last executing test programs:

2m5.125184868s ago: executing program 1 (id=196):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0)
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
r0 = open(&(0x7f0000000140)='.\x00', 0x80000, 0x103)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8)

2m4.914551767s ago: executing program 1 (id=197):
r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0)
r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0xe)
r2 = dup(r0)
write$UHID_INPUT(r2, &(0x7f0000001040)={0x18, {"a2e3ad21ed6b52f99cfbf4c087f70c9b3e6ee7ff7fc6e5539b9b3b0e8b9b411b5d30091b080d29428f0e1ac6e7049b3468959b4c9a242a9b67f3988f7ef319520200ffe8d178708c523c921b1b25380a169b63d336cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x100d}}, 0xfffffdef)

2m4.658553839s ago: executing program 1 (id=199):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x0)

2m4.486562947s ago: executing program 1 (id=200):
syz_mount_image$vfat(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x10000, 0xffffffffffffffff, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0)
chroot(&(0x7f0000000100)='./file0\x00')
mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0)
pivot_root(&(0x7f0000000380)='./file0/../file0/../file0\x00', &(0x7f00000000c0)='./file0\x00')

2m4.325189145s ago: executing program 1 (id=202):
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000020180)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x1000a)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000026c0)=0x3d)

2m3.926870473s ago: executing program 1 (id=205):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffe3a}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r2=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x8070bd2c, 0x25dfdbff, {0x0, 0x0, 0x12, r2, {0x0, 0x11}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0xfffffffb}, @TCA_FQ_FLOW_REFILL_DELAY={0x0, 0x9, 0x58a}, @TCA_FQ_RATE_ENABLE={0x4, 0x5, 0x1001}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000840}, 0x0)

2m3.540787691s ago: executing program 32 (id=205):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffe3a}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r2=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x8070bd2c, 0x25dfdbff, {0x0, 0x0, 0x12, r2, {0x0, 0x11}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0xfffffffb}, @TCA_FQ_FLOW_REFILL_DELAY={0x0, 0x9, 0x58a}, @TCA_FQ_RATE_ENABLE={0x4, 0x5, 0x1001}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000840}, 0x0)

1m34.506341935s ago: executing program 3 (id=366):
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000))
r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000000140)={0x7, 0x3, 0x6, 0x7fff, 0x17, "ee1dd756f560f25a63b2f119c3439425ea59d8"})

1m34.229992488s ago: executing program 3 (id=367):
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000100002020207b1af8ff00000000bf86a26db800000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa1000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000d0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000002d"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc)

1m33.994668609s ago: executing program 3 (id=369):
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000300), 0x4, 0xbaf, &(0x7f00000017c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q")
r0 = open(&(0x7f0000000200)='./file1\x00', 0x4827e, 0x20)
fallocate(r0, 0x0, 0x0, 0x8800000)
r1 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21)
pwritev2(r1, &(0x7f0000003480)=[{&(0x7f0000000340)="c4", 0x1}, {0x0}], 0x2, 0x7f, 0xc63, 0x8)

1m33.244733493s ago: executing program 3 (id=374):
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000000, 0x42032, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000c00000/0x400000)=nil, 0x400000}})

1m32.716853498s ago: executing program 3 (id=377):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0xe, 0x5}, {}, {0x7, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x20048091}, 0x0)
sendmsg$inet(r0, &(0x7f00000029c0)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30000001)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000500)="0f", 0x7fd8}], 0x20}, 0x40040)
sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x13, 0xa, 0x3, 0x0, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x2000c040}, 0xc000)

1m32.494503779s ago: executing program 3 (id=379):
syz_usb_connect(0x2, 0x2d, &(0x7f0000000540)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e001c030109021b00"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./my_debugfs\x00', 0x4)
mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_debugfs/usb/devices\x00', 0x2, 0x0)
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)

1m17.297428412s ago: executing program 33 (id=379):
syz_usb_connect(0x2, 0x2d, &(0x7f0000000540)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e001c030109021b00"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./my_debugfs\x00', 0x4)
mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_debugfs/usb/devices\x00', 0x2, 0x0)
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)

48.695606396s ago: executing program 2 (id=667):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc)

48.463017147s ago: executing program 2 (id=669):
socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
socket$kcm(0x23, 0x5, 0x0)
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x6}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c000000000000000000000014", @ANYRES8=0x0, @ANYRES32=r0], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0)

48.262921846s ago: executing program 2 (id=672):
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x80000000, 0x0, 'queue0\x00', 0x132a})
ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000280)={0x0, 0xfffffffffffffffe, 0x0, 0x1})
write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a)
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01)
write$sndseq(r1, &(0x7f00000000c0)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x80, {0x0, 0xfb}, {}, @result={0x0, 0x2}}], 0x1c)

