuous mode [ 127.901940][ T6027] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 127.927689][ T6027] tipc: Resetting bearer [ 127.943914][ T6026] tipc: Resetting bearer [ 127.963779][ T6026] tipc: Disabling bearer [ 128.135301][ T4228] input: HID 04d9:a055 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.1/0003:04D9:A055.000F/input/input18 [ 128.278276][ T4228] holtek_kbd 0003:04D9:A055.000F: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.2-1/input1 [ 128.336449][ T4229] usb 3-1: USB disconnect, device number 13 [ 128.492638][ T6038] fido_id[6038]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 128.532155][ T4233] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 128.781171][ T4233] usb 1-1: Using ep0 maxpacket: 32 [ 129.050976][ T6050] binder: BINDER_SET_CONTEXT_MGR already set [ 129.061691][ T4233] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 129.070930][ T4233] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.087896][ T4233] usb 1-1: Product: syz [ 129.094690][ T6050] binder: 6049:6050 ioctl 4018620d 200000004a80 returned -16 [ 129.107401][ T4233] usb 1-1: Manufacturer: syz [ 129.113817][ T4233] usb 1-1: SerialNumber: syz [ 129.138899][ T4233] usb 1-1: config 0 descriptor?? [ 129.218082][ T4233] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 129.472510][ T6067] fuse: Bad value for 'group_id' [ 129.614286][ T6081] binder: BINDER_SET_CONTEXT_MGR already set [ 129.631591][ T6081] binder: 6080:6081 ioctl 4018620d 200000004a80 returned -16 [ 129.841594][ T4228] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 129.871190][ T4233] gspca_ov534_9: reg_w failed -71 [ 130.241271][ T4228] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 130.252433][ T4228] usb 5-1: config 0 has no interface number 0 [ 130.258562][ T4228] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.261100][ T4233] gspca_ov534_9: Unknown sensor 0000 [ 130.280809][ T4228] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.286521][ T4233] ov534_9: probe of 1-1:0.0 failed with error -22 [ 130.330150][ T4228] usb 5-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 130.349672][ T4228] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.358277][ T4233] usb 1-1: USB disconnect, device number 12 [ 130.396716][ T4228] usb 5-1: config 0 descriptor?? [ 130.474683][ T6088] kvm [6087]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x1226 [ 130.487218][ T6088] kvm [6087]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 130.500952][ T6088] kvm [6087]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x26aa [ 130.513778][ T6088] kvm [6087]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 130.548492][ T6088] kvm [6087]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x5a2f [ 130.565395][ T6088] kvm [6087]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 130.581996][ T6088] kvm [6087]: vcpu0, guest rIP: 0x18e ignored wrmsr: 0x11e data 0xa52b [ 130.593824][ T6088] kvm [6087]: vcpu0, guest rIP: 0x1b8 ignored wrmsr: 0x11e data 0xbe702111 [ 130.701090][ T26] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 130.939288][ T4228] input: HID 04d9:a055 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.1/0003:04D9:A055.0010/input/input19 [ 131.050691][ T4228] holtek_kbd 0003:04D9:A055.0010: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.4-1/input1 [ 131.063302][ T26] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.111181][ T7] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 131.143065][ T4228] usb 5-1: USB disconnect, device number 14 [ 131.221459][ T26] usb 3-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 131.239134][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.266777][ T6103] fido_id[6103]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 131.282704][ T26] usb 3-1: Product: syz [ 131.286889][ T26] usb 3-1: Manufacturer: syz [ 131.301165][ T26] usb 3-1: SerialNumber: syz [ 131.307565][ T26] usb 3-1: config 0 descriptor?? [ 131.373008][ T26] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 131.422288][ T6112] binder: BINDER_SET_CONTEXT_MGR already set [ 131.428570][ T6112] binder: 6111:6112 ioctl 4018620d 200000004a80 returned -16 [ 131.551276][ T7] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 131.559514][ T7] usb 4-1: config 0 has no interface number 0 [ 131.771325][ T7] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 131.780482][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.808138][ T7] usb 4-1: Product: syz [ 131.816137][ T7] usb 4-1: Manufacturer: syz [ 131.820813][ T7] usb 4-1: SerialNumber: syz [ 131.837216][ T7] usb 4-1: config 0 descriptor?? [ 131.958790][ T6128] netlink: 71 bytes leftover after parsing attributes in process `syz.1.628'. [ 132.221361][ T6132] netlink: 8 bytes leftover after parsing attributes in process `syz.3.618'. [ 132.531188][ T21] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 132.533792][ T6141] binder: 6140:6141 ioctl c0306201 0 returned -14 [ 132.699380][ T6146] netlink: 'syz.4.635': attribute type 1 has an invalid length. [ 132.724302][ T1425] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.730692][ T1425] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.781248][ T21] usb 2-1: Using ep0 maxpacket: 8 [ 132.811133][ T26] gspca_pac7302: reg_w() failed i: 78 v: 40 error -110 [ 132.818683][ T26] gspca_pac7302: probe of 3-1:0.0 failed with error -110 [ 132.908865][ T21] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 132.929754][ T21] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 132.941793][ T21] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 132.955098][ T21] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 132.955142][ T21] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 132.955160][ T21] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.018267][ T4233] usb 3-1: USB disconnect, device number 14 [ 133.231252][ T21] usb 2-1: GET_CAPABILITIES returned 0 [ 133.236871][ T21] usbtmc 2-1:16.0: can't read capabilities [ 133.281144][ T26] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 133.582151][ T6161] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4193] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6161] [ 133.596578][ T4231] usb 2-1: USB disconnect, device number 12 [ 133.611191][ T21] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 133.661417][ T26] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 133.692929][ T26] usb 1-1: config 0 has no interface number 0 [ 133.699058][ T26] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.731573][ T26] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 133.751181][ T26] usb 1-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 133.760251][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.783373][ T26] usb 1-1: config 0 descriptor?? [ 133.828159][ T7] asix: probe of 4-1:0.251 failed with error -71 [ 133.844181][ T7] usb 4-1: USB disconnect, device number 16 [ 133.971296][ T21] usb 3-1: config 34 has an invalid interface number: 116 but max is 0 [ 133.981252][ T21] usb 3-1: config 34 has no interface number 0 [ 133.987518][ T21] usb 3-1: config 34 interface 116 has no altsetting 0 [ 134.152382][ T21] usb 3-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=32.4c [ 134.167159][ T21] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.188837][ T21] usb 3-1: Product: syz [ 134.194051][ T21] usb 3-1: Manufacturer: syz [ 134.199399][ T21] usb 3-1: SerialNumber: syz [ 134.285700][ T26] input: HID 04d9:a055 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.1/0003:04D9:A055.0011/input/input20 [ 134.366760][ T26] holtek_kbd 0003:04D9:A055.0011: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.0-1/input1 [ 134.395636][ T6170] fuse: Bad value for 'fd' [ 134.478616][ T26] usb 1-1: USB disconnect, device number 13 [ 134.681400][ T7] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 134.890167][ T6190] binder: BINDER_SET_CONTEXT_MGR already set [ 134.902255][ T6190] binder: 6189:6190 ioctl 4018620d 200000004a80 returned -16 [ 135.076458][ T7] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 135.100288][ T6204] netlink: 'syz.1.652': attribute type 1 has an invalid length. [ 135.106061][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 135.149806][ T7] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 135.181354][ T7] usb 4-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 135.189221][ T6210] input: syz1 as /devices/virtual/input/input21 [ 135.190686][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.238254][ T7] usb 4-1: config 0 descriptor?? [ 135.271448][ T6170] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 135.465614][ T6228] capability: warning: `syz.2.657' uses 32-bit capabilities (legacy support in use) [ 135.531334][ T21] comedi comedi5: could not set alternate setting 3 in high speed [ 135.541776][ T21] usbdux 3-1:34.116: driver 'usbdux' failed to auto-configure device. [ 135.555068][ T21] usbdux: probe of 3-1:34.116 failed with error -71 [ 135.579754][ T21] usb 3-1: USB disconnect, device number 15 [ 135.990136][ T25] audit: type=1804 audit(1783671544.782:3): pid=6247 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.660" name="file0" dev="ramfs" ino=45374 res=1 errno=0 [ 136.083850][ T6243] binder: BINDER_SET_CONTEXT_MGR already set [ 136.089867][ T6243] binder: 6241:6243 ioctl 4018620d 200000004a80 returned -16 [ 136.134763][ T6256] netlink: 8 bytes leftover after parsing attributes in process `syz.2.663'. [ 136.167784][ T7] usbhid 4-1:0.0: can't add hid device: -71 [ 136.175321][ T7] usbhid: probe of 4-1:0.0 failed with error -71 [ 136.175381][ T6256] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 136.191310][ T6256] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 136.200138][ T6256] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 136.208938][ T6256] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 136.227912][ T7] usb 4-1: USB disconnect, device number 17 [ 136.337220][ T6256] device vxlan0 entered promiscuous mode [ 136.376490][ T6259] netlink: 4 bytes leftover after parsing attributes in process `syz.3.664'. [ 136.416765][ T6259] device batadv0 entered promiscuous mode [ 136.428723][ T6259] device macvtap1 entered promiscuous mode [ 136.447334][ T6259] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 136.494635][ T6266] netlink: 8 bytes leftover after parsing attributes in process `syz.2.663'. [ 136.556718][ T6268] device batadv0 left promiscuous mode [ 136.581712][ T6280] netlink: 'syz.0.669': attribute type 1 has an invalid length. [ 136.616677][ T6268] device macvtap1 left promiscuous mode [ 136.966311][ T6292] input: syz1 as /devices/virtual/input/input22 [ 137.118244][ T6302] netlink: 8 bytes leftover after parsing attributes in process `syz.4.674'. [ 137.188892][ T6306] program syz.1.671 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 137.531302][ T4228] usb 5-1: new low-speed USB device number 15 using dummy_hcd [ 137.682887][ T7] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 137.981156][ T4228] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 137.995481][ T4228] usb 5-1: config 179 has no interface number 0 [ 138.015347][ T4228] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 138.057703][ T4228] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 8 [ 138.093783][ T4228] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 138.138694][ T4228] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 45824, setting to 8 [ 138.161207][ T4228] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 138.255518][ T4228] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 138.531126][ T4228] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.561335][ T6311] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 138.569340][ T6354] tipc: Enabled bearer , priority 0 [ 138.586326][ T6311] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 138.674127][ T6360] device syzkaller0 entered promiscuous mode [ 138.707199][ T6354] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 138.770754][ T6360] tipc: Resetting bearer [ 138.862265][ T6351] tipc: Resetting bearer [ 138.867916][ T6368] xt_CT: You must specify a L4 protocol and not use inversions on it [ 138.884911][ T21] usb 5-1: USB disconnect, device number 15 [ 138.901060][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 138.909478][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 138.945960][ T6351] tipc: Disabling bearer [ 139.018805][ T6377] input: syz1 as /devices/virtual/input/input23 [ 139.281232][ T4233] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 139.341148][ T4228] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 139.651310][ T4233] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 139.659475][ T4233] usb 1-1: config 0 has no interface number 0 [ 139.665873][ T4233] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 139.677104][ T4233] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 139.689555][ T4233] usb 1-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 139.698794][ T4233] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.718733][ T4233] usb 1-1: config 0 descriptor?? [ 139.741216][ T4228] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 139.991520][ T4228] usb 4-1: config 0 has no interface number 0 [ 140.161322][ T4228] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 140.170718][ T4228] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.178859][ T4228] usb 4-1: Product: syz [ 140.183472][ T4228] usb 4-1: Manufacturer: syz [ 140.188146][ T4228] usb 4-1: SerialNumber: syz [ 140.195009][ T4228] usb 4-1: config 0 descriptor?? [ 140.261366][ T4233] usbhid 1-1:0.1: can't add hid device: -71 [ 140.267437][ T4233] usbhid: probe of 1-1:0.1 failed with error -71 [ 140.287669][ T4233] usb 1-1: USB disconnect, device number 14 [ 140.423898][ T6418] tipc: Enabled bearer , priority 0 [ 140.440449][ T6418] device syzkaller0 entered promiscuous mode [ 140.479324][ T6418] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 140.541757][ T6418] tipc: Resetting bearer [ 140.550275][ T6417] tipc: Resetting bearer [ 140.562224][ T6421] netlink: 8 bytes leftover after parsing attributes in process `syz.3.694'. [ 140.581871][ T6417] tipc: Disabling bearer [ 140.690183][ T6429] netlink: 'syz.4.709': attribute type 1 has an invalid length. [ 140.887799][ T6437] input: syz1 as /devices/virtual/input/input24 [ 141.153735][ T6440] netlink: 4 bytes leftover after parsing attributes in process `syz.2.713'. [ 142.061326][ T4228] asix: probe of 4-1:0.251 failed with error -71 [ 142.084893][ T21] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 142.088211][ T4228] usb 4-1: USB disconnect, device number 18 [ 142.193602][ T6460] tipc: Enabled bearer , priority 0 [ 142.202836][ T6460] device syzkaller0 entered promiscuous mode [ 142.211937][ T6460] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 142.227541][ T6460] tipc: Resetting bearer [ 142.235196][ T6459] tipc: Resetting bearer [ 142.265339][ T6459] tipc: Disabling bearer [ 142.341125][ T21] usb 5-1: Using ep0 maxpacket: 8 [ 142.427070][ T6470] device team0 entered promiscuous mode [ 142.441359][ T6470] device team_slave_0 entered promiscuous mode [ 142.463675][ T6470] device team_slave_1 entered promiscuous mode [ 142.575975][ T6476] netlink: 'syz.2.726': attribute type 1 has an invalid length. [ 142.622031][ T21] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 142.661302][ T21] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.669427][ T21] usb 5-1: Product: syz [ 142.674976][ T21] usb 5-1: Manufacturer: syz [ 142.679668][ T21] usb 5-1: SerialNumber: syz [ 142.997920][ T21] usb 5-1: config 0 descriptor?? [ 143.291229][ T21] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 143.651142][ T4233] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 143.723091][ T6502] netlink: 104 bytes leftover after parsing attributes in process `syz.3.735'. [ 143.736312][ T6502] MPTCP: kernel_bind error, err=-99 [ 143.911119][ T7] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 144.021458][ T4233] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 144.030044][ T4233] usb 2-1: config 0 has no interface number 0 [ 144.081341][ T4231] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 144.162212][ T6521] device syzkaller0 entered promiscuous mode [ 144.174061][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 144.191404][ T4233] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 144.200606][ T4233] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.210791][ T4233] usb 2-1: Product: syz [ 144.215310][ T4233] usb 2-1: Manufacturer: syz [ 144.220051][ T4233] usb 2-1: SerialNumber: syz [ 144.233403][ T4233] usb 2-1: config 0 descriptor?? [ 144.291312][ T7] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xA6, skipping [ 144.316918][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 144.333469][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 144.441412][ T4231] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 144.531425][ T7] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 144.540503][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.549240][ T7] usb 1-1: Product: syz [ 144.553732][ T7] usb 1-1: Manufacturer: syz [ 144.558456][ T7] usb 1-1: SerialNumber: syz [ 144.565266][ T7] usb 1-1: config 0 descriptor?? [ 144.601225][ T4310] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 144.612692][ T4231] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 144.638076][ T4231] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.648348][ T4231] usb 4-1: Product: syz [ 144.652872][ T4231] usb 4-1: Manufacturer: syz [ 144.657617][ T4231] usb 4-1: SerialNumber: syz [ 144.672263][ T4231] usb 4-1: config 0 descriptor?? [ 144.681115][ T6527] netlink: 8 bytes leftover after parsing attributes in process `syz.1.729'. [ 144.712424][ T4231] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 144.723703][ T4231] usb 4-1: setting power ON [ 144.728815][ T4231] dvb-usb: bulk message failed: -22 (2/0) [ 144.756329][ T4231] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 144.788643][ T4231] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) error while loading driver (-19) [ 144.807066][ T4231] dvb_usb_cxusb: probe of 4-1:0.0 failed with error -22 [ 144.901418][ T21] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -71 [ 144.917603][ T4261] usb 4-1: USB disconnect, device number 19 [ 144.952065][ T21] usb 5-1: USB disconnect, device number 16 [ 144.961575][ T4310] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 144.987739][ T4310] usb 3-1: config 0 has no interface number 0 [ 145.006723][ T4310] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 145.038330][ T4310] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.069041][ T4310] usb 3-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 145.083840][ T4310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.118480][ T4310] usb 3-1: config 0 descriptor?? [ 145.541647][ T6533] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 64 out of range (51000000..2150000000) [ 145.648952][ T6539] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 145.661281][ T4310] usbhid 3-1:0.1: can't add hid device: -71 [ 145.667309][ T4310] usbhid: probe of 3-1:0.1 failed with error -71 [ 145.709774][ T4310] usb 3-1: USB disconnect, device number 16 [ 145.821066][ T4261] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 145.974600][ T4228] usb 1-1: USB disconnect, device number 15 [ 146.034085][ T6548] input: syz1 as /devices/virtual/input/input25 [ 146.131208][ T4261] usb 5-1: Using ep0 maxpacket: 8 [ 146.241498][ T6555] device syzkaller0 entered promiscuous mode [ 146.411522][ T4233] asix: probe of 2-1:0.251 failed with error -71 [ 146.455091][ T4233] usb 2-1: USB disconnect, device number 13 [ 146.456707][ T4261] usb 5-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 146.470178][ T4229] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 146.486700][ T4261] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.503356][ T4261] usb 5-1: Product: syz [ 146.520561][ T4261] usb 5-1: Manufacturer: syz [ 146.525690][ T4261] usb 5-1: SerialNumber: syz [ 146.601220][ T25] audit: type=1326 audit(1783671555.392:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6561 comm="syz.3.759" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1c2993ee59 code=0x42a60000 [ 146.765539][ T4229] usb 3-1: Using ep0 maxpacket: 16 [ 146.911478][ T4229] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 146.954370][ T4229] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 147.161784][ T4229] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 147.202546][ T4229] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.310736][ T4229] usb 3-1: Product: syz [ 147.352517][ T4229] usb 3-1: Manufacturer: syz [ 147.374261][ T4229] usb 3-1: SerialNumber: syz [ 147.436713][ T4261] usb 5-1: USB disconnect, device number 17 [ 147.761687][ T4229] usb 3-1: 0:2 : does not exist [ 147.832885][ T4229] usb 3-1: USB disconnect, device number 17 [ 148.003187][ T6588] device syzkaller0 entered promiscuous mode [ 148.194522][ T6596] input: syz1 as /devices/virtual/input/input26 [ 148.276651][ T6598] tipc: Enabled bearer , priority 0 [ 148.333696][ T6602] device syzkaller0 entered promiscuous mode [ 148.400043][ T6598] tipc: Resetting bearer [ 148.507211][ T6597] tipc: Resetting bearer [ 148.657498][ T6597] tipc: Disabling bearer [ 148.973218][ T6615] tipc: Enabled bearer , priority 0 [ 148.981378][ T6615] device syzkaller0 entered promiscuous mode [ 149.003258][ T6615] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 149.028039][ T6615] tipc: Resetting bearer [ 149.047579][ T6611] tipc: Resetting bearer [ 149.082530][ T6611] tipc: Disabling bearer [ 149.133887][ T6622] fuse: Unknown parameter 'grou00000000000000000000' [ 149.181485][ T6624] device syzkaller0 entered promiscuous mode [ 149.193791][ T6624] tipc: Enabling of bearer rejected, failed to enable media [ 150.362548][ T6644] device erspan0 entered promiscuous mode [ 150.389848][ T6644] netlink: 8 bytes leftover after parsing attributes in process `syz.1.789'. [ 150.391112][ T4233] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 150.444239][ T6648] loop2: detected capacity change from 0 to 512 [ 150.462176][ T6644] device erspan0 left promiscuous mode [ 150.568322][ T6648] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 150.860549][ T6652] input: syz1 as /devices/virtual/input/input27 [ 151.371413][ T6657] device syzkaller0 entered promiscuous mode [ 151.408084][ T6657] tipc: Enabling of bearer rejected, failed to enable media [ 151.649921][ T6665] netlink: 4 bytes leftover after parsing attributes in process `syz.0.795'. [ 151.673955][ T6667] loop1: detected capacity change from 0 to 2048 [ 151.729314][ T6667] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 151.847520][ T6667] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 151.854524][ T6667] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 151.867066][ T6667] vhci_hcd vhci_hcd.0: Device attached [ 151.884358][ T6668] vhci_hcd: connection closed [ 151.886997][ T154] vhci_hcd: stop threads [ 151.897805][ T154] vhci_hcd: release socket [ 151.902515][ T154] vhci_hcd: disconnect device [ 151.928929][ T4233] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 151.938694][ T4233] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.946932][ T4233] usb 5-1: Product: syz [ 151.956086][ T4233] usb 5-1: Manufacturer: syz [ 151.960730][ T4233] usb 5-1: SerialNumber: syz [ 151.967329][ T4233] usb 5-1: config 0 descriptor?? [ 152.231210][ T4233] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 152.620309][ T25] audit: type=1326 audit(1783671561.412:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6683 comm="syz.3.800" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1c2993ee59 code=0x0 [ 152.809234][ T6689] loop2: detected capacity change from 0 to 512 [ 152.869386][ T6689] EXT4-fs (loop2): Test dummy encryption mode enabled [ 152.940973][ T6689] EXT4-fs error (device loop2): ext4_orphan_get:1406: inode #15: comm syz.2.801: inode has both inline data and extents flags [ 152.956818][ T6689] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.801: couldn't read orphan inode 15 (err -117) [ 152.973200][ T6689] EXT4-fs (loop2): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 153.695927][ T6696] loop0: detected capacity change from 0 to 32768 [ 153.720209][ T6689] fscrypt (loop2): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 153.765799][ T6696] (syz.0.802,6696,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 153.782621][ T6696] (syz.0.802,6696,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 153.818282][ T6696] JBD2: Ignoring recovery information on journal [ 154.011719][ T6696] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 154.671945][ T4188] ocfs2: Unmounting device (7,0) on (node local) [ 154.821073][ T6713] loop2: detected capacity change from 0 to 32768 [ 154.888755][ T6713] (syz.2.806,6713,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 154.907343][ T6713] (syz.2.806,6713,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 154.937975][ T6713] JBD2: Ignoring recovery information on journal [ 155.002513][ T6713] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 155.081881][ T4233] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -71 [ 155.127740][ T4233] usb 5-1: USB disconnect, device number 18 [ 155.571564][ T4350] Bluetooth: hci5: Frame reassembly failed (-84) [ 155.611960][ T4350] Bluetooth: hci5: Frame reassembly failed (-84) [ 155.666424][ T6726] device syzkaller0 entered promiscuous mode [ 155.696584][ T6726] tipc: Enabling of bearer rejected, failed to enable media [ 155.743430][ T6730] loop3: detected capacity change from 0 to 512 [ 155.850950][ T6730] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,stripe=0x0000000000000002,,errors=continue. Quota mode: writeback. [ 155.875764][ T6730] ext4 filesystem being mounted at /152/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 156.058216][ T6742] loop0: detected capacity change from 0 to 512 [ 156.111040][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 156.131049][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.141041][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.161044][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.171041][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.181039][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.191035][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.201037][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.251038][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.261040][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 156.443573][ T25] audit: type=1800 audit(1783671565.032:6): pid=6746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.811" name="file0" dev="loop3" ino=15 res=0 errno=0 [ 156.493907][ T6748] loop1: detected capacity change from 0 to 512 [ 156.550093][ T6742] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,stripe=0x0000000000000002,,errors=continue. Quota mode: writeback. [ 156.579893][ T6748] EXT4-fs (loop1): Test dummy encryption mode enabled [ 156.633851][ T6748] EXT4-fs error (device loop1): ext4_orphan_get:1406: inode #15: comm syz.1.816: inode has both inline data and extents flags [ 156.648481][ T6748] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.816: couldn't read orphan inode 15 (err -117) [ 156.662618][ T6748] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 156.927723][ T6748] fscrypt (loop1): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 156.940401][ T6742] ext4 filesystem being mounted at /176/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 157.099631][ T6760] loop3: detected capacity change from 0 to 256 [ 157.227757][ T6760] exFAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 157.267537][ T6766] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.815: bad entry in directory: inode out of bounds - offset=92, inode=117440528, rec_len=16, size=2048 fake=0 [ 157.311083][ T6760] exFAT-fs (loop3): Medium has reported failures. Some data may be lost. [ 157.390655][ T6760] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000ff98, chksum : 0xc64c91aa, utbl_chksum : 0xe619d30d) [ 157.601437][ T4229] Bluetooth: hci5: command 0x1003 tx timeout [ 157.613402][ T4189] Bluetooth: hci5: sending frame failed (-49) [ 157.902552][ T6784] device syzkaller0 entered promiscuous mode [ 157.929762][ T6784] tipc: Enabling of bearer rejected, failed to enable media [ 158.115600][ T6789] loop4: detected capacity change from 0 to 32768 [ 158.238683][ T6789] (syz.4.825,6789,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 158.252878][ T6789] (syz.4.825,6789,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 158.271240][ T6789] debugfs: Directory '9357E9D751824C228242B9B0D0FB6750' with parent 'ocfs2' already present! [ 158.522758][ T6794] loop0: detected capacity change from 0 to 2048 [ 159.197013][ T6789] JBD2: Ignoring recovery information on journal [ 159.243004][ T6789] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 159.691591][ T4229] Bluetooth: hci5: command 0x1001 tx timeout [ 159.704611][ T4189] Bluetooth: hci5: sending frame failed (-49) [ 159.880785][ T6806] binder_alloc: 6796: binder_alloc_buf size 1024 failed, no address space [ 159.936749][ T4193] ocfs2: Unmounting device (7,4) on (node local) [ 159.960196][ T6806] binder_alloc: allocated: 12280 (num: 1 largest: 12280), free: 8 (num: 1 largest: 8) [ 160.320297][ T7] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 160.822814][ T6824] tipc: Enabling of bearer rejected, failed to enable media [ 161.331648][ T7] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 161.364957][ T7] usb 2-1: config 0 has no interface number 0 [ 161.399046][ T7] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.485018][ T7] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.552520][ T7] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 161.615266][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.671043][ T7] usb 2-1: config 0 descriptor?? [ 161.761295][ T4228] Bluetooth: hci5: command 0x1009 tx timeout [ 162.206523][ T7] input: HID 04d9:a055 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.1/0003:04D9:A055.0012/input/input28 [ 162.286164][ T7] holtek_kbd 0003:04D9:A055.0012: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.1-1/input1 [ 162.371404][ T7] usb 2-1: USB disconnect, device number 14 [ 162.433287][ T6848] fido_id[6848]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 162.801263][ T4261] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 162.949567][ T6854] loop1: detected capacity change from 0 to 8192 [ 162.981397][ T6854] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 163.004080][ T25] audit: type=1800 audit(1783671571.802:7): pid=6854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.841" name="file2" dev="loop1" ino=1048590 res=0 errno=0 [ 163.007769][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.029930][ T4261] usb 1-1: device descriptor read/64, error -71 [ 163.035946][ T6854] FAT-fs (loop1): Filesystem has been set read-only [ 163.047751][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.056921][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.066228][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.075374][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.087022][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.111184][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.130407][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.144545][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.153853][ T6854] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 163.301068][ T4261] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 163.411072][ T7] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 163.491166][ T4261] usb 1-1: device descriptor read/64, error -71 [ 163.611906][ T4261] usb usb1-port1: attempt power cycle [ 163.651329][ T7] usb 4-1: Using ep0 maxpacket: 32 [ 163.771324][ T7] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 163.780429][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.797815][ T7] usb 4-1: config 0 descriptor?? [ 163.852072][ T7] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 163.883248][ T6858] loop1: detected capacity change from 0 to 512 [ 163.967973][ T6858] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,stripe=0x0000000000000002,,errors=continue. Quota mode: writeback. [ 163.983587][ T6858] ext4 filesystem being mounted at /172/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 164.021122][ T4261] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 164.116300][ T4261] usb 1-1: device descriptor read/8, error -71 [ 164.308151][ T6863] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.843: bad entry in directory: inode out of bounds - offset=92, inode=117440528, rec_len=16, size=2048 fake=0 [ 164.771258][ T4261] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 164.871305][ T4261] usb 1-1: device descriptor read/8, error -71 [ 164.991683][ T4261] usb usb1-port1: unable to enumerate USB device [ 165.167424][ T6879] loop4: detected capacity change from 0 to 40427 [ 165.185600][ T6879] F2FS-fs (loop4): Invalid Fs Meta Ino: node(1) meta(2147483650) root(3) [ 165.199936][ T6879] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 165.217912][ T6879] F2FS-fs (loop4): invalid crc value [ 165.223820][ T6879] F2FS-fs (loop4): invalid crc value [ 165.229233][ T6879] F2FS-fs (loop4): Failed to get valid F2FS checkpoint [ 165.476600][ T6884] tipc: Enabled bearer , priority 0 [ 165.484251][ T6884] device syzkaller0 entered promiscuous mode [ 165.497178][ T6884] tipc: Resetting bearer [ 165.505563][ T6883] tipc: Resetting bearer [ 165.515435][ T6883] tipc: Disabling bearer [ 165.696350][ T6889] loop1: detected capacity change from 0 to 512 [ 165.750950][ T6889] EXT4-fs (loop1): Ignoring removed orlov option [ 165.758201][ T6889] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 165.771843][ T6889] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 165.802881][ T6889] EXT4-fs error (device loop1): __ext4_iget:4919: inode #11: block 196628: comm syz.1.852: invalid block [ 165.834782][ T6889] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.852: couldn't read orphan inode 11 (err -117) [ 165.866991][ T6889] EXT4-fs (loop1): mounted filesystem without journal. Opts: orlov,nogrpid,,errors=continue. Quota mode: none. [ 165.928915][ T6889] netlink: 'syz.1.852': attribute type 1 has an invalid length. [ 165.938317][ T6889] netlink: 56 bytes leftover after parsing attributes in process `syz.1.852'. [ 166.098387][ T4199] ocfs2: Unmounting device (7,2) on (node local) [ 166.301908][ T6910] loop0: detected capacity change from 0 to 512 [ 166.394790][ T6910] EXT4-fs (loop0): Test dummy encryption mode enabled [ 166.480337][ T6910] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.859: inode has both inline data and extents flags [ 166.495203][ T6910] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.859: couldn't read orphan inode 15 (err -117) [ 166.509762][ T6910] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 166.661504][ T7] gspca_vc032x: reg_r err -32 [ 166.666423][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 166.729121][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 166.786546][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 166.842647][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 166.900385][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 166.958854][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.025170][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.078430][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.132693][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.183335][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.188837][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.218232][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.226948][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.235531][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.240845][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.246729][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.258735][ T7] gspca_vc032x: I2c Bus Busy Wait 00 [ 167.268110][ T7] gspca_vc032x: Unknown sensor... [ 167.278556][ T7] vc032x: probe of 4-1:0.0 failed with error -22 [ 167.334366][ T6920] tipc: Enabled bearer , priority 0 [ 167.360932][ T6920] device syzkaller0 entered promiscuous mode [ 167.386250][ T6920] tipc: Resetting bearer [ 167.393835][ T6919] tipc: Resetting bearer [ 167.445783][ T6919] tipc: Disabling bearer [ 168.138170][ T6931] input: syz0 as /devices/virtual/input/input31 [ 168.750148][ T7] usb 4-1: USB disconnect, device number 20 [ 169.356953][ T6952] input input33: cannot allocate more than FF_MAX_EFFECTS effects [ 170.443229][ T6956] loop2: detected capacity change from 0 to 2048 [ 170.535067][ T6956] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 170.581175][ T4261] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 170.635172][ T6956] syz.2.875: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 170.664626][ T6956] CPU: 1 PID: 6956 Comm: syz.2.875 Not tainted syzkaller #0 [ 170.671954][ T6956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 170.682143][ T6956] Call Trace: [ 170.685434][ T6956] [ 170.688547][ T6956] dump_stack_lvl+0x188/0x250 [ 170.693328][ T6956] ? rcu_lock_release+0x5/0x20 [ 170.698080][ T6956] ? show_regs_print_info+0x20/0x20 [ 170.703268][ T6956] ? load_image+0x410/0x410 [ 170.707774][ T6956] warn_alloc+0x245/0x320 [ 170.712089][ T6956] ? rcu_lock_release+0x20/0x20 [ 170.716926][ T6956] ? zone_watermark_ok_safe+0x250/0x250 [ 170.722462][ T6956] ? kfree+0xef/0x2a0 [ 170.726441][ T6956] __vmalloc_node_range+0x2b1/0x8b0 [ 170.731715][ T6956] ? mutex_lock_io_nested+0x60/0x60 [ 170.736905][ T6956] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 170.742704][ T6956] vmalloc+0x75/0x80 [ 170.746615][ T6956] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 170.752526][ T6956] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 170.758152][ T6956] dvb_demux_do_ioctl+0x450/0x530 [ 170.763165][ T6956] dvb_usercopy+0x191/0x2b0 [ 170.767663][ T6956] ? dvb_dmxdev_buffer_read+0x4a0/0x4a0 [ 170.773201][ T6956] ? dvb_generic_ioctl+0xb0/0xb0 [ 170.778147][ T6956] ? dvb_demux_poll+0x210/0x210 [ 170.782982][ T6956] dvb_demux_ioctl+0x25/0x30 [ 170.787558][ T6956] __se_sys_ioctl+0xfa/0x170 [ 170.792356][ T6956] do_syscall_64+0x4c/0xa0 [ 170.796787][ T6956] ? clear_bhb_loop+0x30/0x80 [ 170.801452][ T6956] ? clear_bhb_loop+0x30/0x80 [ 170.806115][ T6956] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 170.812002][ T6956] RIP: 0033:0x7feafcbc3e59 [ 170.816464][ T6956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.836252][ T6956] RSP: 002b:00007feafae1c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 170.844918][ T6956] RAX: ffffffffffffffda RBX: 00007feafce4bfa0 RCX: 00007feafcbc3e59 [ 170.852906][ T6956] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000005 [ 170.860868][ T6956] RBP: 00007feafcc59e6f R08: 0000000000000000 R09: 0000000000000000 [ 170.868829][ T6956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.876786][ T6956] R13: 00007feafce4c038 R14: 00007feafce4bfa0 R15: 00007fff22815c78 [ 170.885192][ T6956] [ 170.968456][ T6969] loop1: detected capacity change from 0 to 128 [ 170.992780][ T6969] ======================================================= [ 170.992780][ T6969] WARNING: The mand mount option has been deprecated and [ 170.992780][ T6969] and is ignored by this kernel. Remove the mand [ 170.992780][ T6969] option from the mount to silence this warning. [ 170.992780][ T6969] ======================================================= [ 171.000775][ T6971] loop4: detected capacity change from 0 to 512 [ 171.042592][ T6956] Mem-Info: [ 171.046079][ T6956] active_anon:279 inactive_anon:6320 isolated_anon:0 [ 171.046079][ T6956] active_file:4946 inactive_file:46006 isolated_file:0 [ 171.046079][ T6956] unevictable:768 dirty:179 writeback:0 [ 171.046079][ T6956] slab_reclaimable:20746 slab_unreclaimable:97268 [ 171.046079][ T6956] mapped:30413 shmem:1927 pagetables:749 bounce:0 [ 171.046079][ T6956] kernel_misc_reclaimable:0 [ 171.046079][ T6956] free:1362249 free_pcp:9707 free_cma:0 [ 171.102049][ T6956] Node 0 active_anon:1092kB inactive_anon:24760kB active_file:19580kB inactive_file:184024kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121652kB dirty:716kB writeback:0kB shmem:5628kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:10912kB pagetables:2996kB all_unreclaimable? no [ 171.139917][ T6956] Node 1 active_anon:24kB inactive_anon:520kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2080kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no [ 171.180478][ T6969] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 171.192847][ T4261] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 171.204712][ T4261] usb 4-1: config 0 has no interface number 0 [ 171.218763][ T4261] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 171.232237][ T6969] hpfs: filesystem error: improperly stopped [ 171.238254][ T6969] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 171.246562][ T4261] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 171.267616][ T6969] hpfs: You really don't want any checks? You are crazy... [ 171.275433][ T4261] usb 4-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 171.288155][ T6967] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 171.294721][ T6967] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 171.306961][ T6969] hpfs: hpfs_map_sector(): read error [ 171.322199][ T4261] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.330850][ T6969] hpfs: code page support is disabled [ 171.339495][ T6969] hpfs: hpfs_map_4sectors(): unaligned read [ 171.346972][ T4261] usb 4-1: config 0 descriptor?? [ 171.353066][ T6969] hpfs: hpfs_map_4sectors(): unaligned read [ 171.359152][ T6969] hpfs: filesystem error: unable to find root dir [ 171.437476][ T6956] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 171.466596][ T6956] lowmem_reserve[]: 0 2539 2540 2540 2540 [ 171.481142][ T6967] vhci_hcd vhci_hcd.0: Device attached [ 171.486986][ T6956] Node 0 DMA32 free:1508940kB min:34784kB low:43480kB high:52176kB reserved_highatomic:0KB active_anon:1092kB inactive_anon:35160kB active_file:19580kB inactive_file:184024kB unevictable:1536kB writepending:624kB present:3129332kB managed:2606524kB mlocked:0kB bounce:0kB free_pcp:32140kB local_pcp:21352kB free_cma:0kB [ 171.512790][ T6971] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,stripe=0x0000000000000002,,errors=continue. Quota mode: writeback. [ 171.537398][ T6971] ext4 filesystem being mounted at /168/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 172.682564][ T6980] hpfs: hpfs_map_4sectors(): unaligned read [ 172.693394][ T6980] hpfs: hpfs_map_sector(): read error [ 172.967160][ T6956] lowmem_reserve[]: 0 0 0 0 0 [ 172.981111][ T6973] vhci_hcd: connection closed [ 173.203073][ T25] audit: type=1800 audit(1783671582.002:8): pid=6982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.878" name="file0" dev="loop4" ino=15 res=0 errno=0 [ 173.242441][ T7] vhci_hcd: vhci_device speed not set [ 173.248380][ T154] vhci_hcd: stop threads [ 173.295629][ T154] vhci_hcd: release socket [ 173.361171][ T7] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 173.427944][ T4261] input: HID 04d9:a055 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:04D9:A055.0013/input/input34 [ 173.430265][ T6956] Node 0 [ 173.455455][ T154] vhci_hcd: disconnect device [ 173.471347][ T6956] Normal free:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:660kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 173.555639][ T4261] holtek_kbd 0003:04D9:A055.0013: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.3-1/input1 [ 173.641555][ T6956] lowmem_reserve[]: 0 0 0 0 0 [ 173.644190][ T4261] usb 4-1: USB disconnect, device number 21 [ 173.660108][ T6956] Node 1 Normal free:3922376kB min:55108kB low:68884kB high:82660kB reserved_highatomic:0KB active_anon:24kB inactive_anon:520kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 173.752384][ T6956] lowmem_reserve[]: 0 0 0 0 0 [ 173.757154][ T6956] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 173.771299][ T6956] Node 0 DMA32: 1012*4kB (UM) 70*8kB (UME) 49*16kB (UME) 312*32kB (UME) 130*64kB (UME) 24*128kB (UME) 46*256kB (UME) 33*512kB (UME) 13*1024kB (UM) 6*2048kB (UME) 349*4096kB (M) = 1510544kB [ 173.820907][ T6956] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 173.841330][ T6956] Node 1 Normal: 220*4kB (UME) 37*8kB (UME) 27*16kB (UME) 162*32kB (UME) 79*64kB (UME) 15*128kB (UE) 10*256kB (UME) 5*512kB (U) 2*1024kB (UE) 1*2048kB (M) 952*4096kB (M) = 3922376kB [ 173.864274][ T6992] fido_id[6992]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 173.879788][ T6956] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 173.897432][ T6956] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 173.907920][ T6956] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 173.961183][ T6956] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 173.992395][ T6956] 52866 total pagecache pages [ 173.997374][ T6956] 0 pages in swap cache [ 174.031218][ T6956] Swap cache stats: add 39012, delete 39012, find 1364/1414 [ 174.038541][ T6956] Free swap = 124400kB [ 174.087146][ T6956] Total swap = 124996kB [ 174.101132][ T6956] 2097051 pages RAM [ 174.105025][ T6956] 0 pages HighMem/MovableOnly [ 174.146842][ T6956] 411497 pages reserved [ 174.160878][ T6956] 0 pages cma reserved [ 174.192323][ T6998] tipc: Enabled bearer , priority 0 [ 174.199736][ T6998] device syzkaller0 entered promiscuous mode [ 174.223172][ T6998] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 174.251789][ T6998] tipc: Resetting bearer [ 174.285310][ T6997] tipc: Resetting bearer [ 174.332448][ T6997] tipc: Disabling bearer [ 174.927109][ T7016] device syzkaller0 entered promiscuous mode [ 176.066374][ T4233] Bluetooth: hci0: command 0x0406 tx timeout [ 176.073224][ T4233] Bluetooth: hci2: command 0x0406 tx timeout [ 176.079240][ T4233] Bluetooth: hci4: command 0x0406 tx timeout [ 176.085844][ T4233] Bluetooth: hci3: command 0x0406 tx timeout [ 176.092095][ T4233] Bluetooth: hci1: command 0x0406 tx timeout [ 176.295547][ T7047] device syzkaller0 entered promiscuous mode [ 176.374778][ T7051] loop1: detected capacity change from 0 to 512 [ 176.442189][ T7051] EXT4-fs (loop1): Test dummy encryption mode enabled [ 176.546535][ T7051] EXT4-fs error (device loop1): ext4_orphan_get:1406: inode #15: comm syz.1.904: inode has both inline data and extents flags [ 176.565062][ T7051] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.904: couldn't read orphan inode 15 (err -117) [ 176.578608][ T7051] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 176.900330][ T7051] fscrypt (loop1): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 177.162205][ T7077] netlink: 'syz.2.909': attribute type 1 has an invalid length. [ 178.534214][ T7101] device syzkaller0 entered promiscuous mode [ 178.570291][ T7] vhci_hcd: vhci_device speed not set [ 178.851253][ T26] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 179.341610][ T26] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 179.389394][ T26] usb 2-1: config 0 has no interface number 0 [ 179.681811][ T26] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 179.742251][ T26] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.815815][ T26] usb 2-1: Product: syz [ 179.827405][ T26] usb 2-1: Manufacturer: syz [ 179.940542][ T26] usb 2-1: SerialNumber: syz [ 179.958774][ T26] usb 2-1: config 0 descriptor?? [ 180.075236][ T25] audit: type=1326 audit(1783671588.872:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7126 comm="syz.0.927" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3665fbfe59 code=0x0 [ 180.164558][ T7141] device syzkaller0 entered promiscuous mode [ 182.022177][ T26] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 182.074677][ T26] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 182.142912][ T7175] binder: BINDER_SET_CONTEXT_MGR already set [ 182.150390][ T26] asix: probe of 2-1:0.251 failed with error -5 [ 182.177974][ T7175] binder: 7173:7175 ioctl 4018620d 200000004a80 returned -16 [ 182.196749][ T26] usb 2-1: USB disconnect, device number 15 [ 182.245246][ T7175] binder: 7173:7175 ioctl c0306201 0 returned -14 [ 182.301423][ T7189] xt_hashlimit: size too large, truncated to 1048576 [ 182.477535][ T7194] netlink: 4 bytes leftover after parsing attributes in process `syz.4.951'. [ 183.990405][ T7211] binder: 7209:7211 ioctl c0306201 200000000080 returned -14 [ 184.003224][ T7211] binder: 7209:7211 ioctl c0306201 2000000003c0 returned -14 [ 184.174958][ T4228] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 184.226437][ T154] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.339266][ T154] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.410657][ T7223] binder: 7222:7223 ioctl c0306201 0 returned -14 [ 184.477403][ T154] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.561947][ T4228] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 184.570356][ T4228] usb 3-1: config 0 has no interface number 0 [ 184.645853][ T154] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.761544][ T4228] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 184.805819][ T4228] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.859267][ T4228] usb 3-1: Product: syz [ 184.879757][ T4228] usb 3-1: Manufacturer: syz [ 184.904612][ T4228] usb 3-1: SerialNumber: syz [ 184.917355][ T7239] fuse: Bad value for 'fd' [ 184.940020][ T4228] usb 3-1: config 0 descriptor?? [ 184.954888][ T7233] chnl_net:caif_netlink_parms(): no params data found [ 185.181280][ T7233] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.208047][ T7233] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.220208][ T7233] device bridge_slave_0 entered promiscuous mode [ 185.257680][ T7233] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.281409][ T7233] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.311932][ T7233] device bridge_slave_1 entered promiscuous mode [ 186.122463][ T7233] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.192069][ T154] tipc: Left network mode [ 186.218779][ T7233] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.266480][ T7254] tipc: Enabled bearer , priority 0 [ 186.373654][ T7233] team0: Port device team_slave_0 added [ 186.379995][ T7254] device syzkaller0 entered promiscuous mode [ 186.432689][ T7233] team0: Port device team_slave_1 added [ 186.451977][ T7254] tipc: Resetting bearer [ 186.501288][ T7253] tipc: Resetting bearer [ 186.530458][ T7253] tipc: Disabling bearer [ 186.606730][ T7233] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 186.667693][ T7233] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 186.773437][ T7233] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 186.811143][ T4233] Bluetooth: hci2: command 0x0409 tx timeout [ 186.883842][ T7233] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 186.901443][ T7233] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 187.009389][ T7233] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 187.170529][ T7233] device hsr_slave_0 entered promiscuous mode [ 187.191428][ T4228] asix: probe of 3-1:0.251 failed with error -71 [ 187.208694][ T7233] device hsr_slave_1 entered promiscuous mode [ 187.220239][ T4228] usb 3-1: USB disconnect, device number 18 [ 187.251325][ T7233] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 187.268766][ T7233] Cannot create hsr debugfs directory [ 187.730205][ T7291] fuse: Bad value for 'fd' [ 187.765671][ T7288] device syzkaller0 entered promiscuous mode [ 187.850226][ T7233] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 187.864958][ T7233] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 187.902575][ T7233] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 187.980263][ T154] device hsr_slave_0 left promiscuous mode [ 188.011466][ T154] device hsr_slave_1 left promiscuous mode [ 188.024574][ T7305] netlink: 'syz.0.979': attribute type 1 has an invalid length. [ 188.034329][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 188.047544][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 188.070279][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 188.086600][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 188.107510][ T154] device bridge_slave_1 left promiscuous mode [ 188.119573][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.152612][ T154] device bridge_slave_0 left promiscuous mode [ 188.160533][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.216958][ T154] device veth1_macvtap left promiscuous mode [ 188.235725][ T154] device veth0_macvtap left promiscuous mode [ 188.250062][ T154] device veth1_vlan left promiscuous mode [ 188.256258][ T26] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 188.271065][ T154] device veth0_vlan left promiscuous mode [ 188.485000][ T154] team0 (unregistering): Port device team_slave_1 removed [ 188.497390][ T154] team0 (unregistering): Port device team_slave_0 removed [ 188.515998][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 188.541629][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 188.629256][ T154] bond0 (unregistering): Released all slaves [ 188.641503][ T26] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 188.654867][ T26] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 188.665876][ T26] usb 3-1: config 1 has no interface number 0 [ 188.673913][ T26] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 188.687767][ T26] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 188.701908][ T26] usb 3-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 188.711477][ T7233] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 188.729764][ T26] usb 3-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 188.881465][ T4310] Bluetooth: hci2: command 0x041b tx timeout [ 188.942346][ T7327] usb usb8: usbfs: process 7327 (syz.3.985) did not claim interface 0 before use [ 188.971529][ T26] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 188.980651][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.993761][ T26] usb 3-1: Product: syz [ 188.999653][ T26] usb 3-1: Manufacturer: syz [ 189.004417][ T26] usb 3-1: SerialNumber: syz [ 189.028033][ T7233] 8021q: adding VLAN 0 to HW filter on device bond0 [ 189.050531][ T7301] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 189.089544][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 189.101461][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 189.112103][ T7233] 8021q: adding VLAN 0 to HW filter on device team0 [ 189.159016][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 189.174539][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 189.199571][ T4352] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.206699][ T4352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 189.249695][ T7337] kvm: pic: level sensitive irq not supported [ 189.291345][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 189.331494][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 189.350507][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 189.367901][ T4352] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.375056][ T4352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 189.401466][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 189.422493][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 189.453470][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 189.464295][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 189.492296][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 189.504962][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 189.528196][ T7301] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 189.539569][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 189.551922][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 189.560595][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 189.569741][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 189.579058][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 189.595716][ T7233] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 189.796199][ T26] cdc_ncm 3-1:1.1: failed GET_NTB_PARAMETERS [ 189.803574][ T26] cdc_ncm 3-1:1.1: bind() failure [ 189.827406][ T26] usb 3-1: USB disconnect, device number 19 [ 189.976050][ T4360] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 190.010720][ T4360] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 190.052239][ T7233] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.142885][ T7374] netlink: 'syz.3.993': attribute type 1 has an invalid length. [ 190.168247][ T7372] tipc: Enabled bearer , priority 0 [ 190.202701][ T7372] device syzkaller0 entered promiscuous mode [ 190.267177][ T7372] tipc: Resetting bearer [ 190.286024][ T7381] 9pnet_virtio: no channels available for device syz [ 190.299625][ T7371] tipc: Resetting bearer [ 190.342047][ T7371] tipc: Disabling bearer [ 190.803918][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 190.828646][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 190.878196][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 190.911688][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 190.934501][ T7233] device veth0_vlan entered promiscuous mode [ 190.961629][ T26] Bluetooth: hci2: command 0x040f tx timeout [ 190.968205][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 190.989302][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 191.028239][ T7233] device veth1_vlan entered promiscuous mode [ 191.099253][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 191.119497][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 191.149680][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 