last executing test programs: 1m42.679887774s ago: executing program 3 (id=126): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) readv(r0, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/47, 0x2f}], 0x1) 1m42.501365492s ago: executing program 3 (id=132): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b00000005000000010001004900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r0, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f00000006c0), &(0x7f00000003c0)=""/14, 0x2}, 0x20) 1m42.469633469s ago: executing program 3 (id=134): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x434, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0xfff, 0x9, 0x3, 0x8, 0xa6, 0x7ff, 0x3, 0x4, 0x6, 0x5d01, 0x9, 0x9, 0x6, 0x1ff, 0x8000, 0x9, 0xfffffffa, 0x200, 0xfff, 0x1, 0x4, 0x6, 0x3, 0xb, 0x4, 0x5fe, 0x4, 0x9, 0x5, 0x7, 0x3, 0x4, 0xffffffff, 0x84, 0x400, 0x8000, 0x9, 0x2ff5, 0xffff, 0x7, 0x4, 0xd5, 0x4, 0x5, 0x8, 0x3ff, 0x4, 0x1, 0x8001, 0x8, 0xa85, 0x4, 0x7, 0x7, 0x1, 0x0, 0x8, 0xffff7fff, 0x1, 0xff, 0x7, 0x1, 0x4, 0x4, 0x0, 0xe6, 0x4, 0x1a, 0x1ff, 0xe, 0x55, 0x7, 0x6, 0x8000008, 0x400, 0x6, 0xffffffff, 0xfffffffe, 0x7, 0x0, 0x80000001, 0x400000, 0x6, 0x401, 0x3, 0x200, 0x1, 0x0, 0x6852, 0x10001, 0x0, 0x3, 0x4, 0xcb, 0xb0, 0xae, 0x8, 0x1, 0x80000000, 0x4, 0x0, 0x6, 0x8, 0x245, 0xfc, 0x8b, 0x80000000, 0x0, 0x5, 0x80000000, 0x5, 0x80000000, 0xa976362a, 0x9, 0x9, 0x8, 0xff, 0x80000000, 0x9, 0x8, 0xc869, 0xffff8001, 0xf7, 0x8, 0x40, 0x8, 0x1, 0xf1, 0x6, 0x7, 0x200, 0x2, 0x200, 0x8, 0x5, 0x8, 0x5, 0x7, 0x1, 0x9, 0x918, 0xc035, 0xe, 0x2, 0x3, 0x4, 0x5, 0x5, 0x7a60, 0x9d, 0xfffffffb, 0x1, 0x0, 0x5, 0x5, 0x1, 0x9, 0x8, 0x4, 0x6, 0xc93, 0x13e, 0xff, 0x4, 0x2, 0x7, 0xcd3, 0x6, 0x4, 0xe, 0xffffa776, 0x401, 0x4, 0x8000, 0x3, 0xdbf, 0x10001, 0x0, 0x4, 0x5683e473, 0x13, 0x81, 0xa187, 0x4, 0x1ff, 0x66c, 0x7ff, 0x3610, 0xfffffffd, 0x5, 0x0, 0x9, 0x5, 0xfffff801, 0x0, 0x81, 0xfffffffb, 0x401, 0x6, 0x6, 0xe, 0x101, 0x4, 0x9, 0x4, 0x97c, 0xdb, 0x1, 0x8, 0x7, 0x8, 0x4fbf, 0x160, 0x2, 0x1, 0x5, 0x3, 0x3, 0xfffffff9, 0x7, 0x8, 0x3, 0x4, 0xa, 0x4, 0x6, 0x400, 0x0, 0x9, 0x2d29, 0x1, 0xffffffff, 0x8001, 0x5, 0x7, 0x9, 0xa, 0xec, 0x5, 0x9, 0xffff8acb, 0x4, 0x9, 0x4, 0x2, 0xffffff35, 0x9, 0x8, 0x5, 0x9, 0x7fff, 0x1, 0x6b, 0x81, 0x1, 0x5]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x24000040}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="500000001000010000000000ecffffff00000000", @ANYRES32=r1, @ANYBLOB="0000000000000000300012800e0001006970366772657461700000001c00028006000f000000000006000e"], 0x50}}, 0x0) 1m42.439289016s ago: executing program 3 (id=135): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x117) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x103090, 0x0) mount$bind(&(0x7f0000001900)='.\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) umount2(&(0x7f0000000340)='./file0\x00', 0x1) 1m42.377798849s ago: executing program 3 (id=138): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setuid(0xee00) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) 1m42.276482001s ago: executing program 3 (id=140): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x4}, [@printk={@p, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0xa0}, {0x5}, {}, {}, {}, {0x85, 0x0, 0x0, 0x88}}]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000008000000070000000300000001000000", @ANYRES32], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={&(0x7f0000000180), &(0x7f0000000440)=""/179, &(0x7f0000000500), &(0x7f00000006c0), 0x3, r0}, 0x38) 1m42.223926072s ago: executing program 32 (id=140): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x4}, [@printk={@p, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0xa0}, {0x5}, {}, {}, {}, {0x85, 0x0, 0x0, 0x88}}]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000008000000070000000300000001000000", @ANYRES32], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={&(0x7f0000000180), &(0x7f0000000440)=""/179, &(0x7f0000000500), &(0x7f00000006c0), 0x3, r0}, 0x38) 1m4.746349561s ago: executing program 0 (id=969): r0 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x1) r1 = fcntl$dupfd(r0, 0x406, r0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 1m4.668464148s ago: executing program 0 (id=972): r0 = socket$packet(0x11, 0x3, 0x300) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) 1m4.619388428s ago: executing program 0 (id=973): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xa, 0x1d, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000d1000c0000000000010000b7080000000000007b8af8ff00000000b70800000b0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b6000000b7080000000000007b8af8ff00000000b7080000ff0300007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m4.553362292s ago: executing program 0 (id=975): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x404, &(0x7f0000000100)={[{@nodioread_nolock}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@errors_remount}, {@nombcache}, {@quota}, {@bh}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") mount$incfs(&(0x7f0000000300)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) chdir(&(0x7f0000000400)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1, 0x0) 1m4.362527313s ago: executing program 0 (id=980): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000240)='./file0\x00', 0x220408a, &(0x7f0000000340)=ANY=[@ANYBLOB="756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d312c696f636861727365743d6b6f69382d752c636f6465706167653d3933322c696f636861727365743d6575632d6a702c747a3d5554432c73686f72746e616d653d6d697865642c726f6469722c73686f72746e616d653d6c6f7765722c757466383d312c756e695f786c6174653d312c6e66732c73686f72746e616d653d6c6f7765722c73686f72746e616d653d77696e39352c00416786a537fd"], 0x1, 0x382, &(0x7f0000000400)="$eJzs3T+IHGUUAPC3mbvbu5DkthCCVqudICE5sdAqIUQIXqGRJf5pXMxFY3YN3OLCBczeNkqwEmwEU9mlsE0tFiJ2FrZGkKjYGLAIJjgyu7O7s38uf8A9I/5+RXh533v7fbMz3Mwed9+90YnzZxbj7M2bN2J5uRQLR48fjVulqMSeSKJvO2b6aGl2HgB4yN1K0/g97btn8UrsHYTu/QDw39W7/7+1f5Qo37U8TYr/u7xvbusCAObnPj//vzgze2FuywIA5mjq/v/E2PDEt/kXYuzzf6zMf4EAwD/u5Vdfe+HYesSpanU5ovlhu9auxXOj8WNn41w0YiMOx2rcieg/KPSfFrJ/nz+5fuJwNfNzJWpZR7sW0ey0a/0nhWNJnDvQiHIcidWo5P3psD/J+o/0+qsRsd3pzR/NUru22Pthg2z+H/bGRqzFajwy1R9xcv3EWjV/gVpz0N+J6Mby4CCy9R+K1fjuzbgQjTgTWe9o/ZeOVKvH0/Wx/vbVcq8OAAAAAAAAAAAAAAAAAAAAAADm4VB1qBL78v1v0man/cGpyYLK2P44tf5wvj9Qt78/UFou57vzXE4m9wca35+nXVuIPf/qkQMAAAAAAAAAAAAAAAAAAMDDo7W1FPVGY2OztXXxfDHoFDLvfvPFVysxGFrIW99JRl2RJ8deZ1BYeOUkhlOkw/Y0GavJgyRiULxdv3ptuOJiTXl4FFPtWVCeGirla6o3Gvsf/+mzWV1/ZcF2L5PE1NsyHpTy+QtDzQNZYjki7uzUtXOwdo+a62maZsFiPm+x5tKnxeI/08ZGvhVD54GXsWciU9qeqvn6xtuPPt06+Ewv82U+05NPrZ6+/snnv56vN6I7WOHSZutOevdJ007EVpQihqcpBqcpKVw/pfx9XptxJcwOuqNMd7O1VU++/+2Vxz7+dqI4mX39pMXMezOneP/KH6d7J2NsaKkflCIq06dpOliccfHPDl6/Pbx6H/icXjx45Wj92qUff5lVk73fk12FLxI26gAAAAAAAAAAAAAAAAAAgF0x+qXfiYE0TTs7dj370twXBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7aPT3/wtBdypzP8HtTkwPlTc2WztOvrKrhwoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP/Y3wEAAP//hZFyww==") r0 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r0, 0x0, 0x0) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 1m3.663049173s ago: executing program 0 (id=989): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x14b100, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) read$ptp(r0, &(0x7f00000005c0)=""/117, 0x75) 1m3.535080971s ago: executing program 33 (id=989): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x14b100, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) read$ptp(r0, &(0x7f00000005c0)=""/117, 0x75) 37.055953062s ago: executing program 4 (id=1795): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x0) 37.006900653s ago: executing program 4 (id=1797): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0a000000040000000800000002"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000bc7a007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000840)={{r0}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 36.977503649s ago: executing program 4 (id=1799): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000100)=@newtaction={0x14, 0x30, 0x9}, 0x14}}, 0x20000084) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000600)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0xfffdf00c}, {0x6}]}, 0x10) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) 36.868777482s ago: executing program 4 (id=1801): mount$incfs(&(0x7f0000000b40)='\x00', &(0x7f0000000b80)='.\x00', &(0x7f0000000bc0), 0x800041, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) umount2(&(0x7f0000000040)='.\x00', 0x2) 36.818841823s ago: executing program 4 (id=1802): socket$packet(0x11, 0x2, 0x300) r0 = socket$inet_tcp(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f0000000100)={0x6, 0x2, 0x1000, 0x0, 0x801, 0x100}, 0x0, &(0x7f0000000240)={0x1e, 0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) 36.556553189s ago: executing program 4 (id=1806): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xe, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1080, 0x9, 0x5, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x9, 0x4, 0x2, 0x762, 0x3, 0x80, 0x3, 0x2b12, 0x100, 0x6, 0x1c04, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x80000000, 0x8, 0x79b, 0x2, 0x1, 0x7d, 0x8, 0x2, 0x7, 0xd, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x8, 0x180000, 0x400a, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x5, 0x6, 0x9, 0x9, 0xb, 0x4009, 0x0, 0x4, 0xffffff01, 0x8, 0x752, 0x0, 0x1005, 0x5, 0x10001, 0x2, 0xffffffff, 0x6, 0x4, 0x9, 0x7ffffffe, 0xfdffffff, 0xfffffffe, 0x2, 0x84, 0x800100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0xffffffff, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x2, 0x2, 0x5, 0x1, 0x0, 0x0, 0x2, 0x40, 0x8, 0x4, 0x3, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) unshare(0x22020600) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 36.541831803s ago: executing program 34 (id=1806): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xe, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1080, 0x9, 0x5, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x9, 0x4, 0x2, 0x762, 0x3, 0x80, 0x3, 0x2b12, 0x100, 0x6, 0x1c04, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x80000000, 0x8, 0x79b, 0x2, 0x1, 0x7d, 0x8, 0x2, 0x7, 0xd, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x8, 0x180000, 0x400a, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x5, 0x6, 0x9, 0x9, 0xb, 0x4009, 0x0, 0x4, 0xffffff01, 0x8, 0x752, 0x0, 0x1005, 0x5, 0x10001, 0x2, 0xffffffff, 0x6, 0x4, 0x9, 0x7ffffffe, 0xfdffffff, 0xfffffffe, 0x2, 0x84, 0x800100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0xffffffff, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x2, 0x2, 0x5, 0x1, 0x0, 0x0, 0x2, 0x40, 0x8, 0x4, 0x3, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) unshare(0x22020600) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 16.382268513s ago: executing program 6 (id=2299): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000022c0)={0x2020}, 0x2020) pread64(r0, &(0x7f00000001c0)=""/149, 0x95, 0x1000306) read$eventfd(r0, &(0x7f0000000000), 0x63) 16.360847887s ago: executing program 6 (id=2300): userfaultfd(0x80801) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000380)={0x6, 0x2000027, 0x20000000, 0x1}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c0000800800", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) 16.346509071s ago: executing program 6 (id=2301): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x66, &(0x7f00000001c0)={@local, @random="6c22c7f3e9bb", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010700", 0x30, 0x11, 0x0, @private1, @mcast2, {[], {0x0, 0xe22, 0x30, 0x0, @wg=@data={0x4, 0x80000001, 0x7, "d69ccf0131b5a2cfe8da65c267ec09fa4a2733b5621038d6"}}}}}}}, 0x0) 16.332364254s ago: executing program 6 (id=2302): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x50, &(0x7f0000000580)=ANY=[@ANYBLOB="6e6f646973636172642c6e6f636865636b706f696e745f6d657267652c6661756c745f747970653d30303030303030303030303030303033323736372c6d656d6f72793d6c6f772c666c7573685f6d657267652c6661756c745f696e6a656374696f6e3d30303030303030303030303030303030313236322c61636c2c6e6f61636c2c636f6d70726573735f63616368652c646973636172642c6e6f657874656e745f63616368652c6e6f71756f74612c636865636b706f696e743d64697361626c652c00363101be2f2414c1ff59cf0ff87782bcde43f7989389b5df0c89a39b9879753e01c3936df8f39b60655e3609ad58e855a62cde73be8487d7f660b8da7993b53c4bea49f4e3f2d6b81984f7eeaafb913ce47a483219b0f7b60a2b1f30eb272e8137a471ec62a32d98bb77dfeb8bb0c56400"/344], 0x4, 0x5525, &(0x7f00000014c0)="$eJzs3EtvG1UUAODrPNqmLSVCLNh1pAopQbUV51HBLkArHiJVVGDBChzbsdzanih2nJAVC5aIBf8EgcSKJb+BBWt2iAWIHRLIc8eQQEFImcSk+T5pfOZeX58516oqnZnIAbiw5pNffiqFG2EuhDAdQrgeQigdOTLrMTyXH1NHjlI+98fEpRDC1RDCjVHymLOUv/XZ7eGttR/f/Pnrby/PXPv8q+8mt2tg0p4PIXR34vl+N8a0FePDfL42bGexuzrMY3yj+ygfpzHuN7eyDPu18bpaFldacX26s9cfxe1OrT6KrfZ2Nr/TixfsD1vjPNkHHtZ2s3GjuZXFdj/NYusw1nVwGP9vO+wPYp5Gnu/DLH0YDMYxzjcPmnE/O4+yWO8N8vmYN200D0ZxmMf8cqGedhpZHVsn+ab/395q9/YOkmFzt99Oe8lapfpipXqnXN1NG81Bc7Vc6zburCYLrc5oWXnQrHXXW2na6jQr9bS7mCy06vVytZos3G1utWu9pFqtrFSWymuL+dnt5LX77yadmbAwiq+0e3uDdqefbKe7SfzEYrJcWXlpMblVTd7e2Ew2H9y7t7H5zvt337v/8sYbr+aL/lbWC2F5aXm5XF0qL1cXz8H+G0kx+/84LzpZKGz/cCKlSRcAcP48rv+f+5f+/6b+HyjA6fX/uw9COP3+P+j/C3Gu+t9xWQX2vxd9/3Ai+n8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAvr+9kvXs9O5uP4Wj7/VD71TD4uhRCmQgi/PcZ0uHQs53SeZ/Yf1s/+pYZvSiHLMLrG5fy4GkJYz49fnz7tbwEAAACeXF9+dPPT2K3Hl/lJF8RZijdtpq5/UFC+Ughhdv6HgrJNjV6eLShZ9u97JhwUlC27gXWloGTxlttMUdn+k+lj4cqRUIph6kzLAQAAzsTxTuBsuxAAAADO0ieTLoDJKIXxo8zxs+DsL+//fCA4d2wEAAAAnEOlSRcAAAAAnLqs//f7fwAAAPBki7//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv7NzP7lpA1EcgJ8NLvSfiqrue5Xu4Bg9QpddVhygl+AAXdAr5AKcgexyhAgi7IkDEYtIHttK9H2SGRmZH88IFm9GDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCn22q7+v/n+9+uOYdjN3nuBgAAALhmX21XEVEcUgv+MT3/OSIWEfE1nRcRUUbEtd59Eu8uMicpp3q6/t/59dWzGm4i6oTTe8zS8SEifqTj/ssAHwQAAAC8Ubv1Ztl0683DYuyCGFIzaVN++pkpr4iIanGXKa085X3LFFZ/v6fxO1NaPYE1zxTWTLlNc6W9SP1zb2ft5mdD0Qzl1Ze1RWa7dwAAYECTi2HYLgQAAIAh/Rq7AMZRxONSZrsUOGuGtLz3/uIMAAAAeIWKsQsAAAAAelf3/2n/v/bP/z3t/3e0/x8AAACMo9n/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD7tq+1qt94su+Ycjt3kuRsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCB/XlHgRAIgzDYu74zmfsfVho0NTWpAuHjbwwGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAN7/7y/+JqXEmmXttLD2PJGunxtapsXduHP1hfP0aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC725yUFQiAIomDO+N9J3/+wkqBnECECGh5V1KIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCLfvfL/4mpcSaZO20sHY8ka1eNravG3oPG0YPx9m8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC527uc1jioOAPibmZ2NqYprlD1ERMGDXux2W1t7Ew9K8OCfIIR0W2O3/mhzsKWIuXiTnHsRPYoISrz1f+i5hV7qrYc9RPAcmdmZ3ckPcDU6s00+H3jzvjsM733fLIR8500CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUBq9O42T7NAZx3Fx7v7O7bWsf7Cvz9zderictSyO6kz6yfBy9UPUnYQ7TSQDAADAyZCU9X0I4VG6vZL1cSev/9Pymqzm//7ZcVzW8/vr/rIva/+s/fbr4xcnE3XG82SDXl4fDs4cTKX1/61yvj33t1e08jufP3tJ8i8k/mDzhVGa38/o23v33mvn4UId2QIA/8bpsi+C8vehrO83mRgAx9piJW5VCu+y/k86zeQFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUKfRZni6jKMQwnJrGmce7NxeO6y/u/VwuWwX7tzZCl9Px8yGSEMIl9eHgzO1rma+3bh56+rqcDi4Xn/wSgihqdnfKZZ/9aMZLg6hkfsj+G+C3YXiy56TfGoK4iOO0+APJQAAjqW0aFld/yjdXsnORUsh7P6wt/5/vRKHGev/xx9fuF+dq1r/92tb4fzrbVz7vHfj5q0316+tXhlcGXz61tn+2/1zF8+fv9jLn5X0PDEBAADgaNpFq9b/8dLB/f9TlTjMWP9/8V3/q+pcifr/UNNNv6YzAQAAONmef/XPP6JDzkftdvhydWPjen98nHw+Oz42kOo/tlC0av2fLDWdFQAAAFCH0Wa0Z///UiUOM+7/P/PjSz9Xx0xCCIvF/v/ptc+Gl+pbzlyr46+Rm14jAAAAzVosWnX/P83f/48nrzzEIYQ3XhvHxb8BnKn+T97/5qfqXNX3/8/Vt8S5FHfH9yPvuyG0uk1nBAAAwHH2VNGyYv/3dHvlk19Ofdj2/j8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA3f4KAAD///2uQe0=") openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x13) mount$bind(&(0x7f0000002cc0)='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x81001, 0x0) stat(&(0x7f0000003480)='./file0\x00', &(0x7f0000000140)) 15.948880096s ago: executing program 6 (id=2307): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="0100000004000000080000000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0xc, &(0x7f0000000200)=@framed={{}, [@generic={0x7a, 0xa, 0x0, 0xfffffff0}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4, 0x0, 0x0, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 15.360542403s ago: executing program 6 (id=2309): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000002000010026bd7000ffffffff0a14204003000006fffffff014000100ff020000000000000000000000000001140002"], 0x44}, 0x1, 0x0, 0x0, 0x40814}, 0x4000004) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x0) 15.344706096s ago: executing program 35 (id=2309): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000002000010026bd7000ffffffff0a14204003000006fffffff014000100ff020000000000000000000000000001140002"], 0x44}, 0x1, 0x0, 0x0, 0x40814}, 0x4000004) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x0) 1.551488486s ago: executing program 7 (id=2657): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="10031400e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) 1.494844748s ago: executing program 7 (id=2659): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) r1 = dup(r0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000080}, 0x4840) ioctl$PTP_EXTTS_REQUEST2(r1, 0x40383d0c, &(0x7f0000000040)={0x8, 0x4}) 1.381121393s ago: executing program 7 (id=2660): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) pipe2(&(0x7f0000001cc0), 0x800) 1.231655125s ago: executing program 8 (id=2665): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000500)=ANY=[], 0x6a) 1.162787809s ago: executing program 8 (id=2669): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000640)={0x2, {{0x2, 0x12, @multicast2}}, 0x1, 0x1, [{{0x2, 0x4e21, @empty}}]}, 0x110) 1.084487206s ago: executing program 8 (id=2670): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_SREGS2(r2, 0x4140aecd, &(0x7f0000000140)={{0x26000, 0xffff1000, 0xf000, 0x9, 0x7f, 0xe3, 0x81, 0xff, 0x0, 0x84, 0x4, 0xb}, {0xd000, 0xd000, 0x10, 0x3, 0x3, 0x7, 0x5, 0x6, 0x1, 0x4, 0xfa, 0x5}, {0xf000, 0x8000000, 0x4, 0x4, 0x11, 0x81, 0x0, 0x5, 0x5, 0x4, 0x92, 0x9}, {0x40000, 0xeeef0000, 0x1b, 0x7, 0x1, 0xfa, 0x0, 0x0, 0xfa, 0x29, 0x9, 0x9}, {0xeeee8000, 0x0, 0xf, 0x9, 0x1, 0x2, 0x7, 0xf1, 0x2, 0x6e, 0x0, 0x8}, {0x4000, 0x80a0000, 0x10, 0x2, 0xad, 0x2, 0x5, 0x4, 0x1, 0xe, 0x6, 0xa}, {0x10000, 0x10000, 0xc, 0x0, 