48.030944987s ago: executing program 2 (id=675):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x404, &(0x7f00000012c0)={[{@nogrpid}, {@data_err_ignore}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@errors_remount}, {@mblk_io_submit}, {@quota}, {@nojournal_checksum}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000100)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0)
syz_clone3(&(0x7f0000000400)={0x2000080, 0x0, 0x0, 0x0, {0x25}, 0x0, 0x0, 0x0, 0x0}, 0x58)

47.694559353s ago: executing program 2 (id=677):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a1a40001010203010902470001010080320904000005000000000705810340000107058202000200070502020002000705830200020007050302"], 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='0525 a4a1', 0x9)
syz_usb_disconnect(r0)

47.062833932s ago: executing program 2 (id=685):
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x0, 0x2010, 0xffffffffffffffff, 0xec777000)
ptrace(0x10, r0)
ptrace$setsig(0x4203, r0, 0x40, &(0x7f0000000240)={0x8, 0x1, 0x9})

46.632021462s ago: executing program 34 (id=685):
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x0, 0x2010, 0xffffffffffffffff, 0xec777000)
ptrace(0x10, r0)
ptrace$setsig(0x4203, r0, 0x40, &(0x7f0000000240)={0x8, 0x1, 0x9})

31.086857702s ago: executing program 6 (id=819):
r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0)
fchdir(r0)
syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00')
mount(&(0x7f0000000000), &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x1001, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00')
read$FUSE(r1, &(0x7f0000000240)={0x2020}, 0x2020)

30.862634442s ago: executing program 6 (id=822):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000000)=[@code={0xa, 0x18, {"b80000c0fe3acb80"}}], 0xd3})
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0xe000, 0x9, 0x77, 0x0, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6}, {0x2, 0x9000, 0xd, 0xeb, 0x2, 0x0, 0x0, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0x0, 0x0, 0x7, 0xc4, 0x5, 0x1, 0x41, 0x3, 0x4, 0xfc}, {0x1, 0x3000, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x0, 0x26}, {0x0, 0xffff1000, 0x3, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0x4}, {0xffff1000, 0x1, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1a, 0xa3, 0xff, 0x9}, {0xeeee8000, 0xdddd1000, 0xa, 0xc, 0x0, 0x0, 0x7, 0x20}, {0x0, 0x6000, 0xa, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0x80a0000, 0x3}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x0, 0xf801, 0xdddd1000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]})

30.717406539s ago: executing program 6 (id=823):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r1=>0x0})
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r3, r1, 0x25, 0x0, @void}, 0x10)
syz_emit_ethernet(0x7a, &(0x7f0000000880)={@local, @multicast, @void, {@ipv6={0x86dd, @gre_packet={0x3, 0x6, 'n[Q', 0x44, 0x2f, 0xff, @mcast2, @private2, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x7, {{0xd, 0x1, 0xc, 0x3, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x390e}}}, {0x8, 0x22eb, 0x3, {{0x8, 0x2, 0x6, 0x0, 0x1, 0x1, 0x7, 0xf}, 0x2, {0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}}, 0x0)

30.539088117s ago: executing program 6 (id=825):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0)
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262)

30.517945618s ago: executing program 6 (id=826):
connect$tipc(0xffffffffffffffff, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1}, 0x2}}, 0x10)
r0 = socket$inet6(0x10, 0x3, 0x0)
sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x18}, 0x922bac8556bdad8e)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x88d0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94)
sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b)

30.062996359s ago: executing program 6 (id=831):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r3, r4, 0x4, r4}, 0x5)

29.635962889s ago: executing program 35 (id=831):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r3, r4, 0x4, r4}, 0x5)

24.083496356s ago: executing program 5 (id=864):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x80)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x482, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum={0x6}]}, {0x0, [0x30, 0x30, 0x61, 0x30, 0x30]}}, &(0x7f0000000180)=""/79, 0x2b, 0x4f, 0x1, 0x802}, 0x28)

23.475310124s ago: executing program 5 (id=865):
socket$xdp(0x2c, 0x3, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0)
r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, &(0x7f0000000300)=<r5=>0x0)
syz_ublk_setup_queues(r0, r5, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3104, 0x1, 0x1, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587d, 0x200, 0x1, 0x69, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x800, 0x10000, 0x400000, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x20, 0x3, 0x0, 0x0, r0}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xdbd, 0x0, 0x0}}, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94)