191.170312][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 191.203468][ T7233] device veth0_macvtap entered promiscuous mode [ 191.237496][ T7233] device veth1_macvtap entered promiscuous mode [ 191.317697][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.392897][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.428260][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.481029][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.521029][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.532293][ T7425] netlink: 'syz.3.1003': attribute type 1 has an invalid length. [ 191.571023][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.580853][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.661021][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.714098][ T7233] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 191.754253][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 191.782221][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 191.825947][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 191.855917][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 191.885100][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 191.921074][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.930910][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.031675][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.063188][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.096027][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.124204][ T7233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.161417][ T7233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.194064][ T7233] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 192.225404][ T7233] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.240682][ T7233] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.279187][ T7233] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.307556][ T7233] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.346467][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 192.365870][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 192.599936][ T4352] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 192.631135][ T4352] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 192.670665][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 192.709933][ T4352] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 192.741283][ T4352] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 192.748904][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 192.871367][ T7] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 193.052411][ T4230] Bluetooth: hci2: command 0x0419 tx timeout [ 193.288426][ T7485] tipc: Enabling of bearer rejected, failed to enable media [ 193.391435][ T7] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 193.445942][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.479237][ T7] usb 4-1: Product: syz [ 193.503909][ T7] usb 4-1: Manufacturer: syz [ 193.523420][ T7] usb 4-1: SerialNumber: syz [ 193.606501][ T7] usb 4-1: config 0 descriptor?? [ 193.891949][ T7] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 194.211653][ T1425] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.218012][ T1425] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.115778][ T7553] tipc: Enabled bearer , priority 0 [ 195.123949][ T7553] device syzkaller0 entered promiscuous mode [ 195.140089][ T7553] tipc: Resetting bearer [ 195.159247][ T7552] tipc: Resetting bearer [ 195.189258][ T7552] tipc: Disabling bearer [ 195.416362][ T154] Bluetooth: hci5: Frame reassembly failed (-84) [ 195.529996][ T7570] kvm [7566]: vcpu0, guest rIP: 0x18e ignored wrmsr: 0x11e data 0xc880 [ 195.555890][ T7570] kvm [7566]: vcpu0, guest rIP: 0x1b8 ignored wrmsr: 0x11e data 0xbe702111 [ 195.571431][ T7570] kvm [7566]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0x187 data 0xa088 [ 195.601969][ T7570] kvm [7566]: vcpu0, guest rIP: 0x18e ignored wrmsr: 0x11e data 0xd1a8 [ 195.615998][ T7570] kvm [7566]: vcpu0, guest rIP: 0x1b8 ignored wrmsr: 0x11e data 0xbe702111 [ 196.193628][ T7607] loop2: detected capacity change from 0 to 2048 [ 196.251894][ T7607] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 196.281218][ T7] dvb_usb_rtl28xxu: probe of 4-1:0.0 failed with error -32 [ 196.305472][ T7] usb 4-1: USB disconnect, device number 22 [ 196.395110][ T7612] fuse: Invalid rootmode [ 196.679973][ T7630] binder: 7629:7630 ioctl c0306201 200000000080 returned -14 [ 196.720631][ T7633] loop2: detected capacity change from 0 to 128 [ 196.757735][ T7633] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 196.795715][ T7633] hpfs: filesystem error: improperly stopped [ 196.813654][ T7633] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 196.826566][ T7633] hpfs: You really don't want any checks? You are crazy... [ 196.835550][ T7633] hpfs: hpfs_map_sector(): read error [ 196.845455][ T7633] hpfs: code page support is disabled [ 196.853105][ T7633] hpfs: hpfs_map_4sectors(): unaligned read [ 196.859179][ T7633] hpfs: hpfs_map_4sectors(): unaligned read [ 196.877896][ T7633] hpfs: filesystem error: unable to find root dir [ 197.041422][ T7642] netlink: 'syz.3.1058': attribute type 3 has an invalid length. [ 197.130767][ T7643] hpfs: hpfs_map_4sectors(): unaligned read [ 197.138100][ T7643] hpfs: hpfs_map_sector(): read error [ 197.369645][ T4230] Bluetooth: hci3: command 0x201b tx timeout [ 197.441391][ T4201] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 197.790850][ T7649] loop5: detected capacity change from 0 to 2048 [ 197.928739][ T7649] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 198.041436][ T4228] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 198.498100][ T4228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 198.509433][ T4228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 198.520161][ T4228] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 198.541275][ T26] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 198.691758][ T4228] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 198.719018][ T4228] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.763070][ T4228] usb 1-1: Product: syz [ 198.785974][ T4228] usb 1-1: Manufacturer: syz [ 198.813634][ T4228] usb 1-1: SerialNumber: syz [ 198.893899][ T4228] usb 1-1: config 0 descriptor?? [ 199.178762][ T4310] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 199.187100][ T4233] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 199.189652][ T4228] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 199.302012][ T7682] fuse: Unknown parameter '00000000000000000000' [ 199.441149][ T4233] usb 4-1: Using ep0 maxpacket: 32 [ 199.561318][ T4233] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 199.574412][ T4233] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.587928][ T4233] usb 4-1: config 0 descriptor?? [ 199.636584][ T4233] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 199.701450][ T26] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 199.710798][ T26] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 199.719411][ T26] usb 6-1: Product: syz [ 199.724202][ T26] usb 6-1: Manufacturer: syz [ 199.728810][ T26] usb 6-1: SerialNumber: syz [ 199.740639][ T26] usb 6-1: config 0 descriptor?? [ 199.745847][ T4310] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 199.755198][ T4310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.763661][ T4310] usb 3-1: Product: syz [ 199.768036][ T4310] usb 3-1: Manufacturer: syz [ 199.772753][ T4310] usb 3-1: SerialNumber: syz [ 199.780586][ T4310] usb 3-1: config 0 descriptor?? [ 200.008499][ T26] usb 6-1: USB disconnect, device number 2 [ 200.041227][ T4310] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 200.545843][ T7687] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1073'. [ 200.615594][ T7690] loop5: detected capacity change from 0 to 2048 [ 200.658194][ T7690] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 200.711958][ T7693] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.770089][ T4230] usb 1-1: USB disconnect, device number 20 [ 201.691681][ T7711] binder_alloc: 7710: binder_alloc_buf size 4294967152 failed, no address space [ 201.703920][ T7711] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 201.782671][ T7713] fuse: Unknown parameter '00000000000000000000' [ 201.808127][ T7715] binder: 7714:7715 unknown command 0 [ 201.817697][ T7715] binder: 7714:7715 ioctl c0306201 200000004a40 returned -22 [ 202.234700][ T4310] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -32 [ 202.244278][ T4310] usb 3-1: USB disconnect, device number 20 [ 202.311301][ T4233] gspca_vc032x: reg_r err -71 [ 202.316116][ T4230] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 202.324197][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.329659][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.335551][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.340879][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.346789][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.352214][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.357501][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.363204][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.368638][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.374563][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.380093][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.385543][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.390833][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.396179][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.401568][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.406865][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.412217][ T4233] gspca_vc032x: I2c Bus Busy Wait 00 [ 202.417858][ T4233] gspca_vc032x: Unknown sensor... [ 202.423367][ T4233] vc032x: probe of 4-1:0.0 failed with error -22 [ 202.431885][ T4233] usb 4-1: USB disconnect, device number 23 [ 202.581168][ T4230] usb 6-1: Using ep0 maxpacket: 16 [ 202.711171][ T4230] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.721835][ T4230] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 202.731693][ T4230] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.749711][ T4230] usb 6-1: config 0 descriptor?? [ 203.315633][ T7724] udc-core: couldn't find an available UDC or it's busy [ 203.509128][ T7724] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 203.720352][ T4201] Bluetooth: hci2: Unknown advertising packet type: 0x72 [ 203.720404][ T4201] Bluetooth: hci2: Unknown advertising packet type: 0x130 [ 203.721128][ T4228] usb 6-1: USB disconnect, device number 3 [ 203.728255][ T4201] ================================================================== [ 203.749100][ T4201] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x12ea/0x3ca0 [ 203.756974][ T4201] Read of size 1 at addr ffff88805fa01409 by task kworker/u5:6/4201 [ 203.764954][ T4201] [ 203.767315][ T4201] CPU: 1 PID: 4201 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 203.774845][ T4201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 203.784884][ T4201] Workqueue: hci2 hci_rx_work [ 203.789552][ T4201] Call Trace: [ 203.792818][ T4201] [ 203.795736][ T4201] dump_stack_lvl+0x188/0x250 [ 203.800405][ T4201] ? show_regs_print_info+0x20/0x20 [ 203.805592][ T4201] ? load_image+0x410/0x410 [ 203.810077][ T4201] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 203.815527][ T4201] print_address_description+0x60/0x2d0 [ 203.821058][ T4201] ? hci_le_meta_evt+0x12ea/0x3ca0 [ 203.826157][ T4201] kasan_report+0xdf/0x130 [ 203.830566][ T4201] ? hci_le_meta_evt+0x12ea/0x3ca0 [ 203.835687][ T4201] hci_le_meta_evt+0x12ea/0x3ca0 [ 203.840612][ T4201] ? hci_event_packet+0x363/0x1310 [ 203.845757][ T4201] ? __lock_acquire+0x7b50/0x7b50 [ 203.850790][ T4201] ? hci_remote_host_features_evt+0x240/0x240 [ 203.856842][ T4201] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 203.862463][ T4201] ? mark_lock+0x94/0x320 [ 203.866782][ T4201] ? mutex_unlock+0x10/0x10 [ 203.871271][ T4201] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 203.877239][ T4201] ? lock_chain_count+0x20/0x20 [ 203.882074][ T4201] ? __rwlock_init+0x140/0x140 [ 203.886822][ T4201] hci_event_packet+0xe0b/0x1310 [ 203.891752][ T4201] ? _raw_spin_unlock+0x40/0x40 [ 203.896591][ T4201] ? rcu_lock_release+0x20/0x20 [ 203.901446][ T4201] ? hci_send_to_monitor+0x9c/0x4a0 [ 203.906631][ T4201] hci_rx_work+0x255/0xa10 [ 203.911047][ T4201] process_one_work+0x867/0xff0 [ 203.915904][ T4201] ? worker_detach_from_pool+0x240/0x240 [ 203.921517][ T4201] ? lockdep_hardirqs_off+0x70/0x100 [ 203.926794][ T4201] ? _raw_spin_lock_irq+0xb7/0xf0 [ 203.931805][ T4201] ? _raw_spin_lock_irqsave+0x100/0x100 [ 203.937337][ T4201] ? wq_worker_running+0x97/0x170 [ 203.942468][ T4201] worker_thread+0xad7/0x12a0 [ 203.947168][ T4201] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 203.953063][ T4201] kthread+0x42e/0x520 [ 203.957127][ T4201] ? rcu_lock_release+0x20/0x20 [ 203.961962][ T4201] ? kthread_blkcg+0xd0/0xd0 [ 203.966540][ T4201] ret_from_fork+0x1f/0x30 [ 203.970953][ T4201] [ 203.973958][ T4201] [ 203.976264][ T4201] Allocated by task 7724: [ 203.980569][ T4201] __kasan_kmalloc+0xaf/0xe0 [ 203.985143][ T4201] __alloc_skb+0x22c/0x750 [ 203.989539][ T4201] vhci_write+0xbd/0x440 [ 203.993766][ T4201] vfs_write+0x748/0xd70 [ 203.997990][ T4201] ksys_write+0x153/0x260 [ 204.002316][ T4201] do_syscall_64+0x4c/0xa0 [ 204.006713][ T4201] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 204.012587][ T4201] [ 204.014890][ T4201] The buggy address belongs to the object at ffff88805fa01000 [ 204.014890][ T4201] which belongs to the cache kmalloc-1k of size 1024 [ 204.028923][ T4201] The buggy address is located 9 bytes to the right of [ 204.028923][ T4201] 1024-byte region [ffff88805fa01000, ffff88805fa01400) [ 204.042704][ T4201] The buggy address belongs to the page: [ 204.048336][ T4201] page:ffffea00017e8000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5fa00 [ 204.058471][ T4201] head:ffffea00017e8000 order:3 compound_mapcount:0 compound_pincount:0 [ 204.066871][ T4201] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 204.074846][ T4201] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c41dc0 [ 204.083408][ T4201] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 204.091999][ T4201] page dumped because: kasan: bad access detected [ 204.098499][ T4201] page_owner tracks the page as allocated [ 204.104190][ T4201] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4188, ts 52532326256, free_ts 14436621809 [ 204.123270][ T4201] get_page_from_freelist+0x24f6/0x2670 [ 204.128823][ T4201] __alloc_pages+0x1ee/0x480 [ 204.133398][ T4201] new_slab+0xc0/0x4b0 [ 204.137452][ T4201] ___slab_alloc+0x807/0xdd0 [ 204.142027][ T4201] __kmalloc+0x11d/0x340 [ 204.146247][ T4201] __register_sysctl_table+0xe0/0x1240 [ 204.151699][ T4201] neigh_sysctl_register+0x9b2/0xa90 [ 204.156966][ T4201] addrconf_sysctl_register+0xac/0x1b0 [ 204.162412][ T4201] addrconf_notify+0x7cb/0xf20 [ 204.167155][ T4201] raw_notifier_call_chain+0xcb/0x160 [ 204.172507][ T4201] dev_change_name+0x676/0xc10 [ 204.177252][ T4201] do_setlink+0x9e7/0x29d0 [ 204.181650][ T4201] rtnl_newlink+0x15bb/0x1920 [ 204.186308][ T4201] rtnetlink_rcv_msg+0x82c/0xf00 [ 204.191227][ T4201] netlink_rcv_skb+0x1e9/0x430 [ 204.196057][ T4201] netlink_unicast+0x78f/0x940 [ 204.200803][ T4201] page last free stack trace: [ 204.205456][ T4201] free_unref_page_prepare+0x637/0x6c0 [ 204.210898][ T4201] free_unref_page+0x8f/0x2a0 [ 204.215560][ T4201] free_contig_range+0x96/0xf0 [ 204.220318][ T4201] destroy_args+0xef/0xa00 [ 204.224716][ T4201] debug_vm_pgtable+0x321/0x380 [ 204.229547][ T4201] do_one_initcall+0x272/0x730 [ 204.234332][ T4201] do_initcall_level+0x13d/0x1f0 [ 204.239602][ T4201] do_initcalls+0x4b/0x90 [ 204.243917][ T4201] kernel_init_freeable+0x3d5/0x560 [ 204.249103][ T4201] kernel_init+0x19/0x1b0 [ 204.253417][ T4201] ret_from_fork+0x1f/0x30 [ 204.257841][ T4201] [ 204.260147][ T4201] Memory state around the buggy address: [ 204.265756][ T4201] ffff88805fa01300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 204.273796][ T4201] ffff88805fa01380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 204.281837][ T4201] >ffff88805fa01400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 204.289874][ T4201] ^ [ 204.294182][ T4201] ffff88805fa01480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 204.302240][ T4201] ffff88805fa01500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 204.310364][ T4201] ================================================================== [ 204.318411][ T4201] Disabling lock debugging due to kernel taint [ 204.328114][ T4201] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 204.335578][ T4201] CPU: 1 PID: 4201 Comm: kworker/u5:6 Tainted: G B syzkaller #0 [ 204.344515][ T4201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 204.354658][ T4201] Workqueue: hci2 hci_rx_work [ 204.359354][ T4201] Call Trace: [ 204.359363][ T4201] [ 204.359369][ T4201] dump_stack_lvl+0x188/0x250 [ 204.359400][ T4201] ? show_regs_print_info+0x20/0x20 [ 204.359418][ T4201] ? load_image+0x410/0x410 [ 204.359439][ T4201] panic+0x2f8/0x850 [ 204.359456][ T4201] ? bpf_jit_dump+0xd0/0xd0 [ 204.359472][ T4201] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 204.359491][ T4201] ? _raw_spin_unlock+0x40/0x40 [ 204.359509][ T4201] ? hci_le_meta_evt+0x12ea/0x3ca0 [ 204.359527][ T4201] check_panic_on_warn+0x80/0xa0 [ 204.359544][ T4201] ? hci_le_meta_evt+0x12ea/0x3ca0 [ 204.359561][ T4201] end_report+0x6d/0xf0 [ 204.359577][ T4201] kasan_report+0x102/0x130 [ 204.359594][ T4201] ? hci_le_meta_evt+0x12ea/0x3ca0 [ 204.359612][ T4201] hci_le_meta_evt+0x12ea/0x3ca0 [ 204.359628][ T4201] ? hci_event_packet+0x363/0x1310 [ 204.359646][ T4201] ? __lock_acquire+0x7b50/0x7b50 [ 204.359666][ T4201] ? hci_remote_host_features_evt+0x240/0x240 [ 204.359684][ T4201] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 204.359701][ T4201] ? mark_lock+0x94/0x320 [ 204.359715][ T4201] ? mutex_unlock+0x10/0x10 [ 204.359730][ T4201] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 204.359749][ T4201] ? lock_chain_count+0x20/0x20 [ 204.359766][ T4201] ? __rwlock_init+0x140/0x140 [ 204.359782][ T4201] hci_event_packet+0xe0b/0x1310 [ 204.359801][ T4201] ? _raw_spin_unlock+0x40/0x40 [ 204.359817][ T4201] ? rcu_lock_release+0x20/0x20 [ 204.359835][ T4201] ? hci_send_to_monitor+0x9c/0x4a0 [ 204.359851][ T4201] hci_rx_work+0x255/0xa10 [ 204.359871][ T4201] process_one_work+0x867/0xff0 [ 204.359892][ T4201] ? worker_detach_from_pool+0x240/0x240 [ 204.359907][ T4201] ? lockdep_hardirqs_off+0x70/0x100 [ 204.359924][ T4201] ? _raw_spin_lock_irq+0xb7/0xf0 [ 204.359940][ T4201] ? _raw_spin_lock_irqsave+0x100/0x100 [ 204.359957][ T4201] ? wq_worker_running+0x97/0x170 [ 204.359971][ T4201] worker_thread+0xad7/0x12a0 [ 204.359987][ T4201] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 204.360005][ T4201] kthread+0x42e/0x520 [ 204.360017][ T4201] ? rcu_lock_release+0x20/0x20 [ 204.360032][ T4201] ? kthread_blkcg+0xd0/0xd0 [ 204.360044][ T4201] ret_from_fork+0x1f/0x30 [ 204.360064][ T4201] [ 204.360285][ T4201] Kernel Offset: disabled [ 204.574489][ T4201] Rebooting in 86400 seconds..