0xcd, 0x5, 0x5, 0x26, 0xa, 0x6, 0xff, 0x6}, {0x1, 0xeeef0000, 0xb, 0xe, 0x13, 0x1a, 0x3, 0x0, 0x7f, 0x7, 0x2, 0x8}, {0x100000, 0x405}, {0xeeef0000, 0xff81}, 0xe0000031, 0x0, 0x6000, 0x61, 0x5, 0xa800, 0x800f900, 0x1, [0x6257, 0x2, 0x8000000000000003, 0xc]}) 984.446438ms ago: executing program 1 (id=2677): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x40000084, 0x0, 0x1}]}) 944.856276ms ago: executing program 8 (id=2678): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r0, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4e24, 0x10, @mcast2}, 0x4a) sendto$inet6(r0, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) 844.387658ms ago: executing program 8 (id=2682): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f00000001c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) pread64(r0, &(0x7f0000000040)=""/79, 0x4f, 0x1b) 844.253388ms ago: executing program 8 (id=2683): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000080)={{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x16, {0x2, 0x4e20, @private}, 'syz_tun\x00'}) 831.591911ms ago: executing program 2 (id=2684): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x94) 756.337067ms ago: executing program 2 (id=2687): r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) writev(r0, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000ffffffffffff", 0x58}], 0x1) 756.258867ms ago: executing program 1 (id=2688): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000300)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) 735.297422ms ago: executing program 7 (id=2689): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/vm/compaction_proactiveness\x00', 0x1, 0x0) write$P9_RATTACH(r0, 0x0, 0x0) 718.193035ms ago: executing program 1 (id=2690): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000000, 0x8031, 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) write$FUSE_STATX(r1, &(0x7f0000004000)={0x130, 0xfffffffffffffffe, 0x0, {0x801e, 0x0, 0x0, '\x00', {0x400, 0x1, 0x9, 0x23eecb0e, 0x0, 0x0, 0x4000, '\x00', 0x7a3, 0x9, 0x3374, 0x8, {0x2, 0x4}, {0x2, 0x2}, {0x100, 0x101}, {0x8, 0x7}, 0x3, 0x8000000, 0x1, 0x8000}}}, 0x130) 667.552526ms ago: executing program 7 (id=2691): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) uname(&(0x7f0000000180)=""/224) 667.011146ms ago: executing program 2 (id=2692): r0 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f00000001c0), 0x10) listen(r0, 0x0) accept4$unix(r0, 0x0, 0x0, 0x0) 610.744498ms ago: executing program 2 (id=2694): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x203, 0xa0402) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000400)={0x23, 0x3, 0x10, 0x1, 0x0, 0x8, 0x0}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCOUTQ(r1, 0x4bfb, 0x0) 552.235051ms ago: executing program 1 (id=2696): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x0, 0x0, 0x57b2}, [@TCA_NETEM_JITTER64={0xc, 0xb, 0x3}, @TCA_NETEM_ECN={0x8, 0x7, 0x1}]}}}]}, 0x60}}, 0x0) 524.843527ms ago: executing program 2 (id=2697): bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0xf400}, 0x90) 521.212378ms ago: executing program 1 (id=2698): r0 = socket$netlink(0x10, 0x3, 0x0) syz_read_part_table(0x5e4, &(0x7f0000000000)="$eJzs3D2LXFUYB/D/uXfeFiLrBxBcSCMKRrETF2Oha7og2gnaWqxILMRCdgcVwZcPYCtaGIUQawUFCWKsrERYYiFib2GacGTuy0xAsZlFCfx+xZznnHue57mXe9sz4c5Wd5Nakuvd7KO2GybNw33wW/L2NFm+8EQy7xOmQ2JJ8tzlJ5+6sHexzNdrq9Xj4ep802U2jJPsDdGXk3xw+eCdLj5OyVGGMNPPZ5ms9tY+78O/3/TNkrbbw/9s8nXtX8QsP+aLJIelXb38ebLMJ8ndWXT7ziVpa63daz5OdpJ2/VVs4cr+teXjQ7yT4Uub9rOjd0t9aLg2Ta21Njk6O2a2yT2Pnbv0T0W7/GX3eONSrXV6ZsxtNhcOb80mw+yR7345ynKxrp7abEqe7CSvnDzzYHcnpa8x3f7xAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Zfe9ev83zTg53/2Wdfz0p2k2W49z7zreW5xS/yv713bffOtSk9f3X/rp5Td+Pfg9fyRp2xycSebrfS/2w9X3umEyrLZb9z+81cw++/jbnfXCULok35/9+WYdO5wM42uP3pa832zdHwAAAAAAAAAAAAAAAAAAAFau5sLexSbPfnWj5PlsjvvXLJJSxukiqbXWP2tnPPz/w3gOP9dvpKySUsvt1c8nu3cldf7+A93fCvSJtdZJ16L8J4/Iv/grAAD//x/vY/E=") mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) writev(r0, &(0x7f0000000100)=[{0x0}], 0x1) 483.378276ms ago: executing program 2 (id=2700): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x2e3}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdd52, 0x40000, 0x2, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x4020, 0x8, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x12, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) 373.621739ms ago: executing program 5 (id=2702): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x7, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00'}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000002c0), r0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="c8010000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001000000060006000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5426c010880f4000080060005000180000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff240002001bc715ee4868b12a49f4df11bc05475489f6a27c4d6483ad2fa5e45903b0ce851400040002000000ac1414aa00000000000000008c00098028000080060001000a00000014000200ff020000000000000000000000000001050003000000000028000080060001000a000000140002000000000000000000000000000000000105000300030000001c000080060001000a00da0008000200e0f4ff0105000300000000001c000080060001000200000008000200ac141400050003000000000074000080200004000a004e2200000000fc0000000000000000000000000000000400000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000100000024000200cde20bc0d9b90ac13642d7b66459dd9db5e20b4b16d3d23f2cb03a8aa417dce6080007000000000014000200776730"], 0x1c8}}, 0x0) 316.676822ms ago: executing program 1 (id=2703): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xeef, 0x72c4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000580)={0x0, 0x22, 0x18, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @main=@item_4={0x3, 0x0, 0xa, "33c7827a"}, @main=@item_4={0x3, 0x0, 0xb, "2d29195c"}, @local=@item_012={0x2, 0x2, 0x2, "acf6"}, @main=@item_012={0x2, 0x0, 0xa, "8d00"}, @global=@item_012={0x0, 0x1, 0x9}, @main=@item_4={0x3, 0x0, 0x8, "aa78b033"}]}}, 0x0}, 0x0) 240.468438ms ago: executing program 5 (id=2704): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000dc0)={0xa8, 0x0, 0x2, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0x94, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_TUPLE={0x8c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @loopback}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}]}, 0xa8}}, 0x10) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000006c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 210.134734ms ago: executing program 5 (id=2705): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000780)={0x34, 0x0, 0x1, 0x0, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_MLSCATLST={0x8, 0xc, 0x0, 0x1, [{0x4}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01fffc00000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004"], 0x38}}, 0x0) 157.096876ms ago: executing program 5 (id=2706): open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x10) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="2900000003000000000000000000000001000000000000000800008d"], 0x29) 79.322773ms ago: executing program 5 (id=2707): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448dc, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 78.748143ms ago: executing program 7 (id=2708): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000001040)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast2}, 0x20000003}}, 0x2e) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, 0x0) 0s ago: executing program 5 (id=2709): r0 = epoll_create1(0x80000) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000180)={[0x9]}, 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000140)={0xe000200c}) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) kernel console output (not intermixed with test programs): [ 77.013305][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 77.059472][ T3183] ip_tables: iptables: counters copy to user failed while replacing table [ 77.268994][ T309] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 77.472071][ T309] usb 3-1: Using ep0 maxpacket: 16 [ 77.478480][ T309] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 77.486759][ T309] usb 3-1: config 0 has no interface number 0 [ 77.492865][ T309] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 77.502865][ T309] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 77.514663][ T309] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 77.523836][ T309] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.531918][ T309] usb 3-1: Product: syz [ 77.536184][ T309] usb 3-1: Manufacturer: syz [ 77.540810][ T309] usb 3-1: SerialNumber: syz [ 77.546008][ T309] usb 3-1: config 0 descriptor?? [ 77.551363][ T3177] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 77.558786][ T3177] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 77.782805][ T3177] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 77.790142][ T3177] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 77.997821][ T3219] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 78.025744][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 78.216318][ T3243] input: syz1 as /devices/virtual/input/input13 [ 78.232573][ T309] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 78.249889][ T309] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read software interface selection register: -71 [ 78.274245][ T309] asix: probe of 3-1:0.251 failed with error -71 [ 78.286774][ T309] usb 3-1: USB disconnect, device number 5 [ 78.396428][ T3267] device-mapper: ioctl: only supply one of name or uuid, cmd(4) [ 78.565159][ T3286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1247'. [ 78.574571][ T3286] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1247'. [ 78.631232][ T3292] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1250'. [ 78.660092][ T3295] EXT4-fs: Ignoring removed orlov option [ 78.668703][ T3295] EXT4-fs (loop5): ext4_check_descriptors: Inode bitmap for group 0 not in group (block 48900)! [ 78.692639][ T3295] EXT4-fs (loop5): group descriptors corrupted! [ 78.708743][ T3298] user requested TSC rate below hardware speed [ 78.765177][ T3308] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 79.016842][ T3340] set_capacity_and_notify: 6 callbacks suppressed [ 79.016860][ T3340] loop6: detected capacity change from 0 to 256 [ 79.070589][ T3343] loop1: detected capacity change from 0 to 512 [ 79.080643][ T3343] EXT4-fs error (device loop1): ext4_orphan_get:1405: inode #15: comm syz.1.1272: inode has both inline data and extents flags [ 79.095267][ T3343] EXT4-fs error (device loop1): ext4_orphan_get:1410: comm syz.1.1272: couldn't read orphan inode 15 (err -117) [ 79.107513][ T3343] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 79.144114][ T289] EXT4-fs (loop1): unmounting filesystem. [ 79.192468][ T757] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 79.396577][ T757] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 79.416957][ T757] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 79.452149][ T757] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 79.501045][ T757] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 79.531678][ T757] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 79.545236][ T757] usb 3-1: Product: syz [ 79.551334][ T757] usb 3-1: Manufacturer: syz [ 79.570267][ T757] usb 3-1: SerialNumber: syz [ 79.641517][ T28] kauditd_printk_skb: 10 callbacks suppressed [ 79.641533][ T28] audit: type=1400 audit(1790643623.435:415): avc: denied { append } for pid=3378 comm="syz.1.1288" name="rtc0" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 79.775732][ T3386] loop1: detected capacity change from 0 to 256 [ 79.809751][ T3386] exfat: Deprecated parameter 'utf8' [ 79.817385][ T757] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 6 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 79.844512][ T3386] exfat: Deprecated parameter 'namecase' [ 79.846163][ T757] usb 3-1: USB disconnect, device number 6 [ 79.861701][ T3386] exfat: Deprecated parameter 'namecase' [ 79.872476][ T3386] exfat: Deprecated parameter 'namecase' [ 79.888988][ T757] usblp0: removed [ 79.894783][ T3386] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 79.926291][ T3309] loop5: detected capacity change from 0 to 131072 [ 79.955709][ T28] audit: type=1400 audit(1790643623.725:416): avc: denied { mounton } for pid=3385 comm="syz.1.1291" path=2F3235322F131377C5FC35D41454D5D41D29AD1A6029598146E6BE166E41AD0DBD4054033C9F33BBDA8224A2F3D772E7636E48B33CBF708372E8F1B9933EC5127743BE2206209EF02DF9CBF2F6E880D3382F66696C6530 dev="loop1" ino=1048689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 79.978903][ T3309] F2FS-fs (loop5): Test dummy encryption mode enabled [ 80.051836][ T3309] F2FS-fs (loop5): invalid crc value [ 80.080754][ T3309] F2FS-fs (loop5): Found nat_bits in checkpoint [ 80.175593][ T3309] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 80.244799][ T3309] fscrypt: AES-256-XTS using blk-crypto-fallback [ 80.307549][ T3411] loop1: detected capacity change from 0 to 512 [ 80.319322][ T3411] EXT4-fs (loop1): Test dummy encryption mode enabled [ 80.336474][ T3363] loop4: detected capacity change from 0 to 131072 [ 80.343604][ T3411] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 80.353915][ T3363] F2FS-fs (loop4): invalid crc value [ 80.368127][ T3411] EXT4-fs (loop1): 1 truncate cleaned up [ 80.383032][ T3411] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 80.389664][ T3363] F2FS-fs (loop4): Found nat_bits in checkpoint [ 80.466345][ T3363] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 80.497272][ T289] EXT4-fs (loop1): unmounting filesystem. [ 80.516714][ T28] audit: type=1400 audit(1790643624.239:417): avc: denied { sys_module } for pid=3362 comm="syz.4.1281" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 80.518060][ T3363] Invalid ELF header magic: != ELF [ 80.577309][ T28] audit: type=1400 audit(1790643624.239:418): avc: denied { module_load } for pid=3362 comm="syz.4.1281" path="/257/file1/bus" dev="loop4" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=system permissive=1 [ 80.606916][ T3428] loop2: detected capacity change from 0 to 512 [ 80.657676][ T3428] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1309: invalid indirect mapped block 256 (level 2) [ 80.756916][ T3428] EXT4-fs (loop2): 2 truncates cleaned up [ 80.774430][ T3428] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 80.830577][ T3428] EXT4-fs error (device loop2): ext4_validate_block_bitmap:429: comm syz.2.1309: bg 0: block 5: invalid block bitmap [ 80.877782][ T3428] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 80.904458][ T3428] EXT4-fs (loop2): This should not happen!! Data will be lost [ 80.904458][ T3428] [ 80.914653][ T3428] EXT4-fs (loop2): Total free blocks count 0 [ 80.924434][ T3428] EXT4-fs (loop2): Free/Dirty block details [ 80.930374][ T3428] EXT4-fs (loop2): free_blocks=0 [ 80.936048][ T3428] EXT4-fs (loop2): dirty_blocks=65 [ 80.941195][ T3428] EXT4-fs (loop2): Block reservation details [ 80.947265][ T3428] EXT4-fs (loop2): i_reserved_data_blocks=65 [ 80.969046][ T291] EXT4-fs (loop2): unmounting filesystem. [ 81.153863][ T3475] loop4: detected capacity change from 0 to 512 [ 81.229527][ T3475] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 81.268082][ T3475] ext4 filesystem being mounted at /258/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 81.344717][ T290] EXT4-fs (loop4): unmounting filesystem. [ 81.403768][ T3504] fuse: Bad value for 'group_id' [ 81.450658][ T3510] loop6: detected capacity change from 0 to 128 [ 81.785661][ T28] audit: type=1400 audit(1790643625.437:419): avc: denied { read } for pid=3543 comm="syz.4.1359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 81.846219][ T3550] loop1: detected capacity change from 0 to 512 [ 81.852789][ T3549] binder: 3548:3549 ioctl c0306201 200000000640 returned -22 [ 81.875707][ T3550] EXT4-fs (loop1): 1 truncate cleaned up [ 81.889219][ T3550] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 81.934633][ T289] EXT4-fs (loop1): unmounting filesystem. [ 82.031121][ T3546] syz.6.1360 (3546) used greatest stack depth: 18408 bytes left [ 82.063454][ T3565] incfs: Can't find or create .incomplete dir in ./file0 [ 82.100842][ T3565] incfs: mount failed -28 [ 82.354459][ T3574] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.361783][ T3574] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.369701][ T3574] device bridge_slave_0 entered promiscuous mode [ 82.377063][ T3574] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.384231][ T3574] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.392147][ T3574] device bridge_slave_1 entered promiscuous mode [ 82.469703][ T3574] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.476915][ T3574] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.484290][ T3574] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.491344][ T3574] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.528375][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.536517][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.550965][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.584788][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.607676][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.614806][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.625684][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.634369][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.641446][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.660446][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.684961][ T8] device bridge_slave_1 left promiscuous mode [ 82.692793][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.711498][ T8] device bridge_slave_0 left promiscuous mode [ 82.728516][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.741416][ T8] device veth1_macvtap left promiscuous mode [ 82.760777][ T8] device veth0_vlan left promiscuous mode [ 82.916445][ T3592] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 82.937919][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.945911][ T3592] EXT4-fs (loop4): Test dummy encryption mode enabled [ 82.958894][ T3588] F2FS-fs (loop2): fault_injection options not