23.12450647s ago: executing program 5 (id=868):
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x1, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x9, 0x2, 0xd20, 0x3, 0xfffffffffffffffe, 0x0, 0x9, 0x2, 0x0, 0x802, 0x2000000009, 0x100, 0x3, 0x4, 0x4a, 0x5, 0x100, 0xd, 0xe1, 0x5, 0x6, 0x2aa, 0x7, 0xc39, 0x8000008, 0x8, 0x0, 0x2, 0xa51, 0x401, 0x80401, 0x3, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x933, 0x101, 0x3, 0x8001, 0x8000000000000400, 0x680, 0x0, 0x8, 0x8, 0x6aa, 0x100, 0x40, 0x83, 0x538a, 0x9, 0xdb, 0x5, 0x0, 0x14, 0x800000000000005, 0x7, 0x8000, 0x8000000000000000, 0x2, 0xfffffffffffffffd, 0x1000000000014, 0x0, 0x1, 0x7fffffff, 0x4, 0x2000008000, 0x9, 0xfffffffffffffffd, 0x6, 0x1, 0x82c, 0x7ff, 0xffff, 0x1fcc, 0x6, 0x5b, 0xd, 0x22, 0xffffffffffffffff, 0x7, 0xfffffffffffffffd, 0x8000000000000000, 0x4, 0x8, 0x0, 0x6, 0x26, 0x9, 0x100000002, 0x0, 0x4, 0x3, 0xf, 0x4, 0x9, 0x1001, 0x16d, 0x6, 0x68d, 0xfffffffffff743ac, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x2400000003, 0x4, 0x8, 0x6, 0x3, 0x8, 0x2000000000000005, 0x0, 0x3, 0x40, 0x80000000, 0x7, 0xa, 0x3]})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b80, &(0x7f0000000040)={0x0, 0x8970, 0x1f280, 0x0, 0x8000399})
syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa"], 0x0)
io_uring_enter(r0, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0)

22.671201161s ago: executing program 5 (id=872):
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x8a000)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc)
ioctl$SNDRV_PCM_IOCTL_XRUN(r2, 0x4148, 0x0)

19.502953238s ago: executing program 5 (id=890):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0)
r0 = syz_io_uring_setup(0x686f, &(0x7f0000000200)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000140)=<r1=>0x0, &(0x7f00000004c0)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)

19.266844289s ago: executing program 5 (id=892):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffa, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x68, 0x2c, 0xd3b, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0xc, 0x2}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_basic={{0xa}, {0x38, 0x2, [@TCA_BASIC_EMATCHES={0x34, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x9}, {0x9, 0x4008, 0x2, 0x6, 0x3, 0x1, 0x2}}}, @TCF_EM_IPT={0xc, 0x2, 0x0, 0x0, {{0x3, 0x9, 0x7}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x410c4}, 0x4880)

5.357800713s ago: executing program 4 (id=970):
syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x400, &(0x7f0000000300)={[{@barrier_val={'barrier', 0x3d, 0x81}}, {@minixdf}, {@bh}, {@delalloc}, {@dioread_nolock}, {@noquota}]}, 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=")
r0 = creat(&(0x7f0000000140)='./bus\x00', 0x182)
pwrite64(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x8000c5b)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x2002, 0xa)
fallocate(r0, 0x0, 0x0, 0x2000402)
ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0xc, r0, 0x0, 0x0, 0x0, 0xfffffffffdffffff})

4.499825692s ago: executing program 4 (id=974):
r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
fchdir(r1)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0)
lseek(r2, 0xfffffffffffffffc, 0x2)

4.006261715s ago: executing program 36 (id=892):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffa, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x68, 0x2c, 0xd3b, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0xc, 0x2}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_basic={{0xa}, {0x38, 0x2, [@TCA_BASIC_EMATCHES={0x34, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x9}, {0x9, 0x4008, 0x2, 0x6, 0x3, 0x1, 0x2}}}, @TCF_EM_IPT={0xc, 0x2, 0x0, 0x0, {{0x3, 0x9, 0x7}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x410c4}, 0x4880)

3.963035147s ago: executing program 4 (id=976):
r0 = socket(0x10, 0x803, 0x0)
pipe2(&(0x7f0000000100), 0x0)
r1 = socket(0x1, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40, 0x22, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_ADDRESS={0x14, 0x1, @loopback}]}, 0x40}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="400000001400b595feffffe40f0000000a003efe", @ANYRES32=r2, @ANYBLOB="1400020000000000000000000000ffff0000000014000100"], 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0)

3.767389996s ago: executing program 4 (id=969):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0x0, 0x3dde}, 0x0, [0x0, 0x0, 0x200, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0xffffffff, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x40003, 0x0, 0x0, 0x0, 0x0, 0x5], [0x0, 0x0, 0x8, 0xb16, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x2, 0x0, 0x0, 0x2, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x9, 0xd, 0x1000, 0x0, 0xf, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0xffffffff, 0xfffffffe, 0x0, 0xff, 0xfffffffd, 0xfffffffd, 0x0, 0xfffffffa, 0x0, 0x80000000, 0x0, 0x0, 0x800, 0x0, 0x0, 0x9148, 0x0, 0x2, 0x0, 0xd, 0xffffffff], [0x80000001, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xddc, 0x0, 0x0, 0xfffffffc, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x5, 0x2, 0x0, 0x8000000, 0x0, 0x0, 0xffffffff, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x7, 0x4], [0xfffffffd, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x8, 0x0, 0xc045, 0x10, 0x16, 0x0, 0x4, 0x0, 0x80, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x0, 0x0, 0xffffffff, 0x0, 0x5, 0x0, 0x3, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x4, 0x0, 0x0, 0xfffffffd, 0x80, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c)
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0xfffd, 0xd}, 0x4d, [0x400, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ff, 0xfffffe00, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0xffff, 0x0, 0xfffffffc, 0x120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffc3c3, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x3, 0x3, 0x0, 0x0, 0x6, 0x0, 0xfffffffb, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x400000, 0x1, 0x0, 0xfffffff8, 0xfffffffe, 0x0, 0x4, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2842, 0xfffffffe, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10e3, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0xf9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff, 0x43, 0x7fffffc, 0x0, 0x0, 0x7fff, 0x0, 0x80003, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x7ff, 0x0, 0x6, 0x2], [0x81, 0x0, 0x5d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x100, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfc2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x4, 0x0, 0x2, 0x2, 0x0, 0x4, 0x0, 0x0, 0xe58b, 0xe, 0x0, 0x3, 0x0, 0x1, 0x1ff]}, 0x45c)

3.564991165s ago: executing program 7 (id=971):
unshare(0x20040600)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = fsopen(&(0x7f0000000280)='configfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x0)
ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000380)={{r2}, 0x7, 0x5, 0x1})

3.279550658s ago: executing program 4 (id=973):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r1=>0x0})
r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000000000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x19c}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r3, r1, 0x25, 0x0, @void}, 0x10)
syz_emit_ethernet(0x52, &(0x7f0000000740)=ANY=[], 0x0)

3.24094798s ago: executing program 7 (id=975):
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/4\x00')
pread64(r2, &(0x7f0000000080)=""/11, 0xb, 0x2000000000401)

3.071183199s ago: executing program 4 (id=977):
r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
pwritev2(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0)
getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x31, 0x0, 0x0)
ppoll(&(0x7f00000000c0)=[{r1, 0x44}, {r1}, {}, {r1, 0x200}, {0xffffffffffffffff, 0x1080}, {r1, 0x501}], 0x6, &(0x7f0000000140)={0x0, 0x989680}, 0x0, 0x0)

3.0305239s ago: executing program 7 (id=978):
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@local, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x0, 0x0, 0x48, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffd, 0x0, 0x6, 0x2, 0x5, 0x2, 0x5}, {0x0, 0x0, 0x0, 0x20000000000000}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x4d4, 0x6c}, 0x2, @in=@broadcast, 0x3502, 0x4, 0x1, 0x0, 0x0, 0x0, 0x200000}}, 0xe8)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c)
syz_emit_ethernet(0x56, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x41424344, 0x0, 0x0, 0x8, 0x18, 0x1001, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x2800}]}}}}}}}}, 0x0)

2.964896413s ago: executing program 0 (id=980):
r0 = msgget(0x2, 0x200)
msgctl$IPC_RMID(r0, 0x0)
msgget(0x0, 0x710)
msgget(0x2, 0x624)
msgget(0x1, 0x240)
msgget(0x3, 0x606)

2.673680447s ago: executing program 0 (id=981):
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bind$bt_sco(r0, &(0x7f00000004c0)={0x1f, @none}, 0x14)
listen(r0, 0xc)
poll(&(0x7f0000000100)=[{r0, 0x1000}], 0x1, 0x7eaa)
poll(&(0x7f0000000000), 0x20000000000000b5, 0x9)

2.025470707s ago: executing program 7 (id=982):
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]})
bpf$PROG_LOAD(0x5, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
r1 = fcntl$dupfd(r0, 0x0, r0)
write$sndseq(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @time={0x4, 0x4}, {}, {}, @connect={{0x5, 0xf0}, {0x1, 0x2}}}, {0x0, 0x0, 0x0, 0x0, @time={0x10}, {}, {}, @control={0x0, 0x8001}}], 0x38)

1.007175463s ago: executing program 7 (id=983):
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
setpgid(r0, r0)
setpgid(0x0, r0)
wait4(r0, 0x0, 0x2, 0x0)
tkill(r0, 0x37)