supported [ 82.966903][ T3588] F2FS-fs (loop2): fault_type options not supported [ 82.989664][ T3592] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 83.000839][ T3592] System zones: 0-5 [ 83.004746][ T3588] F2FS-fs (loop2): invalid crc value [ 83.051315][ T3592] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 83.061061][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.072577][ T3588] F2FS-fs (loop2): Found nat_bits in checkpoint [ 83.115505][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.123702][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.139751][ T3592] fs-verity (loop4, inode 13): Unsupported log_blocksize: 13 [ 83.147353][ T3588] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 83.167996][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.184099][ T3574] device veth0_vlan entered promiscuous mode [ 83.213235][ T290] EXT4-fs (loop4): unmounting filesystem. [ 83.247490][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.261792][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.278518][ T3574] device veth1_macvtap entered promiscuous mode [ 83.290981][ T3613] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 83.308711][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 83.316684][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 83.317767][ T3613] ext4 filesystem being mounted at /110/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 83.340149][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 83.360822][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 83.369247][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.434221][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 83.468889][ T3623] device veth0 entered promiscuous mode [ 83.503945][ T3623] device veth0 left promiscuous mode [ 83.635681][ T28] audit: type=1400 audit(1790643627.168:420): avc: denied { ioctl } for pid=3641 comm="syz.4.1399" path="socket:[30725]" dev="sockfs" ino=30725 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 83.762524][ T28] audit: type=1400 audit(1790643627.225:421): avc: denied { watch_reads } for pid=3645 comm="syz.6.1402" path="/113/file0" dev="tmpfs" ino=617 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 83.809257][ T3658] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 83.823636][ T3658] System zones: 1-12 [ 83.828626][ T3658] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #12: comm syz.2.1409: missing EA_INODE flag [ 83.842398][ T3658] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.1409: error while reading EA inode 12 err=-117 [ 83.855292][ T3658] EXT4-fs (loop2): 1 orphan inode deleted [ 83.861073][ T3658] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 83.893388][ T291] EXT4-fs (loop2): unmounting filesystem. [ 83.923280][ T3668] EXT4-fs: Ignoring removed oldalloc option [ 83.948006][ T3668] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 83.989733][ T3574] EXT4-fs (loop5): unmounting filesystem. [ 84.019697][ T3679] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1416'. [ 84.039382][ T3670] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 84.126214][ T290] EXT4-fs (loop4): unmounting filesystem. [ 84.368310][ T3708] FAT-fs (loop2): Directory bread(block 64) failed [ 84.374905][ T3708] FAT-fs (loop2): Directory bread(block 65) failed [ 84.407353][ T3708] FAT-fs (loop2): Directory bread(block 66) failed [ 84.442682][ T3712] set_capacity_and_notify: 8 callbacks suppressed [ 84.442889][ T3708] FAT-fs (loop2): Directory bread(block 67) failed [ 84.457343][ T3712] loop4: detected capacity change from 0 to 1024 [ 84.468411][ T3712] EXT4-fs: Ignoring removed bh option [ 84.485585][ T3712] ext2: Unknown parameter 'mask' [ 84.490904][ T3708] FAT-fs (loop2): Directory bread(block 68) failed [ 84.512590][ T3708] FAT-fs (loop2): Directory bread(block 69) failed [ 84.526649][ T3708] FAT-fs (loop2): Directory bread(block 70) failed [ 84.554760][ T3708] FAT-fs (loop2): Directory bread(block 71) failed [ 84.572753][ T3708] FAT-fs (loop2): Directory bread(block 72) failed [ 84.587452][ T3708] FAT-fs (loop2): Directory bread(block 73) failed [ 84.652786][ T3708] syz.2.1431: attempt to access beyond end of device [ 84.652786][ T3708] loop2: rw=524288, sector=1192, nr_sectors = 4 limit=256 [ 84.667300][ T3708] syz.2.1431: attempt to access beyond end of device [ 84.667300][ T3708] loop2: rw=0, sector=1192, nr_sectors = 4 limit=256 [ 84.756818][ T3738] netlink: 8964 bytes leftover after parsing attributes in process `syz.2.1444'. [ 84.774732][ T3738] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1444'. [ 84.791947][ T3738] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1444'. [ 85.168448][ T3739] loop1: detected capacity change from 0 to 40427 [ 85.192720][ T3739] F2FS-fs (loop1): invalid crc value [ 85.231116][ T28] audit: type=1400 audit(1790643628.666:422): avc: denied { sqpoll } for pid=3772 comm="syz.2.1460" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 85.251092][ T3739] F2FS-fs (loop1): Found nat_bits in checkpoint [ 85.354258][ T3739] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 85.430681][ T3739] syz.1.1445: attempt to access beyond end of device [ 85.430681][ T3739] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 85.567362][ T289] syz-executor: attempt to access beyond end of device [ 85.567362][ T289] loop1: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 85.952453][ T3813] loop5: detected capacity change from 0 to 256 [ 85.969300][ T3813] exfat: Deprecated parameter 'utf8' [ 85.983774][ T3813] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xffade8b4, utbl_chksum : 0xe619d30d) [ 86.113139][ T3820] loop6: detected capacity change from 0 to 1024 [ 86.142606][ T3820] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 86.151154][ T3828] loop5: detected capacity change from 0 to 256 [ 86.158514][ T3828] exfat: Deprecated parameter 'utf8' [ 86.168149][ T3828] exfat: Deprecated parameter 'namecase' [ 86.174110][ T3828] exfat: Deprecated parameter 'namecase' [ 86.187736][ T28] audit: type=1400 audit(1790643629.555:423): avc: denied { rename } for pid=3819 comm="syz.6.1478" name="file0" dev="loop6" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 86.210896][ T3828] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 86.228421][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 86.336767][ T28] audit: type=1400 audit(1790643629.695:424): avc: denied { create } for pid=3838 comm="syz.2.1486" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 86.359343][ T28] audit: type=1400 audit(1790643629.695:425): avc: denied { mounton } for pid=3838 comm="syz.2.1486" path="/306/file0" dev="tmpfs" ino=1616 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 86.462153][ T3834] loop6: detected capacity change from 0 to 40427 [ 86.481027][ T3834] F2FS-fs (loop6): invalid crc value [ 86.509588][ T3834] F2FS-fs (loop6): Found nat_bits in checkpoint [ 86.551050][ T28] audit: type=1400 audit(1790643629.892:426): avc: denied { write } for pid=3851 comm="syz.4.1492" path="socket:[31153]" dev="sockfs" ino=31153 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 86.575888][ T3834] F2FS-fs (loop6): Start checkpoint disabled! [ 86.588314][ T3834] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 86.595795][ T3834] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 86.723240][ T3865] loop1: detected capacity change from 0 to 512 [ 86.747535][ T3864] pimreg: tun_chr_ioctl cmd 2147767506 [ 86.759596][ T3865] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 86.771868][ T43] kworker/u4:2: attempt to access beyond end of device [ 86.771868][ T43] loop6: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 86.787638][ T3865] EXT4-fs error (device loop1): ext4_orphan_get:1431: comm syz.1.1498: bad orphan inode 131083 [ 86.818998][ T3865] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 86.854349][ T28] audit: type=1400 audit(1790643630.172:427): avc: denied { lock } for pid=3862 comm="syz.1.1498" path="/282/bus/file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 86.897588][ T289] EXT4-fs (loop1): unmounting filesystem. [ 87.009402][ T3878] loop6: detected capacity change from 0 to 128 [ 87.059825][ T3881] loop1: detected capacity change from 0 to 256 [ 87.084451][ T3866] loop2: detected capacity change from 0 to 40427 [ 87.108449][ T3866] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 87.139074][ T3866] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 87.154412][ T3866] F2FS-fs (loop2): invalid crc value [ 87.215354][ T3866] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 87.294904][ T3866] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 87.302130][ T3866] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 87.441422][ T3875] F2FS-fs (loop5): invalid crc value [ 87.462141][ T3875] F2FS-fs (loop5): Found nat_bits in checkpoint [ 87.532810][ T3875] F2FS-fs (loop5): Start checkpoint disabled! [ 87.540190][ T3875] F2FS-fs (loop5): f2fs_disable_checkpoint() finish, err:0 [ 87.564779][ T3875] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 87.637984][ T28] audit: type=1400 audit(1790643630.912:428): avc: denied { rename } for pid=3874 comm="syz.5.1502" name="file0" dev="loop5" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 87.663129][ T3916] tap0: tun_chr_ioctl cmd 2147767521 [ 87.669465][ T28] audit: type=1400 audit(1790643630.949:429): avc: denied { reparent } for pid=3874 comm="syz.5.1502" name="file0" dev="loop5" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 87.718458][ T8] kworker/u4:0: attempt to access beyond end of device [ 87.718458][ T8] loop5: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 87.770703][ T3918] exfat: Deprecated parameter 'utf8' [ 87.798706][ T3918] exfat: Deprecated parameter 'utf8' [ 87.827894][ T3918] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 87.919824][ T3926] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 87.965698][ T3926] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 87.973903][ T3926] System zones: 1-12 [ 87.987784][ T3926] EXT4-fs error (device loop6): ext4_orphan_get:1431: comm syz.6.1523: bad orphan inode 131072 [ 87.998950][ T3926] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 88.031384][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 88.074586][ T28] audit: type=1400 audit(1790643631.323:430): avc: denied { read } for pid=3942 comm="syz.4.1529" path="socket:[31400]" dev="sockfs" ino=31400 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 88.135882][ T28] audit: type=1400 audit(1790643631.351:431): avc: denied { ioctl } for pid=3944 comm="syz.6.1528" path="socket:[30579]" dev="sockfs" ino=30579 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 88.357788][ T3968] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 88.370071][ T309] wacom 0003:056A:003F.0007: hidraw0: USB HID v0.00 Gamepad [syz0] on syz0 [ 88.425608][ T3968] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 2: comm syz.6.1539: lblock 2 mapped to illegal pblock 2 (length 1) [ 88.470767][ T3968] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 48: comm syz.6.1539: lblock 0 mapped to illegal pblock 48 (length 1) [ 88.572442][ T3968] EXT4-fs error (device loop6): ext4_acquire_dquot:6828: comm syz.6.1539: Failed to acquire dquot type 0 [ 88.617835][ T3968] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 88.638223][ T3968] EXT4-fs error (device loop6): ext4_evict_inode:281: inode #11: comm syz.6.1539: mark_inode_dirty error [ 88.660399][ T3968] EXT4-fs warning (device loop6): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 88.681488][ T3968] EXT4-fs (loop6): 1 orphan inode deleted [ 88.692364][ T308] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 88.712279][ T3968] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 88.728340][ T3965] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 88.733723][ T308] EXT4-fs error (device loop6): ext4_release_dquot:6864: comm kworker/u4:3: Failed to release dquot type 0 [ 88.737429][ T3965] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 88.782953][ T3965] F2FS-fs (loop4): Image doesn't support compression [ 88.790685][ T3965] F2FS-fs (loop4): Image doesn't support compression [ 88.797836][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 88.803970][ T308] EXT4-fs error (device loop6): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 88.818997][ T3965] F2FS-fs (loop4): invalid crc value [ 88.828582][ T308] EXT4-fs error (device loop6): ext4_release_dquot:6864: comm kworker/u4:3: Failed to release dquot type 0 [ 88.840666][ T3965] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 88.854265][ T2684] EXT4-fs error (device loop6): __ext4_get_inode_loc:4522: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 88.884676][ T2684] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 88.914026][ T2684] EXT4-fs error (device loop6): ext4_quota_off:7134: inode #3: comm syz-executor: mark_inode_dirty error [ 88.937342][ T3965] F2FS-fs (loop4): Start checkpoint disabled! [ 88.959927][ T3965] F2FS-fs (loop4): f2fs_disable_checkpoint() finish, err:0 [ 88.973244][ T3965] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 88.984978][ T3965] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 89.013930][ T3965] SELinux: Context #! ./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 89.092200][ T3985] F2FS-fs (loop1): invalid crc value [ 89.117668][ T3995] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1550'. [ 89.212409][ T3985] F2FS-fs (loop1): Found nat_bits in checkpoint [ 89.238232][ T4000] af_packet: tpacket_rcv: packet too big, clamped from 64993 to 32624. macoff=96 [ 89.272163][ T3985] F2FS-fs (loop1): Start checkpoint disabled! [ 89.280247][ T3985] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 89.301690][ T3985] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 89.482944][ T10] kworker/u4:1: attempt to access beyond end of device [ 89.482944][ T10] loop1: rw=1, sector=45096, nr_sectors = 16 limit=40427 [ 89.526245][ T10] kworker/u4:1: attempt to access beyond end of device [ 89.526245][ T10] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 89.660223][ T4031] netlink: 'syz.4.1564': attribute type 1 has an invalid length. [ 89.688625][ T4031] netlink: 8960 bytes leftover after parsing attributes in process `syz.4.1564'. [ 89.819225][ T4040] set_capacity_and_notify: 8 callbacks suppressed [ 89.819247][ T4040] loop1: detected capacity change from 0 to 512 [ 89.890050][ T4040] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 90.078698][ T289] EXT4-fs (loop1): unmounting filesystem. [ 90.120801][ T4064] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1579'. [ 90.183238][ T4070] ------------[ cut here ]------------ [ 90.188964][ T4070] WARNING: CPU: 1 PID: 4070 at mm/page_alloc.c:5902 __alloc_pages+0x2cc/0x610 [ 90.198066][ T4070] Modules linked in: [ 90.202133][ T4070] CPU: 1 PID: 4070 Comm: syz.1.1581 Not tainted syzkaller #0 [ 90.209668][ T4070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.219985][ T4070] RIP: 0010:__alloc_pages+0x2cc/0x610 [ 90.225735][ T4070] Code: 0c 25 28 00 00 00 48 3b 8c 24 e0 00 00 00 0f 85 a3 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 6b 97 dd 05 01 <0f> 0b eb 8f a9 00 00 08 00 48 8b 54 24 10 75 17 44 89 f6 81 e6 7f [ 90.245799][ T4070] RSP: 0018:ffffc90005077920 EFLAGS: 00010246 [ 90.252132][ T4070] RAX: ffffc90005077900 RBX: 000000000000000b RCX: 0000000000000000 [ 90.260200][ T4070] RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc900050779a8 [ 90.268254][ T4070] RBP: ffffc90005077a50 R08: ffffc900050779a7 R09: ffffc90005077990 [ 90.276306][ T4070] R10: dffffc0000000000 R11: fffff52000a0ef35 R12: dffffc0000000000 [ 90.284323][ T4070] R13: 0000000000000000 R14: 0000000000040dc0 R15: 1ffff92000a0ef28 [ 90.292359][ T4070] FS: 00007f06b413b6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 90.301405][ T4070] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.308070][ T4070] CR2: 000000110c287984 CR3: 0000000116652000 CR4: 00000000003526a0 [ 90.316087][ T4070] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 90.324140][ T4070] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 90.332215][ T4070] Call Trace: [ 90.335537][ T4070] [ 90.338542][ T4070] ? __cfi___alloc_pages+0x10/0x10 [ 90.343714][ T4070] ? kasan_set_track+0x60/0x70 [ 90.348542][ T4070] ? __kmalloc+0xb4/0x1e0 [ 90.352959][ T4070] ? kernfs_fop_write_iter+0x152/0x470 [ 90.358468][ T4070] ? vfs_write+0x5ef/0xd00 [ 90.362968][ T4070] ? ksys_write+0x14a/0x260 [ 90.367513][ T4070] ? __x64_sys_write+0x7b/0x90 [ 90.372397][ T4070] ? do_syscall_64+0x4c/0xa0 [ 90.377046][ T4070] ? _parse_integer_limit+0x18e/0x1d0 [ 90.382507][ T4070] __kmalloc_large_node+0xa1/0x1c0 [ 90.387664][ T4070] ? __cfi_mutex_lock_interruptible+0x10/0x10 [ 90.393852][ T4070] ? max_vclocks_store+0x22f/0x3b0 [ 90.399015][ T4070] __kmalloc+0xe3/0x1e0 [ 90.403244][ T4070] ? kstrtouint+0x74/0xe0 [ 90.407622][ T4070] max_vclocks_store+0x22f/0x3b0 [ 90.412617][ T4070] ? __cfi_max_vclocks_store+0x10/0x10 [ 90.418176][ T4070] ? __kasan_check_write+0x14/0x20 [ 90.423340][ T4070] ? mutex_lock+0x93/0x1b0 [ 90.427832][ T4070] ? __cfi_max_vclocks_store+0x10/0x10 [ 90.433328][ T4070] dev_attr_store+0x6c/0x90 [ 90.437940][ T4070] ? __cfi_dev_attr_store+0x10/0x10 [ 90.443181][ T4070] sysfs_kf_write+0x137/0x150 [ 90.448078][ T4070] ? __cfi_sysfs_kf_write+0x10/0x10 [ 90.453568][ T4070] kernfs_fop_write_iter+0x307/0x470 [ 90.458948][ T4070] vfs_write+0x5ef/0xd00 [ 90.463225][ T4070] ? __cfi_vfs_write+0x10/0x10 [ 90.468062][ T4070] ? __cfi_mutex_lock+0x10/0x10 [ 90.472952][ T4070] ? __fdget_pos+0x2cd/0x380 [ 90.477618][ T4070] ? ksys_write+0x70/0x260 [ 90.482104][ T4070] ksys_write+0x14a/0x260 [ 90.486479][ T4070] ? __cfi_ksys_write+0x10/0x10 [ 90.491424][ T4070] ? fpregs_restore_userregs+0x128/0x260 [ 90.497101][ T4070] __x64_sys_write+0x7b/0x90 [ 90.501797][ T4070] x64_sys_call+0x27b/0x9a0 [ 90.506340][ T4070] do_syscall_64+0x4c/0xa0 [ 90.510833][ T4070] ? clear_bhb_loop+0x30/0x80 [ 90.515550][ T4070] ? clear_bhb_loop+0x30/0x80 [ 90.520317][ T4070] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 90.526239][ T4070] RIP: 0033:0x7f06b319e159 [ 90.531063][ T4070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.551051][ T4070] RSP: 002b:00007f06b413b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 