1.006427934s ago: executing program 0 (id=990):
socketpair$unix(0x1, 0x2, 0x0, 0x0)
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x34, r1, 0x1, 0x70bd27, 0x3, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_FLAGS={0xc, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_WME={0x4}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x4048014)

839.429811ms ago: executing program 0 (id=984):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e00, 0x100bf28, @loopback, 0x7ca}, 0x1c)
setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000080)={0x87}, 0x8)
sendto$inet6(r0, 0x0, 0x3d, 0x4088010, 0x0, 0x0)

706.631448ms ago: executing program 0 (id=985):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2000000000000070200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)

820.13µs ago: executing program 7 (id=986):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb010018000000000000001000f4001000000002000000030000000000ff110100000002"], 0x0, 0x2a, 0x0, 0x1}, 0x28)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='rdma.current\x00', 0x26e1, 0x0)
close(r0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340))
ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"})

0s ago: executing program 0 (id=994):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'pim6reg1\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x7)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
close(0x3)

kernel console output (not intermixed with test programs):

? xfs_bmapi_minleft+0x200/0x200
[  145.724119][ T7088]  ? xfs_trans_alloc_inode+0x195/0x340
[  145.729619][ T7088]  xfs_iomap_write_direct+0x3ba/0x680
[  145.735024][ T7088]  ? xfs_eof_alignment+0x2c0/0x2c0
[  145.740147][ T7088]  ? down_read_nested+0x1ae/0x2e0
[  145.745182][ T7088]  ? xfs_direct_write_iomap_begin+0xbd8/0x1060
[  145.751360][ T7088]  ? xfs_direct_write_iomap_begin+0xbd8/0x1060
[  145.757541][ T7088]  ? xfs_iunlock+0x1c0/0x300
[  145.762153][ T7088]  xfs_direct_write_iomap_begin+0xbff/0x1060
[  145.768149][ T7088]  ? xfs_file_dio_write_aligned+0x148/0x1d0
[  145.774054][ T7088]  ? xfs_file_write_iter+0x4fe/0x610
[  145.779352][ T7088]  ? do_iter_write+0x747/0xc50
[  145.784149][ T7088]  ? xfs_iomap_write_unwritten+0xa50/0xa50
[  145.789967][ T7088]  ? filemap_write_and_wait_range+0x1a5/0x230
[  145.796049][ T7088]  ? xas_next_entry+0x3e0/0x3e0
[  145.800923][ T7088]  ? xfs_iomap_write_unwritten+0xa50/0xa50
[  145.806750][ T7088]  iomap_iter+0x65b/0xe70
[  145.811096][ T7088]  __iomap_dio_rw+0xc60/0x1d00
[  145.815893][ T7088]  ? xfs_trans_log_inode+0x11f/0x190
[  145.821201][ T7088]  ? iomap_dio_bio_end_io+0x630/0x630
[  145.826632][ T7088]  ? xfs_file_write_checks+0x90b/0xad0
[  145.832104][ T7088]  ? __lock_acquire+0x7d80/0x7d80
[  145.837170][ T7088]  ? xfs_file_buffered_write+0x940/0x940
[  145.842814][ T7088]  iomap_dio_rw+0x45/0xa0
[  145.847163][ T7088]  xfs_file_dio_write_aligned+0x148/0x1d0
[  145.852892][ T7088]  ? direct_splice_actor+0xe8/0x130
[  145.858099][ T7088]  ? splice_direct_to_actor+0x30b/0x8e0
[  145.863669][ T7088]  ? do_splice_direct+0x1d5/0x2f0
[  145.868712][ T7088]  ? xfs_file_dio_write_unaligned+0x670/0x670
[  145.874890][ T7088]  ? end_current_label_crit_section+0x149/0x170
[  145.881166][ T7088]  xfs_file_write_iter+0x4fe/0x610
[  145.886295][ T7088]  do_iter_write+0x747/0xc50
[  145.890911][ T7088]  ? vfs_iter_write+0xa0/0xa0
[  145.895608][ T7088]  ? __asan_memset+0x22/0x40
[  145.900216][ T7088]  ? iov_iter_bvec+0xd4/0x1b0
[  145.904924][ T7088]  ? vfs_iter_write+0x6e/0xa0
[  145.909614][ T7088]  iter_file_splice_write+0x6b6/0xcf0
[  145.915014][ T7088]  ? splice_from_pipe+0x180/0x180
[  145.920180][ T7088]  ? splice_shrink_spd+0xc0/0xc0
[  145.925146][ T7088]  ? common_file_perm+0x198/0x1f0
[  145.930196][ T7088]  ? splice_from_pipe+0x180/0x180
[  145.935235][ T7088]  direct_splice_actor+0xe8/0x130
[  145.940271][ T7088]  splice_direct_to_actor+0x30b/0x8e0
[  145.945686][ T7088]  ? direct_file_splice_eof+0xb0/0xb0
[  145.951078][ T7088]  ? warn_unsupported+0xc0/0xc0
[  145.955948][ T7088]  ? fsnotify_perm+0x5d/0x5e0
[  145.960650][ T7088]  ? security_file_permission+0x79/0xa0
[  145.966234][ T7088]  do_splice_direct+0x1d5/0x2f0
[  145.971105][ T7088]  ? splice_direct_to_actor+0x8e0/0x8e0
[  145.976668][ T7088]  ? rcu_read_lock_any_held+0xb4/0x140
[  145.982143][ T7088]  ? do_splice_direct+0x2f0/0x2f0
[  145.987188][ T7088]  do_sendfile+0x52b/0xe80
[  145.991628][ T7088]  ? __ia32_sys_get_robust_list+0x110/0x110
[  145.997545][ T7088]  ? do_pwritev+0x3a0/0x3a0
[  146.002071][ T7088]  __se_sys_sendfile64+0x145/0x1a0
[  146.007208][ T7088]  ? lock_chain_count+0x20/0x20
[  146.012084][ T7088]  ? __x64_sys_sendfile64+0xb0/0xb0
[  146.017402][ T7088]  ? lockdep_hardirqs_on+0x98/0x150
[  146.022635][ T7088]  do_syscall_64+0x55/0xb0
[  146.027086][ T7088]  ? clear_bhb_loop+0x40/0x90
[  146.031809][ T7088]  ? clear_bhb_loop+0x40/0x90
[  146.036508][ T7088]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  146.042422][ T7088] RIP: 0033:0x7f800179e159
[  146.046859][ T7088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  146.066499][ T7088] RSP: 002b:00007f8002636028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  146.074936][ T7088] RAX: ffffffffffffffda RBX: 00007f8001a25fa0 RCX: 00007f800179e159
[  146.082933][ T7088] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
[  146.090916][ T7088] RBP: 00007f800183503b R08: 0000000000000000 R09: 0000000000000000
[  146.098898][ T7088] R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000
[  146.106886][ T7088] R13: 00007f8001a26038 R14: 00007f8001a25fa0 R15: 00007fff6c3d5f28
[  146.114902][ T7088]  </TASK>
[  146.152420][ T7088] XFS (loop4): Corruption detected. Unmount and run xfs_repair
[  146.356316][ T6396] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  147.297569][ T7133] loop2: detected capacity change from 0 to 40427
[  147.322085][ T7133] F2FS-fs (loop2): Wrong segment_count / block_count (31 > 0)
[  147.340401][ T7133] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock
[  147.369950][ T7133] F2FS-fs (loop2): invalid crc value
[  147.392473][ T7133] F2FS-fs (loop2): Found nat_bits in checkpoint
[  147.422268][ T1192] usb 5-1: new full-speed USB device number 7 using dummy_hcd
[  147.572698][ T7133] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0
[  147.591322][ T7133] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5
[  147.637269][ T1192] usb 5-1: config 0 has no interfaces?
[  147.650595][ T1192] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  147.679613][ T1192] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  147.691495][ T1192] usb 5-1: Product: syz
[  147.705924][ T1192] usb 5-1: Manufacturer: syz
[  147.710661][ T1192] usb 5-1: SerialNumber: syz
[  147.732729][ T1192] usb 5-1: config 0 descriptor??
[  147.785935][ T5773] syz-executor: attempt to access beyond end of device
[  147.785935][ T5773] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  147.812689][ T5773] F2FS-fs (loop2): Stopped filesystem due to reason: 3
[  148.333520][ T5849] usb 5-1: USB disconnect, device number 7
[  148.562100][ T7171] loop0: detected capacity change from 0 to 32768
[  148.632773][ T7171] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  148.716999][ T7171] XFS (loop0): Ending clean mount