90.559545][ T4070] RAX: ffffffffffffffda RBX: 00007f06b3425fa0 RCX: 00007f06b319e159 [ 90.567583][ T4070] RDX: 0000000000000007 RSI: 0000200000000100 RDI: 0000000000000003 [ 90.575620][ T4070] RBP: 00007f06b323506b R08: 0000000000000000 R09: 0000000000000000 [ 90.583639][ T4070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.591705][ T4070] R13: 00007f06b3426038 R14: 00007f06b3425fa0 R15: 00007ffe321f9b88 [ 90.599930][ T4070] [ 90.603116][ T4070] ---[ end trace 0000000000000000 ]--- [ 90.636385][ T4086] IPv6: NLM_F_REPLACE set, but no existing node found! [ 90.739002][ T4098] loop6: detected capacity change from 0 to 512 [ 90.769423][ T4098] EXT4-fs (loop6): Test dummy encryption mode enabled [ 90.796220][ T4098] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: inode #2: comm syz.6.1593: missing EA_INODE flag [ 90.808636][ T4098] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.1593: error while reading EA inode 2 err=-117 [ 90.826656][ T4098] EXT4-fs (loop6): 1 orphan inode deleted [ 90.832863][ T4098] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 90.873618][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 90.974489][ T4124] loop2: detected capacity change from 0 to 512 [ 90.993617][ T4124] EXT4-fs (loop2): Test dummy encryption mode enabled [ 91.023417][ T4124] EXT4-fs error (device loop2): ext4_orphan_get:1405: inode #15: comm syz.2.1605: inode has both inline data and extents flags [ 91.069153][ T4124] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.1605: couldn't read orphan inode 15 (err -117) [ 91.107855][ T4124] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 91.153749][ T28] kauditd_printk_skb: 16 callbacks suppressed [ 91.153764][ T28] audit: type=1400 audit(1790643634.206:444): avc: denied { write } for pid=4123 comm="syz.2.1605" path="/335/file1/file1" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 91.252092][ T291] EXT4-fs (loop2): unmounting filesystem. [ 91.298614][ T4147] loop2: detected capacity change from 0 to 128 [ 91.329675][ T4147] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 91.350355][ T28] audit: type=1400 audit(1790643634.383:445): avc: denied { mounton } for pid=4150 comm="syz.4.1615" path=2F70726F632F3638392F6E65742F6E657466696C746572202864656C6574656429 dev="proc" ino=4026532386 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=dir permissive=1 [ 91.384840][ T4153] loop1: detected capacity change from 0 to 512 [ 91.405588][ T4153] EXT4-fs (loop1): couldn't mount as ext3 due to feature incompatibilities [ 91.431642][ T28] audit: type=1400 audit(1790643634.421:446): avc: denied { mount } for pid=4150 comm="syz.4.1615" name="/" dev="pstore" ino=12589 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 91.461458][ T308] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 91.490654][ T4158] sd 0:0:1:0: PR command failed: 1026 [ 91.502039][ T4158] sd 0:0:1:0: Sense Key : 0x5 [current] [ 91.512486][ T4160] loop1: detected capacity change from 0 to 512 [ 91.519693][ T4158] sd 0:0:1:0: ASC=0x20 ASCQ=0x0 [ 91.567311][ T4163] loop2: detected capacity change from 0 to 256 [ 91.574896][ T4160] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 91.584138][ T4160] ext4 filesystem being mounted at /304/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 91.619592][ T4163] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 91.630967][ T4163] FAT-fs (loop2): Filesystem has been set read-only [ 91.637778][ T4163] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 91.648146][ T4163] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 91.662890][ T4160] EXT4-fs error (device loop1): ext4_map_blocks:637: inode #2: block 18: comm syz.1.1621: lblock 23 mapped to illegal pblock 18 (length 1) [ 91.710114][ T289] EXT4-fs (loop1): unmounting filesystem. [ 91.765099][ T4170] syz.1.1625 (4170): drop_caches: 0 [ 91.860048][ T4182] loop6: detected capacity change from 0 to 256 [ 91.937826][ T4186] loop6: detected capacity change from 0 to 256 [ 91.973515][ T4186] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001207b, chksum : 0x1e846b9d, utbl_chksum : 0xe619d30d) [ 92.014005][ T28] audit: type=1400 audit(1790643635.001:447): avc: denied { read append } for pid=4185 comm="syz.6.1632" path=2F3136312FE91F7189591E9233614B2F626C6B696F2E6266712E656D7074795F74696D65 dev="loop6" ino=1048715 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 92.118873][ T28] audit: type=1400 audit(1790643635.104:448): avc: denied { create } for pid=4197 comm="syz.1.1638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 92.145969][ T28] audit: type=1400 audit(1790643635.132:449): avc: denied { write } for pid=4197 comm="syz.1.1638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 92.202061][ T28] audit: type=1400 audit(1790643635.132:450): avc: denied { nlmsg_write } for pid=4197 comm="syz.1.1638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 92.722569][ T28] audit: type=1400 audit(1790643635.675:451): avc: denied { setopt } for pid=4262 comm="syz.1.1665" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 92.844209][ T4280] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.929849][ T4289] loop5: detected capacity change from 0 to 256 [ 92.940809][ T4289] exfat: Deprecated parameter 'utf8' [ 92.947277][ T4291] exfat: Deprecated parameter 'namecase' [ 92.965544][ T4291] exfat: Deprecated parameter 'namecase' [ 92.979988][ T4289] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x72bddf51, utbl_chksum : 0xe619d30d) [ 93.000159][ T4291] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 93.056890][ T4297] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1681'. [ 93.086268][ T4297] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.093520][ T4297] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.105714][ T743] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 93.151180][ T4303] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 93.166135][ T4303] ext4 filesystem being mounted at /320/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 93.187292][ T4308] netlink: 'syz.5.1685': attribute type 12 has an invalid length. [ 93.203545][ T4308] netlink: 'syz.5.1685': attribute type 29 has an invalid length. [ 93.211518][ T4308] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1685'. [ 93.247528][ T289] EXT4-fs (loop1): unmounting filesystem. [ 93.298030][ T743] usb 3-1: Using ep0 maxpacket: 8 [ 93.304346][ T743] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 93.336579][ T743] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 93.356286][ T743] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 93.385605][ T743] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 93.420793][ T743] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 93.441361][ T743] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 93.453618][ T743] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.470502][ T4335] kvm [4333]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0x4000001f) = 0x1af [ 93.480989][ T743] usb 3-1: config 0 descriptor?? [ 93.490439][ T4278] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 93.721549][ T310] usb 3-1: USB disconnect, device number 7 [ 93.757548][ T4360] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 93.786724][ T4360] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 93.832840][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 93.853145][ T28] audit: type=1400 audit(1790643636.723:452): avc: denied { getopt } for pid=4367 comm="syz.4.1712" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 93.919328][ T4374] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 93.974931][ T4374] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010364, chksum : 0x43f9f21b, utbl_chksum : 0xe619d30d) [ 94.121892][ T4382] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: inode #2: comm syz.6.1719: missing EA_INODE flag [ 94.144324][ T4382] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.1719: error while reading EA inode 2 err=-117 [ 94.168685][ T4382] EXT4-fs (loop6): 1 orphan inode deleted [ 94.176122][ T4382] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 94.185688][ T4364] F2FS-fs (loop1): invalid crc value [ 94.191048][ T28] audit: type=1400 audit(1790643637.041:453): avc: denied { mounton } for pid=4381 comm="syz.6.1719" path="/174/file0/file0" dev="loop6" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 94.226924][ T4364] F2FS-fs (loop1): Found nat_bits in checkpoint [ 94.239627][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 94.343643][ T4364] F2FS-fs (loop1): Start checkpoint disabled! [ 94.360936][ T4364] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 94.378530][ T4364] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 94.481229][ T8] kworker/u4:0: attempt to access beyond end of device [ 94.481229][ T8] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 94.747533][ T4438] SELinux: policydb version 1180827720 does not match my version range 15-33 [ 94.770055][ T4438] SELinux: failed to load policy [ 95.182888][ T4488] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1765'. [ 95.372362][ T4503] set_capacity_and_notify: 9 callbacks suppressed [ 95.372382][ T4503] loop2: detected capacity change from 0 to 1024 [ 95.436724][ T4503] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 95.564456][ T4503] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 95.601727][ T291] EXT4-fs (loop2): unmounting filesystem. [ 95.790684][ T4510] loop5: detected capacity change from 0 to 40427 [ 95.802507][ T4510] F2FS-fs (loop5): Image doesn't support compression [ 95.810215][ T4510] F2FS-fs (loop5): Unrecognized mount option "whint_mode=fs-based" or missing value [ 95.854082][ T4532] sd 0:0:1:0: PR command failed: 1026 [ 95.866087][ T4532] sd 0:0:1:0: Sense Key : 0x5 [current] [ 95.873470][ T743] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 95.898431][ T4532] sd 0:0:1:0: ASC=0x20 ASCQ=0x0 [ 96.077495][ T743] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 96.098111][ T743] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 96.138627][ T743] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 96.161273][ T4562] input: syz1 as /devices/virtual/input/input18 [ 96.171833][ T743] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.191642][ T743] usb 2-1: Product: syz [ 96.210715][ T4566] netlink: 'syz.5.1800': attribute type 12 has an invalid length. [ 96.213287][ T743] usb 2-1: Manufacturer: syz [ 96.223424][ T743] usb 2-1: SerialNumber: syz [ 96.228038][ T4566] netlink: 'syz.5.1800': attribute type 29 has an invalid length. [ 96.241402][ T743] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 96.244178][ T4566] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1800'. [ 96.269356][ T743] ums-sddr09 2-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 96.269356][ T743] Please send a copy of this message to and [ 96.284218][ T4566] netlink: 'syz.5.1800': attribute type 3 has an invalid length. [ 96.314459][ T4566] netlink: 'syz.5.1800': attribute type 2 has an invalid length. [ 96.322394][ T4566] netlink: 35 bytes leftover after parsing attributes in process `syz.5.1800'. [ 96.350457][ T43] kworker/u4:2: attempt to access beyond end of device [ 96.350457][ T43] loop4: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 96.761757][ T743] ums-sddr09: probe of 2-1:1.0 failed with error -5 [ 96.780602][ T4587] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.787958][ T4587] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.795754][ T4587] device bridge_slave_0 entered promiscuous mode [ 96.802983][ T4587] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.810493][ T4587] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.818784][ T4587] device bridge_slave_1 entered promiscuous mode [ 96.901459][ T4587] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.908522][ T4587] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.915831][ T4587] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.922892][ T4587] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.951271][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 96.959010][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.966466][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.978668][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 96.986902][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.993962][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.002950][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 97.011282][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.018374][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.034458][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 97.043820][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 97.067727][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 97.084673][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 97.093100][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 97.106051][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 97.114738][ T4587] device veth0_vlan entered promiscuous mode [ 97.121487][ T10] device bridge_slave_1 left promiscuous mode [ 97.127872][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.136119][ T10] device bridge_slave_0 left promiscuous mode [ 97.142308][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.156122][ T10] device veth1_macvtap left promiscuous mode [ 97.162216][ T10] device veth0_vlan left promiscuous mode [ 97.205515][ T4611] loop6: detected capacity change from 0 to 4096 [ 97.214019][ T4611] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 97.228597][ T4611] EXT4-fs (loop6): Test dummy encryption mode enabled [ 97.236917][ T4611] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 97.245445][ T4611] System zones: 0-5 [ 97.250491][ T4611] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 97.270285][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 97.328452][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 97.338704][ T4587] device veth1_macvtap entered promiscuous mode [ 97.350064][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 97.362821][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 97.414561][ T4618] loop7: detected capacity change from 0 to 256 [ 97.426508][ T4618] exfat: Bad value for 'uid' [ 97.586569][ T4633] loop7: detected capacity change from 0 to 1024 [ 97.593419][ T4633] EXT4-fs: Ignoring removed orlov option [ 97.617234][ T4637] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1830'. [ 97.655807][ T4633] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 97.709741][ T4587] EXT4-fs (loop7): unmounting filesystem. [ 97.720255][ T4648] loop6: detected capacity change from 0 to 4096 [ 97.726354][ T4652] loop5: detected capacity change from 0 to 512 [ 97.737663][ T4652] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 97.751824][ T4648] EXT4-fs (loop6): Test dummy encryption mode enabled [ 97.770122][ T4652] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #11: comm syz.5.1836: invalid indirect mapped block 9 (level 0) [ 97.787358][ T4652] EXT4-fs (loop5): 1 truncate cleaned up [ 97.800236][ T4652] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 97.811161][ T4648] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 97.821984][ T4658] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1838'. [ 97.837411][ T28] kauditd_printk_skb: 6 callbacks suppressed [ 97.837425][ T28] audit: type=1400 audit(1790643640.457:460): avc: denied { create } for pid=4651 comm="syz.5.1836" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 97.872995][ T3574] EXT4-fs (loop5): unmounting filesystem. [ 97.875129][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 97.880003][ T28] audit: type=1326 audit(1790643640.457:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 97.912462][ T28] audit: type=1326 audit(1790643640.457:462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 97.955231][ T28] audit: type=1326 audit(1790643640.457:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 97.980457][ T28] audit: type=1326 audit(1790643640.457:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=443 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 98.006591][ T28] audit: type=1326 audit(1790643640.466:465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 98.031742][ T28] audit: type=1326 audit(1790643640.466:466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 98.101328][ T309] kernel write not supported for file /input/event2 (pid: 309 comm: kworker/0:3) [ 98.124687][ T28] audit: type=1326 audit(1790643640.466:467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4647 comm="syz.6.1834" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f02bb79e159 code=0x7ffc0000 [ 98.138678][ T4674] loop2: detected capacity change from 0 to 256 [ 98.184488][ T4674] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0xda218cab, utbl_chksum : 0xe619d30d) [ 98.199284][ T4674] exFAT-fs (loop2): error, invalid access to FAT free cluster (entry 0x00000008) [ 98.208680][ T4674] exFAT-fs (loop2): error, failed to bmap (inode : ffff888131f49570 iblock : 8, err : -5) [ 98.233575][ T4674] exFAT-fs (loop2): error, invalid access to FAT free cluster (entry 0x00000008) [ 98.259083][ T4681] loop6: detected capacity change from 0 to 512 [ 98.289465][ T4681] FAT-fs (loop6): Directory bread(block 2080) failed [ 98.310699][ T4681] FAT-fs (loop6): Directory bread(block 2081) failed [ 98.321474][ T4681] FAT-fs (loop6): Directory bread(block 2082) failed [ 98.330420][ T4681] FAT-fs (loop6): Directory bread(block 2083) failed [ 98.338327][ T4681] FAT-fs (loop6): Directory bread(block 2084) failed [ 98.345592][ T4681] FAT-fs (loop6): Directory bread(block 2085) failed [ 98.352378][ T4681] FAT-fs (loop6): Directory bread(block 2086) failed [ 98.359350][ T4681] FAT-fs (loop6): Directory bread(block 2087) failed [ 98.397061][ T4666] FAT-fs (loop6): Directory bread(block 2080) failed [ 98.404119][ T4666] FAT-fs (loop6): Directory bread(block 2081) failed [ 98.442278][ T4693] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1854'. [ 98.469519][ T4691] loop2: detected capacity change from 0 to 4096 [ 98.483119][ T4691] EXT4-fs (loop2): Test dummy encryption mode enabled [ 98.503851][ T4691] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 98.527767][ T291] EXT4-fs (loop2): unmounting