[  148.808780][ T7171] XFS (loop0): User initiated shutdown received.
[  148.835060][ T7171] XFS (loop0): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:497).  Shutting down filesystem.
[  148.897720][ T7171] XFS (loop0): Please unmount the filesystem and rectify the problem(s)
[  148.985550][ T7184] netlink: 12 bytes leftover after parsing attributes in process `syz.4.398'.
[  149.032755][ T5774] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  149.314267][ T7190] loop2: detected capacity change from 0 to 512
[  149.914058][ T7193] loop0: detected capacity change from 0 to 32768
[  149.954541][ T7193] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  150.041497][ T7193] XFS (loop0): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51.
[  150.088606][ T7193] XFS (loop0): Starting recovery (logdev: internal)
[  150.122886][ T7193] XFS (loop0): Ending recovery (logdev: internal)
[  150.188417][   T28] audit: type=1800 audit(1789135905.133:10): pid=7193 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.399" name="file1" dev="loop0" ino=4422 res=0 errno=0
[  150.263551][ T7205] XFS (loop0): Metadata corruption detected at xfs_btree_lookup_get_block+0x43f/0x660, xfs_bnobt block 0x8
[  150.276288][ T7205] XFS (loop0): Unmount and run xfs_repair
[  150.286402][ T7193] XFS (loop0): Internal error i != 1 at line 527 of file fs/xfs/libxfs/xfs_alloc.c.  Caller xfs_alloc_fixup_trees+0x5e7/0x820
[  150.303253][ T7193] CPU: 0 PID: 7193 Comm: syz.0.399 Not tainted syzkaller #0
[  150.310685][ T7193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  150.320771][ T7193] Call Trace:
[  150.324080][ T7193]  <TASK>
[  150.327035][ T7193]  dump_stack_lvl+0x18c/0x250
[  150.331755][ T7193]  ? __xfs_printk+0x90/0x90
[  150.336305][ T7193]  ? show_regs_print_info+0x20/0x20
[  150.341552][ T7193]  xfs_corruption_error+0x122/0x170
[  150.346779][ T7193]  ? xfs_alloc_fixup_trees+0x5e7/0x820
[  150.352271][ T7193]  xfs_alloc_fixup_trees+0x64e/0x820
[  150.357593][ T7193]  ? xfs_alloc_fixup_trees+0x5e7/0x820
[  150.363096][ T7193]  ? xfs_alloc_fix_len+0x280/0x280
[  150.368257][ T7193]  ? xfs_alloc_ag_vextent_lastblock+0x432/0x700
[  150.374551][ T7193]  xfs_alloc_cur_finish+0xd5/0x470
[  150.379683][ T7193]  ? xfs_allocbt_init_cursor+0x70/0x110
[  150.385244][ T7193]  xfs_alloc_ag_vextent_near+0xd69/0x1220
[  150.390978][ T7193]  ? __xfs_free_extent_later+0x650/0x650
[  150.396636][ T7193]  ? xfs_alloc_vextent_near_bno+0x540/0x540
[  150.402544][ T7193]  ? xfs_perag_grab+0x25/0x400
[  150.407317][ T7193]  ? xfs_perag_grab+0x25/0x400
[  150.412105][ T7193]  ? xfs_alloc_vextent_prepare_ag+0x19d/0x5d0
[  150.418189][ T7193]  xfs_alloc_vextent_iterate_ags+0x607/0x8e0
[  150.424212][ T7193]  xfs_alloc_vextent_start_ag+0x370/0x810
[  150.429960][ T7193]  xfs_bmapi_allocate+0x1446/0x2b60
[  150.435199][ T7193]  ? xfs_bmapi_write+0x1170/0x1170
[  150.440337][ T7193]  ? xfs_iext_find_level+0x445/0x490
[  150.445638][ T7193]  ? xfs_iext_lookup_extent+0x41f/0x7f0
[  150.451208][ T7193]  ? xfs_iext_prev+0x34a/0x360
[  150.455997][ T7193]  ? xfs_iext_get_extent+0x1b9/0x370
[  150.461309][ T7193]  xfs_bmapi_write+0x796/0x1170
[  150.466196][ T7193]  ? xfs_bmapi_minleft+0x200/0x200
[  150.471334][ T7193]  ? xfs_trans_alloc_inode+0x195/0x340
[  150.476819][ T7193]  xfs_iomap_write_direct+0x3ba/0x680
[  150.482227][ T7193]  ? xfs_eof_alignment+0x2c0/0x2c0
[  150.487366][ T7193]  ? down_read_nested+0x1ae/0x2e0
[  150.492408][ T7193]  ? xfs_direct_write_iomap_begin+0xbd8/0x1060
[  150.498582][ T7193]  ? xfs_direct_write_iomap_begin+0xbd8/0x1060
[  150.504759][ T7193]  ? xfs_iunlock+0x1c0/0x300