filesystem. [ 98.592557][ T4706] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 98.604391][ T4706] ext4 filesystem being mounted at /369/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 98.633534][ T4706] EXT4-fs (loop2): shut down requested (0) [ 98.640226][ T4706] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=15 [ 98.649139][ T4706] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=15 [ 98.658051][ T28] audit: type=1400 audit(1790643641.224:468): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 98.686418][ T28] audit: type=1400 audit(1790643641.224:469): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.708331][ T291] EXT4-fs (loop2): unmounting filesystem. [ 98.727014][ T4712] netlink: 'syz.2.1862': attribute type 11 has an invalid length. [ 98.734938][ T4712] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1862'. [ 98.792593][ T309] usb 2-1: USB disconnect, device number 9 [ 98.826411][ T4705] F2FS-fs (loop7): Corrupted extension count (64 + 1 > 64) [ 98.833759][ T4705] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 98.844565][ T4705] F2FS-fs (loop7): Image doesn't support compression [ 98.852107][ T4705] F2FS-fs (loop7): Image doesn't support compression [ 98.860633][ T4705] F2FS-fs (loop7): invalid crc value [ 98.867257][ T4705] F2FS-fs (loop7): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 98.886808][ T757] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 98.919324][ T4705] F2FS-fs (loop7): Start checkpoint disabled! [ 98.926106][ T4705] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 98.950041][ T4705] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 98.957687][ T4705] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 98.998195][ T4720] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 99.011447][ T4720] EXT4-fs (loop1): re-mounted. Quota mode: writeback. [ 99.031709][ T289] EXT4-fs (loop1): unmounting filesystem. [ 99.102892][ T757] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.118536][ T757] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 99.140617][ T757] usb 7-1: config 0 interface 0 has no altsetting 0 [ 99.153110][ T757] usb 7-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 99.165998][ T4742] exfat: Deprecated parameter 'utf8' [ 99.171404][ T757] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.179762][ T4742] exfat: Deprecated parameter 'utf8' [ 99.195632][ T757] usb 7-1: config 0 descriptor?? [ 99.200950][ T4742] exfat: Deprecated parameter 'namecase' [ 99.211916][ T4742] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbcba5927, utbl_chksum : 0xe619d30d) [ 99.640229][ T757] hid-multitouch 0003:0EEF:72C4.0008: unbalanced collection at end of report description [ 99.652066][ T757] hid-multitouch: probe of 0003:0EEF:72C4.0008 failed with error -22 [ 99.854898][ T309] usb 7-1: USB disconnect, device number 2 [ 99.953304][ T6] kernel write not supported for file /input/event2 (pid: 6 comm: kworker/0:0) [ 102.336439][ T4810] set_capacity_and_notify: 5 callbacks suppressed [ 102.336460][ T4810] loop5: detected capacity change from 0 to 40427 [ 102.366406][ T4810] F2FS-fs (loop5): Corrupted extension count (64 + 1 > 64) [ 102.402670][ T4810] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 102.421948][ T4810] F2FS-fs (loop5): Image doesn't support compression [ 102.440520][ T4810] F2FS-fs (loop5): Image doesn't support compression [ 102.458511][ T4810] F2FS-fs (loop5): invalid crc value [ 102.462253][ T4812] loop2: detected capacity change from 0 to 40427 [ 102.470590][ T4810] F2FS-fs (loop5): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 102.496968][ T4812] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 102.509385][ T4812] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 102.528779][ T4812] F2FS-fs (loop2): invalid crc value [ 102.558298][ T4812] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 102.594808][ T4810] F2FS-fs (loop5): Start checkpoint disabled! [ 102.611006][ T4810] F2FS-fs (loop5): f2fs_disable_checkpoint() finish, err:0 [ 102.629506][ T4810] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 102.636589][ T4810] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 102.704515][ T4812] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 102.721266][ T4812] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 102.827770][ T4862] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.859266][ T291] syz-executor: attempt to access beyond end of device [ 102.859266][ T291] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 103.448259][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 103.448276][ T28] audit: type=1400 audit(1790643645.707:475): avc: denied { ioctl } for pid=4935 comm="syz.7.1959" path="socket:[35543]" dev="sockfs" ino=35543 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 103.556640][ T24] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 103.762420][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 103.773173][ T24] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 103.794262][ T24] usb 7-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 103.813924][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.824915][ T4956] loop1: detected capacity change from 0 to 512 [ 103.830230][ T24] usb 7-1: Product: syz [ 103.841455][ T24] usb 7-1: Manufacturer: syz [ 103.847207][ T4956] EXT4-fs: Ignoring removed nomblk_io_submit option [ 103.850924][ T24] usb 7-1: SerialNumber: syz [ 103.863139][ T4956] EXT4-fs (loop1): can't mount with journal_async_commit, fs mounted w/o journal [ 103.944575][ T28] audit: type=1400 audit(1790643646.174:476): avc: denied { bind } for pid=4961 comm="syz.7.1972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 103.990166][ T28] audit: type=1326 audit(1790643646.212:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.033498][ T28] audit: type=1326 audit(1790643646.212:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.058695][ T28] audit: type=1326 audit(1790643646.212:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.084096][ T28] audit: type=1326 audit(1790643646.212:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.114213][ T24] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 104.187103][ T28] audit: type=1326 audit(1790643646.212:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.258190][ T28] audit: type=1326 audit(1790643646.212:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.304485][ T28] audit: type=1326 audit(1790643646.212:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.342651][ T28] audit: type=1326 audit(1790643646.212:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4965 comm="syz.7.1973" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f618919e159 code=0x7ffc0000 [ 104.438398][ T4988] loop2: detected capacity change from 0 to 2048 [ 104.460775][ T4988] EXT4-fs: Ignoring removed orlov option [ 104.506828][ T4988] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 104.527000][ T4988] ext4 filesystem being mounted at /389/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 104.617246][ T291] EXT4-fs (loop2): unmounting filesystem. [ 104.674863][ T5003] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1988'. [ 104.727829][ T309] wiimote 0005:057E:0306.0009: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 104.737526][ T309] wiimote 0005:057E:0306.0009: New device registered [ 104.770878][ T24] usb 7-1: parse_audio_format_rates_v2v3(): unable to retrieve sample rate range (clock 0) [ 104.798649][ T24] usb 7-1: USB disconnect, device number 3 [ 105.010108][ T310] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 105.074399][ T2266] udevd[2266]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 105.202267][ T310] usb 3-1: Using ep0 maxpacket: 16 [ 105.208798][ T310] usb 3-1: config 0 has no interfaces? [ 105.216090][ T310] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 105.225329][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.233455][ T310] usb 3-1: Product: syz [ 105.237849][ T310] usb 3-1: Manufacturer: syz [ 105.242531][ T310] usb 3-1: SerialNumber: syz [ 105.256115][ T310] usb 3-1: config 0 descriptor?? [ 105.479744][ T743] wiimote 0005:057E:0306.0009: detected device: Nintendo Wii Remote (Gen 1) [ 105.480702][ T24] usb 3-1: USB disconnect, device number 8 [ 105.505557][ T5010] wiimote 0005:057E:0306.0009: Device removed [ 105.511451][ T743] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0009/input/input20 [ 105.543176][ T743] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0009/input/input21 [ 105.577813][ T743] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0009/input/input19 [ 105.744823][ T5079] loop6: detected capacity change from 0 to 128 [ 105.761749][ T5079] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 105.803670][ T5045] loop1: detected capacity change from 0 to 131072 [ 105.810418][ T5079] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 105.821397][ T5045] F2FS-fs (loop1): invalid crc value [ 105.886957][ T5045] F2FS-fs (loop1): Found nat_bits in checkpoint [ 105.993129][ T5045] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 106.026644][ T5099] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2029'. [ 106.039413][ T5099] netlink: 240 bytes leftover after parsing attributes in process `syz.5.2029'. [ 106.691995][ T5164] loop6: detected capacity change from 0 to 512 [ 106.737929][ T5164] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 106.759445][ T5164] ext4 filesystem being mounted at /238/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 106.811641][ T5164] EXT4-fs error (device loop6): __ext4_remount:6637: comm syz.6.2058: Abort forced by user [ 106.824042][ T5164] EXT4-fs (loop6): re-mounted. Quota mode: writeback. [ 106.844508][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 106.897771][ T5179] loop6: detected capacity change from 0 to 1024 [ 106.919454][ T5179] EXT4-fs (loop6): revision level too high, forcing read-only mode [ 106.929698][ T5179] EXT4-fs (loop6): orphan cleanup on readonly fs [ 106.936453][ T5179] EXT4-fs error (device loop6): ext4_free_blocks:6220: comm syz.6.2062: Freeing blocks not in datazone - block = 0, count = 4096 [ 106.951324][ T5179] EXT4-fs (loop6): 1 orphan inode deleted [ 106.955354][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 106.957419][ T5179] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 106.999051][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 107.147150][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 107.155583][ T24] usb 6-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 107.171628][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.188981][ T24] usb 6-1: Product: syz [ 107.197959][ T24] usb 6-1: Manufacturer: syz [ 107.207156][ T24] usb 6-1: SerialNumber: syz [ 107.218513][ T24] usb 6-1: config 0 descriptor?? [ 107.238100][ T24] ums-onetouch 6-1:0.0: USB Mass Storage device detected [ 107.257385][ T5191] netlink: 164 bytes leftover after parsing attributes in process `syz.7.2067'. [ 107.267457][ T5194] loop6: detected capacity change from 0 to 128 [ 107.274762][ T5194] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 107.287217][ T5194] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 107.343334][ T5194] FAT-fs (loop6): error, fat_free_clusters: deleting FAT entry beyond EOF [ 107.352269][ T5194] FAT-fs (loop6): Filesystem has been set read-only [ 107.373184][ T2684] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 107.420708][ T5206] syz.7.2073[5206] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 107.420835][ T5206] syz.7.2073[5206] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 107.453466][ T24] usb 6-1: USB disconnect, device number 5 [ 107.776005][ T5243] SELinux: failed to load policy [ 107.797946][ T5256] netlink: 'syz.7.2097': attribute type 32 has an invalid length. [ 108.041291][ T5272] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2104'. [ 108.055461][ T6] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 108.146169][ T5280] loop6: detected capacity change from 0 to 512 [ 108.162880][ T5280] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 108.190310][ T5280] EXT4-fs error (device loop6): ext4_orphan_get:1405: inode #15: comm syz.6.2108: inode has both inline data and extents flags [ 108.203822][ T5280] EXT4-fs error (device loop6): ext4_orphan_get:1410: comm syz.6.2108: couldn't read orphan inode 15 (err -117) [ 108.216204][ T5280] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 108.258494][ T6] usb 2-1: Using ep0 maxpacket: 16 [ 108.264837][ T6] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.275886][ T6] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 108.288739][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 108.288826][ T6] usb 2-1: config 0 interface 0 has no altsetting 0 [ 108.301414][ T6] usb 2-1: New USB device found, idVendor=04b3, idProduct=3108, bcdDevice= 0.00 [ 108.310477][ T6] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.319440][ T6] usb 2-1: config 0 descriptor?? [ 108.408151][ T24] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 108.612242][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 108.632483][ T24] usb 6-1: New USB device found, idVendor=046d, idProduct=c281, bcdDevice= 1.00 [ 108.652400][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.698585][ T5292] device hsr0 entered promiscuous mode [ 108.764351][ T6] input: HID 04b3:3108 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:04B3:3108.000A/input/input23 [ 108.787612][ T6] lenovo 0003:04B3:3108.000A: input,hidraw1: USB HID v0.01 Joystick [HID 04b3:3108] on usb-dummy_hcd.1-1/input0 [ 108.986795][ T6] usb 2-1: USB disconnect, device number 10 [ 109.062766][ T5314] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2122'. [ 109.132015][ T28] kauditd_printk_skb: 10 callbacks suppressed [ 109.132033][ T28] audit: type=1400 audit(1790643651.022:495): avc: denied { append } for pid=5318 comm="syz.7.2124" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 109.247120][ T5323] logitech-hidpp-device 0005:046D:B012.000B: received hid++ report of bad size (3) [ 109.256553][ T5323] logitech-hidpp-device 0005:046D:B012.000B: Event data for report 17 was too short (19 vs 2) [ 109.296862][ T688] logitech-hidpp-device 0005:046D:B012.000B: Device not connected [ 109.371887][ T5329] input: syz1 as /devices/virtual/input/input24 [ 109.423465][ T5335] netlink: 104 bytes leftover after parsing attributes in process `syz.7.2131'. [ 109.423465][ T28] audit: type=1400 audit(1790643651.303:496): avc: denied { nlmsg_read } for pid=5334 comm="syz.7.2131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 109.543232][ T5340] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 109.566796][ T5342] loop1: detected capacity change from 0 to 1024 [ 109.577279][ T5342] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 109.600418][ T5342] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 109.681224][ T289] EXT4-fs (loop1): unmounting filesystem. [ 109.741611][ T28] audit: type=1400 audit(1790643651.593:497): avc: denied { bind } for pid=5351 comm="syz.1.2138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 110.062314][ T5369] netlink: 8964 bytes leftover after parsing attributes in process `syz.6.2146'. [ 110.072059][ T5369] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2146'. [ 110.291253][ T5358] loop1: detected capacity change from 0 to 131072 [ 110.306002][ T5358] F2FS-fs (loop1): Invalid log blocks per segment (2236) [ 110.330689][ T5358] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 110.339798][ T5358] F2FS-fs (loop1): invalid crc value [ 110.346702][ T5358] F2FS-fs (loop1): Found nat_bits in checkpoint [ 110.387945][ T5358] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 110.395046][ T5358] F2FS-fs (loop1): Mounted with checkpoint version = 753bd00b [ 110.454750][ T5358] syz.1.2141 (pid 5358) is setting an IV_INO_LBLK_32 encryption policy. This should only be used if there are certain hardware limitations. [ 110.522868][ T5398] loop6: detected capacity change from 0 to 1024 [ 110.537802][ T5398] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 110.557981][ T5398] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 110.580992][ T5398] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 110.596149][ T5398] EXT4-fs error (device loop6) in ext4_setattr:5697: error 28 [ 110.614850][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 110.783547][ T5418] kvm [5416]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x2000000 [ 111.109302][ T5448] loop1: detected capacity change from 0 to 1024 [ 111.134124][ T5448] EXT4-fs: Ignoring removed bh option [ 111.166329][ T5448] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 111.181801][ T5448] ext4 filesystem being mounted at /405/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 111.213980][ T5448] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: comm syz.1.2179: lblock 0 mapped to illegal pblock 0 (length 1) [ 111.240977][ T5448] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 111.258129][ T5448] EXT4-fs (loop1): This should not happen!! Data will be lost [ 111.258129][ T5448] [ 111.269459][ T5451] EXT4-fs error (device loop1): ext4_map_blocks:637: inode #15: comm syz.1.2179: lblock 0 mapped to illegal pblock 0 (length 1) [ 111.291014][ T289] EXT4-fs (loop1): unmounting filesystem. [ 111.326742][ T310] usb 6-1: USB disconnect, device number 6 [ 111.329025][ T5455] kvm: apic: phys broadcast and lowest prio [ 111.479126][ T28] audit: type=1400 audit(1790643653.221:498): avc: denied { module_request } for pid=5467 comm="syz.5.2186" kmod="nfnetlink-subsys-10" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 111.503735][ T5468] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2186'. [ 111.846432][ T5442] loop6: detected capacity change from 0 to 131072 [ 111.866800][ T5442] F2FS-fs (loop6): Wrong secs_per_zone / total_sections (512, 24) [ 111.882186][ T5442] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 111.891305][ T5442] F2FS-fs (loop6): Test dummy encryption mode enabled [ 111.934123][ T5442] F2FS-fs (loop6): invalid crc value [ 111.967681][ T5442] F2FS-fs (loop6): Found nat_bits in checkpoint [ 112.117734][ T5442] F2FS-fs (loop6): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 112.151362][ T5442] F2FS-fs (loop6): Start checkpoint disabled! [ 112.157972][ T5442] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 112.197398][ T5442] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 112.223059][ T5442] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 112.365387][ T10] F2FS-fs (loop6): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 112.429932][ T5513] loop1: detected capacity change from 0 to 512 [ 112.469242][ T5513] EXT4-fs: Ignoring removed nobh option [ 112.501234][ T5513] EXT4-fs (loop1): Test dummy encryption mode enabled [ 112.520041][ T5513] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 112.556867][ T5513] EXT4-fs (loop1): Unsupported encryption level 12 [ 112.826395][ T5532] loop1: detected capacity change from 0 to 1024 [ 112.897124][ T5532] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 112.905676][ T5532] ext4 filesystem being mounted at /415/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 112.950641][ T289] EXT4-fs (loop1): unmounting filesystem. [ 113.339467][ T5552] loop1: detected capacity change from 0 to 40427 [ 113.371920][ T5552] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 113.390296][ T5552] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 113.402242][ T5552] F2FS-fs (loop1): invalid crc value [ 113.440447][ T5552] F2FS-fs (loop1): Found nat_bits in checkpoint [ 113.551603][ T28] audit: type=1400 audit(1790643655.168:499): avc: denied { read write } for pid=5585 comm="syz.6.2235" name="cpu_dma_latency" dev="devtmpfs" ino=277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 113.601815][ T5552] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 113.609173][ T5552] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 113.656817][ T5589] loop6: detected capacity change from 0 to 256 [ 113.699988][ T28] audit: type=1400 audit(1790643655.308:500): avc: denied { rename } for pid=5550 comm="syz.1.2220" name="file1" dev="loop1" ino=455 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 113.734224][ T5589] FAT-fs (loop6): Directory bread(block 64) failed [ 113.748384][ T5589] FAT-fs (loop6): Directory bread(block 65) failed [ 113.755917][ T43] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 113.772542][ T5589] FAT-fs (loop6): Directory bread(block 66) failed [ 113.773575][ T43] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 113.779112][ T5589] FAT-fs (loop6): Directory bread(block 67) failed [ 113.825966][ T5589] FAT-fs (loop6): Directory bread(block 68) failed [ 113.847545][ T5589] FAT-fs (loop6): Directory bread(block 69) failed [ 113.889125][ T5596] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2240'. [ 113.900791][ T5589] FAT-fs (loop6): Directory bread(block 70) failed [ 113.907358][ T5589] FAT-fs (loop6): Directory bread(block 71) failed [ 113.925903][ T5596] device macsec1 entered promiscuous mode [ 113.936646][ T5596] device vlan1 entered promiscuous mode [ 113.943821][ T5589] FAT-fs (loop6): Directory bread(block 72) failed [ 113.961219][ T5589] FAT-fs (loop6): Directory bread(block 73) failed [ 114.003560][ T5596] device vlan1 left promiscuous mode N[ 114.055327][ T28] audit: type=1400 audit(1790643655.635:501): avc: denied { read write } for pid=5601 comm="syz.1.2242" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 114.111976][ T28] audit: type=1400 audit(1790643655.635:502): avc: denied { open } for pid=5601 comm="syz.1.2242" path="/dev/raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 114.170842][ T28] audit: type=1400 audit(1790643655.635:503): avc: denied { ioctl } for pid=5601 comm="syz.1.2242" path="/dev/raw-gadget" dev="devtmpfs" ino=258 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 114.198829][ T5610] loop6: detected capacity change from 0 to 512 [ 114.226426][ T28] audit: type=1400 audit(1790643655.720:504): avc: denied { append } for pid=5603 comm="syz.5.2245" name="event2" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 114.261291][ T5610] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 114.284141][ T5610] EXT4-fs warning (device loop6): verify_group_input:151: Cannot add at group 49 (only 1 groups) [ 114.327874][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 114.360261][ T222] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 114.368515][ T5622] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2252'. [ 114.409511][ T5622] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2252'. [ 114.523331][ T5636] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 114.540175][ T5636] syzkaller1: linktype set to 6 [ 114.575267][ T222] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 114.595902][ T222] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 114.618031][ T222] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 114.627142][ T222] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.655215][ T222] usb 2-1: Product: syz [ 114.671017][ T222] usb 2-1: Manufacturer: syz [ 114.675675][ T222] usb 2-1: SerialNumber: syz [ 114.681469][ T222] usb 2-1: config 0 descriptor?? [ 114.686727][ T5602] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 114.697295][ T5602] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 114.790007][ T5647] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2262'. [ 114.811849][ T5647] netlink: 'syz.6.2262': attribute type 1 has an invalid length. [ 114.832285][ T5647] netlink: 'syz.6.2262': attribute type 2 has an invalid length. [ 114.874268][ T5649] netlink: 'syz.5.2263': attribute type 3 has an invalid length. [ 114.886058][ T5649] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2263'. [ 114.929204][ T5602] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 114.947245][ T5602] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 115.012101][ T28] audit: type=1326 audit(1790643656.524:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5658 comm="syz.5.2268" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecc139e159 code=0x7ffc0000 [ 115.054894][ T28] audit: type=1326 audit(1790643656.524:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5658 comm="syz.5.2268" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecc139e159 code=0x7ffc0000 [ 115.090476][ T28] audit: type=1326 audit(1790643656.524:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5658 comm="syz.5.2268" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fecc139e159 code=0x7ffc0000 [ 115.143351][ T28] audit: type=1326 audit(1790643656.524:508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5658 comm="syz.5.2268" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fecc139e159 code=0x7ffc0000 [ 115.396781][ T6] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 115.409070][ T222] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 115.590372][ T6] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 115.600628][ T6] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 115.614273][ T6] usb 7-1: New USB device found, idVendor=0471, idProduct=0608, bcdDevice= 0.00 [ 115.623605][ T6] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.632249][ T222] dm9601 2-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 115.654476][ T222] usb 2-1: USB disconnect, device number 11 [ 115.781447][ T24] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 115.879592][ T222] usb 7-1: USB disconnect, device number 4 [ 115.939234][ T5691] loop2: detected capacity change from 0 to 131072 [ 115.951088][ T5691] F2FS-fs (loop2): Found nat_bits in checkpoint [ 115.984519][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 115.990989][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.010866][ T5691] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 116.029292][ T24] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 116.045800][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.053762][ T5691] F2FS-fs (loop2): lookup inode (7) has corrupted xattr [ 116.054807][ T24] usb 6-1: Product: syz [ 116.064486][ T5691] F2FS-fs (loop2): lookup inode (7) has corrupted xattr [ 116.065591][ T24] usb 6-1: Manufacturer: syz [ 116.078436][ T24] usb 6-1: SerialNumber: syz [ 116.242503][ T5701] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2287'. [ 116.451217][ T28] audit: type=1400 audit(1790643657.872:509): avc: denied { connect } for pid=5717 comm="syz.6.2294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 116.485714][ T5720] loop6: detected capacity change from 0 to 512 [ 116.501438][ T5720] EXT4-fs: Ignoring removed nomblk_io_submit option [ 116.509303][ T5720] EXT4-fs: Ignoring removed nobh option [ 116.520883][ T5720] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 116.530029][ T5720] ext4 filesystem being mounted at /317/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 116.559924][ T5720] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.571986][ T5720] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 116.581204][ T5720] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.593489][ T5720] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 116.602584][ T5720] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.615441][ T5720] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 116.616205][ T5728] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.624597][ T5720] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.638363][ T5728] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 116.648978][ T5720] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.658314][ T5728] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.669880][ T5720] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 116.690496][ T5728] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.2295: corrupted xattr block 33 [ 116.702787][ T5728] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 116.722465][ T2684] EXT4-fs (loop6): unmounting filesystem. [ 116.839540][ T60] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 116.930621][ T5739] loop6: detected capacity change from 0 to 40427 [ 116.938686][ T5739] F2FS-fs (loop6): Invalid log blocks per segment (1) [ 116.945651][ T5739] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 116.954773][ T24] cdc_ncm 6-1:1.0: SET_CRC_MODE failed [ 116.960766][ T5739] F2FS-fs (loop6): fault_type options not supported [ 116.967522][ T5739] F2FS-fs (loop6): fault_injection options not supported [ 116.974819][ T5739] F2FS-fs (loop6): Image doesn't support compression [ 116.981958][ T24] cdc_ncm 6-1:1.0: bind() failure [ 116.987734][ T5739] F2FS-fs (loop6): invalid crc value [ 116.989364][ T24] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 117.001055][ T5739] F2FS-fs (loop6): Found nat_bits in checkpoint [ 117.001094][ T24] cdc_ncm 6-1:1.1: bind() failure [ 117.013845][ T24] usb 6-1: USB disconnect, device number 7 [ 117.033364][ T60] usb 3-1: unable to get BOS descriptor or descriptor too short [ 117.053468][ T60] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.081159][ T60] usb 3-1: string descriptor 0 read error: -22 [ 117.094911][ T60] usb 3-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 117.105436][ T5739] F2FS-fs (loop6): Start checkpoint disabled! [ 117.111831][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.120388][ T5739] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 117.131037][ T5739] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 117.138195][ T5739] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 117.171351][ T2684] F2FS-fs (loop6): access invalid blkaddr:4043309056 [ 117.184778][ T2684] CPU: 1 PID: 2684 Comm: syz-executor Tainted: G W syzkaller #0 [ 117.193865][ T2684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 117.203946][ T2684] Call Trace: [ 117.207250][ T2684] [ 117.210209][ T2684] __dump_stack+0x21/0x24 [ 117.214575][ T2684] dump_stack_lvl+0x110/0x170 [ 117.219263][ T2684] ? __cfi_dump_stack_lvl+0x8/0x8 [ 117.224294][ T2684] dump_stack+0x15/0x24 [ 117.228461][ T2684] __f2fs_is_valid_blkaddr+0xd2e/0x15a0 [ 117.234011][ T2684] f2fs_is_valid_blkaddr+0x23/0x30 [ 117.239133][ T2684] f2fs_map_blocks+0xcc1/0x4060 [ 117.243990][ T2684] ? kasan_save_alloc_info+0x1f/0x30 [ 117.249279][ T2684] ? __cfi_f2fs_map_blocks+0x10/0x10 [ 117.254575][ T2684] ? __cfi_mempool_alloc+0x10/0x10 [ 117.259777][ T2684] ? bio_associate_blkg_from_css+0x960/0xb10 [ 117.265768][ T2684] ? xas_start+0x31d/0x3e0 [ 117.270188][ T2684] ? xa_load+0xad/0xd0 [ 117.274261][ T2684] f2fs_mpage_readpages+0xa46/0x1b20 [ 117.279563][ T2684] ? dquot_release_reservation_block+0xa0/0xa0 [ 117.285743][ T2684] ? cgroup_rstat_updated+0xf0/0x360 [ 117.291042][ T2684] ? xas_nomem+0x6b/0x1f0 [ 117.295383][ T2684] f2fs_readahead+0xfc/0x240 [ 117.299996][ T2684] ? __cfi_f2fs_readahead+0x10/0x10 [ 117.305212][ T2684] read_pages+0x1bf/0xe10 [ 117.309563][ T2684] ? page_cache_ra_unbounded+0x850/0x850 [ 117.315219][ T2684] ? filemap_add_folio+0x113/0x260 [ 117.320345][ T2684] page_cache_ra_unbounded+0x6ff/0x850 [ 117.325828][ T2684] ? __cfi_page_cache_ra_unbounded+0x10/0x10 [ 117.331827][ T2684] ? is_bpf_text_address+0x177/0x190 [ 117.337133][ T2684] page_cache_ra_order+0xb0c/0xe50 [ 117.342295][ T2684] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 117.348468][ T2684] ? avc_has_perm_noaudit+0x390/0x490 [ 117.353861][ T2684] ? __cfi_page_cache_ra_order+0x10/0x10 [ 117.359531][ T2684] ondemand_readahead+0x821/0xda0 [ 117.364592][ T2684] ? __x64_sys_openat+0x136/0x160 [ 117.369658][ T2684] ? page_cache_sync_ra+0x4a0/0x4a0 [ 117.374886][ T2684] page_cache_sync_ra+0x427/0x4a0 [ 117.379961][ T2684] f2fs_readdir+0x473/0x990 [ 117.384492][ T2684] ? cgroup_rstat_updated+0xf0/0x360 [ 117.389821][ T2684] ? __cfi_f2fs_readdir+0x10/0x10 [ 117.394916][ T2684] ? handle_mm_fault+0x18d8/0x26b0 [ 117.400042][ T2684] ? down_read_killable+0xbc/0x110 [ 117.405174][ T2684] ? __cfi_down_read_killable+0x10/0x10 [ 117.410746][ T2684] ? security_file_permission+0x94/0xb0 [ 117.416311][ T2684] iterate_dir+0x26d/0x610 [ 117.420743][ T2684] ? __cfi_f2fs_readdir+0x10/0x10 [ 117.425883][ T2684] __se_sys_getdents64+0xf2/0x250 [ 117.430921][ T2684] ? __x64_sys_getdents64+0x90/0x90 [ 117.436175][ T2684] ? __cfi_filldir64+0x10/0x10 [ 117.440957][ T2684] ? do_user_addr_fault+0x9a5/0x1030 [ 117.446269][ T2684] ? debug_smp_processor_id+0x17/0x20 [ 117.451657][ T2684] __x64_sys_getdents64+0x7b/0x90 [ 117.456697][ T2684] x64_sys_call+0x15c/0x9a0 [ 117.461223][ T2684] do_syscall_64+0x4c/0xa0 [ 117.465662][ T2684] ? clear_bhb_loop+0x30/0x80 [ 117.470355][ T2684] ? clear_bhb_loop+0x30/0x80 [ 117.475242][ T2684] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 117.481151][ T2684] RIP: 0033:0x7f02bb7c6af3 [ 117.485581][ T2684] Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 [ 117.505199][ T2684] RSP: 002b:00007ffd2d670948 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 117.513738][ T2684] RAX: ffffffffffffffda RBX: 0000555558fa9910 RCX: 00007f02bb7c6af3 [ 117.521723][ T2684] RDX: 0000000000008000 RSI: 0000555558fa9940 RDI: 0000000000000005 [ 117.529721][ T2684] RBP: 0000555558fa9940 R08: 00007f02bb9f2e20 R09: 0000000000000001 [ 117.537726][ T2684] R10: 0000000000000000 R11: 0000000000000293 R12: 0000555558fa9914 [ 117.545715][ T2684] R13: ffffffffffffffe8 R14: 0000000000000010 R15: 00007ffd2d672bf0 [ 117.553743][ T2684] [ 117.558064][ T2684] syz-executor: attempt to access beyond end of device [ 117.558064][ T2684] loop6: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 117.572664][ T2684] syz-executor: attempt to access beyond end of device [ 117.572664][ T2684] loop6: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 117.612762][ T43] kworker/u4:2: attempt to access beyond end of device [ 117.612762][ T43] loop6: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 117.947843][ T5760] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.955079][ T5760] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.962706][ T5760] device bridge_slave_0 entered promiscuous mode [ 117.972274][ T5760] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.979410][ T5760] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.987010][ T5760] device bridge_slave_1 entered promiscuous mode [ 117.998191][ T60] usb 3-1: failed to read current rate; disabling the check [ 118.060275][ T5760] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.067410][ T5760] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.074775][ T5760] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.081867][ T5760] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.108038][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 118.115811][ T330] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.123277][ T330] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.133064][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 118.141423][ T330] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.148617][ T330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.157247][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 118.165721][ T330] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.172789][ T330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.188164][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 118.197858][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 118.212683][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 118.224950][ T24] usb 3-1: USB disconnect, device number 9 [ 118.231541][ T5760] device veth0_vlan entered promiscuous mode [ 118.238409][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 118.247212][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 118.255061][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 118.271132][ T5760] device veth1_macvtap entered promiscuous mode [ 118.278581][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 118.290063][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 118.302914][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 118.336427][ T10] device bridge_slave_1 left promiscuous mode [ 118.342765][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.343046][ T5766] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 118.356717][ T330] Bluetooth: hci1: Frame reassembly failed (-84) [ 118.363963][ T10] device bridge_slave_0 left promiscuous mode [ 118.370260][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.378755][ T10] device veth1_macvtap left promiscuous mode [ 118.384879][ T10] device veth0_vlan left promiscuous mode [ 118.537464][ T28] audit: type=1400 audit(1790643659.828:510): avc: denied { setcheckreqprot } for pid=5772 comm="syz.7.2316" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 118.589078][ T5777] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2318'. [ 118.606446][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.111593][ T28] audit: type=1400 audit(1790643660.361:511): avc: denied { accept } for pid=5828 comm="syz.5.2343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 119.425450][ T5767] Bluetooth: hci0: command 0x1003 tx timeout [ 119.428162][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 119.454836][ T5848] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2350'. [ 119.463896][ T5848] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2350'. [ 119.698392][ T5871] loop1: detected capacity change from 0 to 1024 [ 119.705323][ T5871] EXT4-fs: Ignoring removed bh option [ 119.716363][ T5871] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 119.730470][ T28] audit: type=1400 audit(1790643666.946:512): avc: denied { create } for pid=5870 comm="syz.1.2361" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 119.773867][ T28] audit: type=1400 audit(1790643666.964:513): avc: denied { read write } for pid=5870 comm="syz.1.2361" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 119.817466][ T28] audit: type=1400 audit(1790643666.964:514): avc: denied { open } for pid=5870 comm="syz.1.2361" path="/440/file1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 119.863598][ T289] EXT4-fs (loop1): unmounting filesystem. [ 119.880962][ T5876] input: syz0 as /devices/virtual/input/input25 [ 119.931560][ T5882] binder: 5881:5882 ioctl c018620c 200000000180 returned -1 [ 120.414134][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 120.414149][ T28] audit: type=1400 audit(1790643667.582:516): avc: denied { read } for pid=5917 comm="syz.5.2380" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 120.439535][ T24] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 120.495800][ T330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready [ 120.536803][ T45] Bluetooth: hci1: command 0x1003 tx timeout [ 120.547521][ T1813] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 120.664958][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 120.671996][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.689695][ T24] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 120.712139][ T5948] loop8: detected capacity change from 0 to 256 [ 120.715521][ T24] usb 2-1: New USB device found, idVendor=2b73, idProduct=001e, bcdDevice= 0.40 [ 120.741222][ T5948] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 120.749386][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.769518][ T24] usb 2-1: Product: syz [ 120.776134][ T24] usb 2-1: Manufacturer: syz [ 120.782654][ T24] usb 2-1: SerialNumber: syz [ 121.010718][ T24] usb 2-1: unit 5 not found! [ 121.019841][ T24] usb 2-1: USB disconnect, device number 12 [ 121.049590][ T5962] xt_hashlimit: size too large, truncated to 1048576 [ 121.159407][ T28] audit: type=1400 audit(1790643668.284:517): avc: denied { read } for pid=5970 comm="syz.8.2404" name="/" dev="configfs" ino=12474 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 121.210555][ T28] audit: type=1400 audit(1790643668.284:518): avc: denied { open } for pid=5970 comm="syz.8.2404" path="/" dev="configfs" ino=12474 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 121.253415][ T2266] udevd[2266]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 121.512170][ T5992] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.519461][ T5992] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.571673][ T5996] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2415'. [ 121.580832][ T5996] sch_fq: defrate 0 ignored. [ 121.629084][ T28] audit: type=1400 audit(1790643668.724:519): avc: denied { name_bind } for pid=6005 comm="syz.2.2419" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 121.659211][ T5997] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 121.680410][ T6006] TCP: TCP_TX_DELAY enabled [ 121.687810][ T5997] device veth0_vlan left promiscuous mode [ 121.700072][ T5997] device veth0_vlan entered promiscuous mode [ 121.710875][ T5997] device veth1_macvtap left promiscuous mode [ 121.718137][ T5997] device veth1_macvtap entered promiscuous mode [ 121.725787][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 121.733390][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 121.741235][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 121.750192][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.757292][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.765564][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 121.774248][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 121.783582][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.790710][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.798243][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 121.811842][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 121.820059][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 121.828439][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 121.836777][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 121.845154][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 121.853454][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 121.861649][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 121.869768][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 121.878138][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 121.886561][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 121.894877][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 121.903167][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 121.911610][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 121.919797][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 121.928283][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 121.936380][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 121.944600][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 121.953154][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 121.961779][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 121.970025][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 121.977978][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 121.985713][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 121.993420][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 122.001933][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 122.010264][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 122.018156][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 122.078156][ T6024] loop8: detected capacity change from 0 to 256 [ 122.100866][ T6024] FAT-fs (loop8): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 122.122690][ T6030] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2428'. [ 122.133657][ T6030] device ip6gre1 entered promiscuous mode [ 122.357458][ T6054] loop1: detected capacity change from 0 to 512 [ 122.382025][ T6054] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 122.409563][ T6054] EXT4-fs (loop1): 1 truncate cleaned up [ 122.415271][ T6054] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 122.428141][ T28] audit: type=1400 audit(1790643669.463:520): avc: denied { map } for pid=6055 comm="syz.8.2440" path="/dev/ashmem" dev="devtmpfs" ino=269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 122.472625][ T6054] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 122.567745][ T289] EXT4-fs (loop1): unmounting filesystem. [ 122.588583][ T222] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 122.674856][ T6086] loop8: detected capacity change from 0 to 128 [ 122.681606][ T6086] EXT4-fs: Ignoring removed nobh option [ 122.712016][ T6086] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 122.713427][ T6085] xt_hashlimit: size too large, truncated to 1048576 [ 122.729484][ T6086] ext4 filesystem being mounted at /26/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 122.761699][ T6086] fscrypt (loop8, inode 12): Reserved bits set in encryption policy [ 122.783743][ T5760] EXT4-fs (loop8): unmounting filesystem. [ 122.803383][ T222] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 122.818812][ T222] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 122.857022][ T222] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 122.866133][ T222] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 122.887865][ T222] usb 3-1: SerialNumber: syz [ 122.902155][ T222] usb 3-1: 0:2 : does not exist [ 123.102510][ T6110] loop1: detected capacity change from 0 to 256 [ 123.117012][ T60] usb 3-1: USB disconnect, device number 10 [ 123.139963][ T6110] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 123.167410][ T28] audit: type=1400 audit(1790643670.165:521): avc: denied { rename } for pid=6109 comm="syz.1.2464" name="file2" dev="loop1" ino=1048738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 123.236161][ T6119] loop1: detected capacity change from 0 to 128 [ 123.269739][ T6121] loop1: detected capacity change from 0 to 1024 [ 123.295913][ T6121] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 123.306484][ T28] audit: type=1400 audit(1790643670.296:522): avc: denied { reparent } for pid=6120 comm="syz.1.2469" name="file1" dev="loop1" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 123.329893][ T6121] EXT4-fs warning (device loop1): ext4_rmdir:3243: inode #11: comm syz.1.2469: empty directory 'file0' has too many links (111) [ 123.355432][ T289] EXT4-fs (loop1): unmounting filesystem. [ 123.365848][ T6127] can0: slcan on ttyS3. [ 123.379445][ T6129] loop1: detected capacity change from 0 to 256 [ 123.389317][ T6129] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 123.411885][ T6127] can0 (unregistered): slcan off ttyS3. [ 123.420049][ T6127] Falling back ldisc for ttyS3. [ 123.602595][ T6140] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 123.727634][ C1] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 123.738466][ T6131] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 123.763170][ T28] audit: type=1400 audit(1790643670.698:523): avc: denied { write } for pid=6149 comm="syz.8.2482" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 123.785645][ T28] audit: type=1400 audit(1790643670.698:524): avc: denied { read } for pid=6149 comm="syz.8.2482" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 124.061155][ T6172] loop1: detected capacity change from 0 to 256 [ 124.438574][ T222] kernel write not supported for file /vcsa (pid: 222 comm: kworker/0:2) [ 124.776469][ T28] audit: type=1400 audit(1790643671.662:525): avc: denied { bind } for pid=6205 comm="syz.1.2508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 124.990788][ T6218] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 125.036922][ T6218] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 125.064911][ T6218] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 125.315630][ T6228] set_capacity_and_notify: 2 callbacks suppressed [ 125.315652][ T6228] loop1: detected capacity change from 0 to 256 [ 125.804854][ T6249] loop2: detected capacity change from 0 to 2048 [ 125.872122][ T6249] EXT4-fs error (device loop2): __ext4_iget:5104: inode #2: block 127754: comm syz.2.2528: invalid block [ 125.892139][ T6249] EXT4-fs (loop2): get root inode failed [ 125.901045][ T6249] EXT4-fs (loop2): mount failed [ 126.141218][ T6274] loop8: detected capacity change from 0 to 128 [ 126.222003][ T6274] FAT-fs (loop8): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 126.247572][ T6289] loop2: detected capacity change from 0 to 256 [ 126.275544][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 126.275565][ T28] audit: type=1400 audit(1790643673.075:528): avc: denied { setopt } for pid=6287 comm="syz.7.2546" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 126.320642][ T6289] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 126.383472][ T330] FAT-fs (loop8): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 126.454275][ T6300] loop8: detected capacity change from 0 to 512 [ 126.493865][ T6300] EXT4-fs (loop8): Test dummy encryption mode enabled [ 126.517571][ T6300] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 126.607297][ T6300] EXT4-fs (loop8): 1 truncate cleaned up [ 126.613049][ T6300] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 126.653216][ T5760] EXT4-fs (loop8): unmounting filesystem. [ 126.771953][ T6305] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.800103][ T6318] loop2: detected capacity change from 0 to 512 [ 126.878556][ T6318] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 126.904376][ T6318] ext4 filesystem being mounted at /438/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 127.080285][ T6318] SELinux: Context : is not valid (left unmapped). [ 127.121130][ T28] audit: type=1400 audit(1790643673.852:529): avc: denied { relabelto } for pid=6316 comm="syz.2.2558" name="rdma.current" dev="loop2" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=":" [ 127.166227][ T291] EXT4-fs (loop2): unmounting filesystem. [ 127.174995][ T6309] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 127.192769][ T6309] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.199928][ T6309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.271306][ T6309] device veth0_vlan left promiscuous mode [ 127.281103][ T6338] __vm_enough_memory: pid: 6338, comm: syz.8.2565, no enough memory for the allocation [ 127.310933][ T6309] device veth0_vlan entered promiscuous mode [ 127.323797][ T6309] device veth1_macvtap left promiscuous mode [ 127.332669][ T6309] device veth1_macvtap entered promiscuous mode [ 127.341925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 127.363713][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 127.374397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 127.383492][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 127.393464][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 127.402704][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 127.411843][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 127.420842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 127.430158][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 127.438890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 127.453826][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 127.473120][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.480256][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.504429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 127.521200][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 127.533721][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 127.546523][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 127.560566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 127.594616][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 127.608032][ T6353] loop1: detected capacity change from 0 to 512 [ 127.614260][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 127.623769][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 127.634837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 127.652059][ T6353] EXT4-fs: Ignoring removed nobh option [ 127.664366][ T6] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 127.678017][ T757] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 127.707188][ T6353] EXT4-fs (loop1): Test dummy encryption mode enabled [ 127.724935][ T6353] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 127.776645][ T6353] EXT4-fs (loop1): 1 truncate cleaned up [ 127.816650][ T6353] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 127.879754][ T6] usb 9-1: New USB device found, idVendor=0925, idProduct=8888, bcdDevice= 0.00 [ 127.900322][ T6] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.908617][ T6365] input: syz1 as /devices/virtual/input/input26 [ 127.917866][ T6] usb 9-1: config 0 descriptor?? [ 127.981628][ T289] EXT4-fs (loop1): unmounting filesystem. [ 128.252307][ T757] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 128.510429][ T757] usb 3-1: unable to get BOS descriptor or descriptor too short [ 128.523527][ T6407] loop1: detected capacity change from 0 to 512 [ 128.531942][ T757] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.557766][ T6407] EXT4-fs (loop1): Test dummy encryption mode enabled [ 128.577891][ T757] usb 3-1: string descriptor 0 read error: -22 [ 128.594321][ T757] usb 3-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 128.610673][ T757] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.630206][ T6407] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 128.675862][ T6416] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2597'. [ 128.694405][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.711574][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.722620][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.730393][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.738290][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.746239][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.753781][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.760859][ T289] EXT4-fs (loop1): unmounting filesystem. [ 128.762474][ T6] smartjoyplus 0003:0925:8888.000C: unknown main item tag 0x0 [ 128.777913][ T6] smartjoyplus 0003:0925:8888.000C: hidraw0: USB HID vef.fd Device [HID 0925:8888] on usb-dummy_hcd.8-1/input0 [ 128.789811][ T6] smartjoyplus 0003:0925:8888.000C: no output reports found [ 128.921401][ T222] usb 9-1: USB disconnect, device number 2 [ 129.352783][ T222] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 129.427697][ T28] audit: type=1400 audit(1790643676.023:530): avc: denied { ioctl } for pid=6439 comm="syz.7.2606" path="socket:[42126]" dev="sockfs" ino=42126 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 129.521274][ T6] usb 3-1: USB disconnect, device number 11 [ 129.558584][ T222] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 129.578789][ T222] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 129.587716][ T222] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 129.630612][ T222] usb 2-1: config 220 has no interface number 2 [ 129.639449][ T222] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 129.656343][ T222] usb 2-1: config 220 interface 0 has no altsetting 0 [ 129.663534][ T222] usb 2-1: config 220 interface 76 has no altsetting 0 [ 129.670598][ T222] usb 2-1: config 220 interface 1 has no altsetting 0 [ 129.692342][ T222] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 129.710276][ T222] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.719345][ T222] usb 2-1: Product: syz [ 129.723959][ T222] usb 2-1: Manufacturer: syz [ 129.729769][ T222] usb 2-1: SerialNumber: syz [ 129.825973][ T6462] loop8: detected capacity change from 0 to 2048 [ 129.836884][ T6462] EXT4-fs: Ignoring removed orlov option [ 129.875362][ T6464] netlink: 64 bytes leftover after parsing attributes in process `syz.7.2618'. [ 129.892670][ T6462] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 129.901748][ T24] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 129.909482][ T6462] ext4 filesystem being mounted at /43/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 129.955706][ T222] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 129.974524][ T5760] EXT4-fs (loop8): unmounting filesystem. [ 129.980447][ T222] usb 2-1: No valid video chain found. [ 129.992640][ T222] usb 2-1: selecting invalid altsetting 0 [ 130.013335][ T222] usb 2-1: USB disconnect, device number 13 [ 130.118855][ T6482] loop2: detected capacity change from 0 to 128 [ 130.134322][ T24] usb 6-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.155243][ T24] usb 6-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.169929][ T24] usb 6-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 130.196044][ T24] usb 6-1: config 0 interface 0 has no altsetting 0 [ 130.204587][ T24] usb 6-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 130.214257][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.225234][ T24] usb 6-1: config 0 descriptor?? [ 130.284635][ T6487] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.292077][ T6487] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.396007][ T6490] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 130.430389][ T6490] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.437661][ T6490] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.456565][ T6447] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2609'. [ 130.472457][ T6490] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.479685][ T6490] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.491954][ T24] usbhid 6-1:0.0: can't add hid device: -71 [ 130.498179][ T24] usbhid: probe of 6-1:0.0 failed with error -71 [ 130.510173][ T24] usb 6-1: USB disconnect, device number 8 [ 130.520371][ T6490] device veth0_vlan left promiscuous mode [ 130.528051][ T6490] device veth0_vlan entered promiscuous mode [ 130.535498][ T6490] device veth1_macvtap left promiscuous mode [ 130.543293][ T6490] device veth1_macvtap entered promiscuous mode [ 130.552649][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.574549][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.606913][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.624191][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.633406][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 130.642505][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 130.651918][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 130.661234][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 130.670324][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 130.686549][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 130.695912][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 130.710760][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 130.719209][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 130.728910][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 130.737974][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.747132][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.756152][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.764838][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.773337][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.781705][ T6502] loop2: detected capacity change from 0 to 256 [ 130.975927][ T6516] loop1: detected capacity change from 0 to 512 [ 130.980932][ T6517] loop2: detected capacity change from 0 to 256 [ 131.393840][ T6544] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 131.634406][ T6560] loop2: detected capacity change from 0 to 1024 [ 131.708037][ T6560] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 131.731425][ T291] EXT4-fs (loop2): unmounting filesystem. [ 132.052589][ T6592] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2672'. [ 132.419939][ C1] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 132.492201][ T28] audit: type=1400 audit(1790643678.887:531): avc: denied { listen } for pid=6635 comm="syz.2.2692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 132.545521][ T28] audit: type=1400 audit(1790643678.887:532): avc: denied { accept } for pid=6635 comm="syz.2.2692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 132.660267][ T6647] loop1: detected capacity change from 0 to 2048 [ 132.713289][ T6647] loop1: p3 < > p4 < > [ 132.717607][ T6647] loop1: partition table partially beyond EOD, truncated [ 132.733588][ T6647] loop1: p3 start 4284289 is beyond EOD, truncated [ 133.094320][ T6667] ================================================================== [ 133.102445][ T6667] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 133.110568][ T6667] Read of size 4 at addr ffff888131155800 by task syz.7.2708/6667 [ 133.118401][ T6667] [ 133.120750][ T6667] CPU: 0 PID: 6667 Comm: syz.7.2708 Tainted: G W syzkaller #0 [ 133.129628][ T6667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 133.139717][ T6667] Call Trace: [ 133.143026][ T6667] [ 133.146020][ T6667] __dump_stack+0x21/0x24 [ 133.150403][ T6667] dump_stack_lvl+0x110/0x170 [ 133.155131][ T6667] ? __cfi_dump_stack_lvl+0x8/0x8 [ 133.157760][ T6494] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 133.160201][ T6667] ? _raw_spin_lock_bh+0x94/0xf0 [ 133.160242][ T6667] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 133.178471][ T6667] print_address_description+0x71/0x200 [ 133.184060][ T6667] print_report+0x4a/0x60 [ 133.188436][ T6667] kasan_report+0x122/0x150 [ 133.193003][ T6667] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 133.198774][ T6667] __asan_report_load4_noabort+0x14/0x20 [ 133.204440][ T6667] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 133.210041][ T6667] pppol2tp_release+0x150/0x2b0 [ 133.214971][ T6667] sock_close+0xc9/0x220 [ 133.217314][ T28] audit: type=1326 audit(1790643679.457:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6669 comm="syz.5.2709" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fecc139e159 code=0x0 [ 133.219253][ T6667] ? __cfi_sock_close+0x10/0x10 [ 133.219283][ T6667] __fput+0x1fd/0x8f0 [ 133.219316][ T6667] ____fput+0x15/0x20 [ 133.256190][ T6667] task_work_run+0x1e1/0x250 [ 133.260821][ T6667] ? __cfi_task_work_run+0x10/0x10 [ 133.265971][ T6667] ? trace_event_raw_event_sys_exit+0x7c/0xa0 [ 133.272106][ T6667] exit_to_user_mode_loop+0x9b/0xb0 [ 133.277543][ T6667] exit_to_user_mode_prepare+0x87/0xd0 [ 133.283043][ T6667] syscall_exit_to_user_mode+0x1a/0x30 [ 133.288630][ T6667] do_syscall_64+0x58/0xa0 [ 133.293089][ T6667] ? clear_bhb_loop+0x30/0x80 [ 133.297806][ T6667] ? clear_bhb_loop+0x30/0x80 [ 133.302527][ T6667] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 133.308462][ T6667] RIP: 0033:0x7f618919e159 [ 133.312912][ T6667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.332561][ T6667] RSP: 002b:00007ffd9ed60718 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 133.341017][ T6667] RAX: 0000000000000000 RBX: 00007ffd9ed60800 RCX: 00007f618919e159 [ 133.349110][ T6667] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 133.357120][ T6667] RBP: 000000000001f497 R08: 0000000000000001 R09: 0000000000000000 [ 133.365133][ T6667] R10: 0000001b32320000 R11: 0000000000000246 R12: 00007ffd9ed60840 [ 133.373141][ T6667] R13: 00007f6189425fac R14: 000000000001f4d1 R15: 00007f6189425fa0 [ 133.381243][ T6667] [ 133.384289][ T6667] [ 133.386663][ T6667] Allocated by task 6668: [ 133.391015][ T6667] kasan_set_track+0x4b/0x70 [ 133.395648][ T6667] kasan_save_alloc_info+0x1f/0x30 [ 133.400794][ T6667] __kasan_kmalloc+0x95/0xb0 [ 133.405430][ T6667] __kmalloc+0xb4/0x1e0 [ 133.409618][ T6667] l2tp_session_create+0x38/0xbd0 [ 133.414676][ T6667] pppol2tp_connect+0xbf5/0x1640 [ 133.419624][ T6667] __sys_connect+0x3da/0x460 [ 133.424233][ T6667] __x64_sys_connect+0x7a/0x90 [ 133.429050][ T6667] x64_sys_call+0x88d/0x9a0 [ 133.433571][ T6667] do_syscall_64+0x4c/0xa0 [ 133.438019][ T6667] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 133.443948][ T6667] [ 133.446301][ T6667] Freed by task 649: [ 133.450208][ T6667] kasan_set_track+0x4b/0x70 [ 133.454856][ T6667] kasan_save_free_info+0x2b/0x40 [ 133.459934][ T6667] ____kasan_slab_free+0x132/0x180 [ 133.465085][ T6667] __kasan_slab_free+0x11/0x20 [ 133.469918][ T6667] slab_free_freelist_hook+0xc2/0x190 [ 133.475329][ T6667] __kmem_cache_free+0xb7/0x1b0 [ 133.480207][ T6667] kfree+0x6f/0xf0 [ 133.483956][ T6667] l2tp_session_put+0xaf/0x1a0 [ 133.488732][ T6667] l2tp_session_delete+0x3df/0x4d0 [ 133.493859][ T6667] l2tp_tunnel_del_work+0x199/0x410 [ 133.499070][ T6667] process_one_work+0x717/0xc30 [ 133.503974][ T6667] worker_thread+0xa4d/0x11d0 [ 133.508669][ T6667] kthread+0x281/0x320 [ 133.512779][ T6667] ret_from_fork+0x1f/0x30 [ 133.517219][ T6667] [ 133.519560][ T6667] Last potentially related work creation: [ 133.525284][ T6667] kasan_save_stack+0x3a/0x60 [ 133.530015][ T6667] __kasan_record_aux_stack+0xb6/0xc0 [ 133.535392][ T6667] kasan_record_aux_stack_noalloc+0xb/0x10 [ 133.541209][ T6667] kvfree_call_rcu+0x8b/0x7a0 [ 133.545999][ T6667] inet6_ifa_finish_destroy+0x129/0x1b0 [ 133.551578][ T6667] addrconf_ifdown+0x1254/0x1950 [ 133.556546][ T6667] addrconf_notify+0x39f/0xe30 [ 133.561344][ T6667] raw_notifier_call_chain+0xa1/0x110 [ 133.566751][ T6667] __dev_notify_flags+0x276/0x5b0 [ 133.571795][ T6667] dev_change_flags+0xe3/0x1a0 [ 133.576578][ T6667] do_setlink+0xc02/0x2a10 [ 133.581128][ T6667] rtnl_newlink+0x10b3/0x20d0 [ 133.585820][ T6667] rtnetlink_rcv_msg+0xb28/0xde0 [ 133.590784][ T6667] netlink_rcv_skb+0x200/0x450 [ 133.595590][ T6667] rtnetlink_rcv+0x1c/0x20 [ 133.600071][ T6667] netlink_unicast+0x8c1/0xa60 [ 133.604872][ T6667] netlink_sendmsg+0x8b9/0xbd0 [ 133.609669][ T6667] ____sys_sendmsg+0x5fb/0x9c0 [ 133.614449][ T6667] ___sys_sendmsg+0x2a2/0x360 [ 133.619165][ T6667] __x64_sys_sendmsg+0x20d/0x2e0 [ 133.624136][ T6667] x64_sys_call+0x171/0x9a0 [ 133.628668][ T6667] do_syscall_64+0x4c/0xa0 [ 133.633125][ T6667] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 133.639067][ T6667] [ 133.641401][ T6667] Second to last potentially related work creation: [ 133.647999][ T6667] kasan_save_stack+0x3a/0x60 [ 133.652689][ T6667] __kasan_record_aux_stack+0xb6/0xc0 [ 133.658074][ T6667] kasan_record_aux_stack_noalloc+0xb/0x10 [ 133.663564][ T6494] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.663887][ T6667] insert_work+0x51/0x300 [ 133.663914][ T6667] __queue_work+0x9d0/0xd50 [ 133.675550][ T6494] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 133.679199][ T6667] delayed_work_timer_fn+0x61/0x80 [ 133.679234][ T6667] call_timer_fn+0x46/0x2a0 [ 133.706136][ T6667] __run_timers+0x672/0x9b0 [ 133.710075][ T6494] usb 2-1: config 0 interface 0 has no altsetting 0 [ 133.717266][ T6667] run_timer_softirq+0x6a/0xf0 [ 133.717302][ T6667] handle_softirqs+0x1d7/0x600 [ 133.717325][ T6667] __irq_exit_rcu+0x52/0xf0 [ 133.717348][ T6667] irq_exit_rcu+0x9/0x10 [ 133.717370][ T6667] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 133.717395][ T6667] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 133.717431][ T6667] [ 133.717437][ T6667] The buggy address belongs to the object at ffff888131155800 [ 133.717437][ T6667] which belongs to the cache kmalloc-512 of size 512 [ 133.727869][ T6494] usb 2-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 133.731490][ T6667] The buggy address is located 0 bytes inside of [ 133.731490][ T6667] 512-byte region [ffff888131155800, ffff888131155a00) [ 133.731520][ T6667] [ 133.731528][ T6667] The buggy address belongs to the physical page: [ 133.731540][ T6667] page:ffffea0004c45500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x131154 [ 133.738018][ T6494] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.741429][ T6667] head:ffffea0004c45500 order:2 compound_mapcount:0 compound_pincount:0 [ 133.741453][ T6667] flags: 0x4000000000010200(slab|head|zone=1) [ 133.762995][ T6494] usb 2-1: config 0 descriptor?? [ 133.763852][ T6667] raw: 4000000000010200 ffffea0004c5fa00 dead000000000002 ffff888100042f00 [ 133.763879][ T6667] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 133.763893][ T6667] page dumped because: kasan: bad access detected [ 133.855975][ T6667] page_owner tracks the page as allocated [ 133.861771][ T6667] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 290, tgid 290 (syz-executor), ts 25378786130, free_ts 0 [ 133.882118][ T6667] post_alloc_hook+0x1f5/0x210 [ 133.886929][ T6667] prep_new_page+0x1c/0x110 [ 133.891479][ T6667] get_page_from_freelist+0x2ca9/0x2d20 [ 133.897080][ T6667] __alloc_pages+0x1fa/0x610 [ 133.901707][ T6667] alloc_slab_page+0x6e/0xf0 [ 133.906322][ T6667] new_slab+0x98/0x3e0 [ 133.910419][ T6667] ___slab_alloc+0x70f/0xb70 [ 133.915061][ T6667] __slab_alloc+0x5e/0xa0 [ 133.919432][ T6667] __kmem_cache_alloc_node+0x204/0x2d0 [ 133.924918][ T6667] __kmalloc_node_track_caller+0xa1/0x1e0 [ 133.930683][ T6667] __alloc_skb+0x226/0x4a0 [ 133.935144][ T6667] netlink_ack+0x373/0x1160 [ 133.939676][ T6667] netlink_rcv_skb+0x27e/0x450 [ 133.944468][ T6667] rtnetlink_rcv+0x1c/0x20 [ 133.948955][ T6667] netlink_unicast+0x8c1/0xa60 [ 133.953758][ T6667] netlink_sendmsg+0x8b9/0xbd0 [ 133.958559][ T6667] page_owner free stack trace missing [ 133.963964][ T6667] [ 133.966303][ T6667] Memory state around the buggy address: [ 133.971960][ T6667] ffff888131155700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 133.980045][ T6667] ffff888131155780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 133.988134][ T6667] >ffff888131155800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 133.996215][ T6667] ^ [ 134.000301][ T6667] ffff888131155880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.008395][ T6667] ffff888131155900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.016509][ T6667] ================================================================== [ 134.027001][ T6667] Disabling lock debugging due to kernel taint [ 134.033492][ T6667] ------------[ cut here ]------------ [ 134.038999][ T6667] WARNING: CPU: 0 PID: 6667 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 134.049185][ T6667] Modules linked in: [ 134.053105][ T6667] CPU: 0 PID: 6667 Comm: syz.7.2708 Tainted: G B W syzkaller #0 [ 134.062026][ T6667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.072379][ T6667] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 134.078947][ T6667] Code: 5d c3 e8 5c 42 d5 fc be 02 00 00 00 eb 0a e8 50 42 d5 fc be 01 00 00 00 4c 89 f7 e8 d3 03 cd fd e9 0f ff ff ff e8 39 42 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 42 d5 fc 4c 89 f7 be 03 [ 134.098669][ T6667] RSP: 0018:ffffc90003867cb0 EFLAGS: 00010293 [ 134.106190][ T6667] RAX: ffffffff849c2987 RBX: ffff88812a7b4000 RCX: ffff888115ab0000 [ 134.114259][ T6667] RDX: 0000000000000000 RSI: 00000000316bd0c0 RDI: 000000000c04eb7d [ 134.122326][ T6667] RBP: ffffc90003867cd0 R08: ffffffff87b767e7 R09: 1ffffffff0f6ecfc [ 134.130396][ T6667] R10: dffffc0000000000 R11: fffffbfff0f6ecfd R12: dffffc0000000000 [ 134.138408][ T6667] R13: dffffc0000000000 R14: 00000000316bd0c0 R15: ffff888131155800 [ 134.146471][ T6667] FS: 00005555615d1500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 134.155480][ T6667] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.162147][ T6667] CR2: 0000001b2ef17ff8 CR3: 0000000130c7b000 CR4: 00000000003506b0 [ 134.170159][ T6667] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 134.178215][ T6667] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 134.186276][ T6667] Call Trace: [ 134.189581][ T6667] [ 134.192551][ T6667] pppol2tp_release+0x150/0x2b0 [ 134.197498][ T6667] sock_close+0xc9/0x220 [ 134.201798][ T6667] ? __cfi_sock_close+0x10/0x10 [ 134.206737][ T6667] __fput+0x1fd/0x8f0 [ 134.210788][ T6667] ____fput+0x15/0x20 [ 134.214868][ T6667] task_work_run+0x1e1/0x250 [ 134.219500][ T6667] ? __cfi_task_work_run+0x10/0x10 [ 134.224666][ T6667] ? trace_event_raw_event_sys_exit+0x7c/0xa0 [ 134.230847][ T6667] exit_to_user_mode_loop+0x9b/0xb0 [ 134.236105][ T6667] exit_to_user_mode_prepare+0x87/0xd0 [ 134.240507][ T6494] hid-multitouch 0003:0EEF:72C4.000D: ignoring exceeding usage max [ 134.241688][ T6667] syscall_exit_to_user_mode+0x1a/0x30 [ 134.255016][ T6667] do_syscall_64+0x58/0xa0 [ 134.256040][ T6494] hid-multitouch 0003:0EEF:72C4.000D: unbalanced collection at end of report description [ 134.259522][ T6667] ? clear_bhb_loop+0x30/0x80 [ 134.271886][ T6494] hid-multitouch: probe of 0003:0EEF:72C4.000D failed with error -22 [ 134.274059][ T6667] ? clear_bhb_loop+0x30/0x80 [ 134.274091][ T6667] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 134.292843][ T6667] RIP: 0033:0x7f618919e159 [ 134.297289][ T6667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.317841][ T6667] RSP: 002b:00007ffd9ed60718 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 134.326610][ T6667] RAX: 0000000000000000 RBX: 00007ffd9ed60800 RCX: 00007f618919e159 [ 134.334679][ T6667] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 134.342686][ T6667] RBP: 000000000001f497 R08: 0000000000000001 R09: 0000000000000000 [ 134.350725][ T6667] R10: 0000001b32320000 R11: 0000000000000246 R12: 00007ffd9ed60840 [ 134.358748][ T6667] R13: 00007f6189425fac R14: 000000000001f4d1 R15: 00007f6189425fa0 [ 134.366788][ T6667] [ 134.369830][ T6667] ---[ end trace 0000000000000000 ]--- [ 134.437977][ T688] usb 2-1: USB disconnect, device number 14 [ 141.823539][ C1] ip6_tunnel: syztnl1 xmit: Local address not yet configured!