[  150.509374][ T7193]  xfs_direct_write_iomap_begin+0xbff/0x1060
[  150.515384][ T7193]  ? xfs_file_dio_write_aligned+0x148/0x1d0
[  150.521296][ T7193]  ? xfs_file_write_iter+0x4fe/0x610
[  150.526595][ T7193]  ? do_iter_write+0x747/0xc50
[  150.531391][ T7193]  ? xfs_iomap_write_unwritten+0xa50/0xa50
[  150.537216][ T7193]  ? filemap_write_and_wait_range+0x1a5/0x230
[  150.543297][ T7193]  ? xas_next_entry+0x3e0/0x3e0
[  150.548193][ T7193]  ? xfs_iomap_write_unwritten+0xa50/0xa50
[  150.554020][ T7193]  iomap_iter+0x65b/0xe70
[  150.558375][ T7193]  __iomap_dio_rw+0xc60/0x1d00
[  150.563178][ T7193]  ? xfs_trans_log_inode+0x11f/0x190
[  150.568482][ T7193]  ? iomap_dio_bio_end_io+0x630/0x630
[  150.573891][ T7193]  ? xfs_file_write_checks+0x90b/0xad0
[  150.579368][ T7193]  ? __lock_acquire+0x7d80/0x7d80
[  150.584434][ T7193]  ? xfs_file_buffered_write+0x940/0x940
[  150.590081][ T7193]  iomap_dio_rw+0x45/0xa0
[  150.594453][ T7193]  xfs_file_dio_write_aligned+0x148/0x1d0
[  150.600200][ T7193]  ? direct_splice_actor+0xe8/0x130
[  150.605412][ T7193]  ? splice_direct_to_actor+0x30b/0x8e0
[  150.610965][ T7193]  ? do_splice_direct+0x1d5/0x2f0
[  150.616004][ T7193]  ? xfs_file_dio_write_unaligned+0x670/0x670
[  150.622094][ T7193]  ? end_current_label_crit_section+0x149/0x170
[  150.628383][ T7193]  xfs_file_write_iter+0x4fe/0x610
[  150.633520][ T7193]  do_iter_write+0x747/0xc50
[  150.638141][ T7193]  ? vfs_iter_write+0xa0/0xa0
[  150.642848][ T7193]  ? __asan_memset+0x22/0x40
[  150.647453][ T7193]  ? iov_iter_bvec+0xd4/0x1b0
[  150.652154][ T7193]  ? vfs_iter_write+0x6e/0xa0
[  150.656853][ T7193]  iter_file_splice_write+0x6b6/0xcf0
[  150.662250][ T7193]  ? splice_from_pipe+0x180/0x180
[  150.667303][ T7193]  ? splice_shrink_spd+0xc0/0xc0
[  150.672260][ T7193]  ? common_file_perm+0x198/0x1f0
[  150.677298][ T7193]  ? splice_from_pipe+0x180/0x180
[  150.682329][ T7193]  direct_splice_actor+0xe8/0x130
[  150.687365][ T7193]  splice_direct_to_actor+0x30b/0x8e0
[  150.692763][ T7193]  ? direct_file_splice_eof+0xb0/0xb0
[  150.698153][ T7193]  ? warn_unsupported+0xc0/0xc0
[  150.703013][ T7193]  ? fsnotify_perm+0x5d/0x5e0
[  150.707701][ T7193]  ? security_file_permission+0x79/0xa0
[  150.713270][ T7193]  do_splice_direct+0x1d5/0x2f0
[  150.718143][ T7193]  ? splice_direct_to_actor+0x8e0/0x8e0
[  150.723718][ T7193]  ? rcu_read_lock_any_held+0xb4/0x140
[  150.729208][ T7193]  ? do_splice_direct+0x2f0/0x2f0
[  150.734267][ T7193]  do_sendfile+0x52b/0xe80
[  150.738726][ T7193]  ? __ia32_sys_get_robust_list+0x110/0x110
[  150.744642][ T7193]  ? do_pwritev+0x3a0/0x3a0
[  150.749176][ T7193]  __se_sys_sendfile64+0x145/0x1a0
[  150.754315][ T7193]  ? lock_chain_count+0x20/0x20
[  150.759185][ T7193]  ? __x64_sys_sendfile64+0xb0/0xb0
[  150.764420][ T7193]  ? lockdep_hardirqs_on+0x98/0x150
[  150.769641][ T7193]  do_syscall_64+0x55/0xb0
[  150.774068][ T7193]  ? clear_bhb_loop+0x40/0x90
[  150.778765][ T7193]  ? clear_bhb_loop+0x40/0x90
[  150.783483][ T7193]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  150.789401][ T7193] RIP: 0033:0x7f4246f9e159
[  150.793843][ T7193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  150.813457][ T7193] RSP: 002b:00007f4247dd3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  150.821877][ T7193] RAX: ffffffffffffffda RBX: 00007f4247225fa0 RCX: 00007f4246f9e159
[  150.829856][ T7193] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
[  150.837837][ T7193] RBP: 00007f424703503b R08: 0000000000000000 R09: 0000000000000000
[  150.845815][ T7193] R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000
[  150.853794][ T7193] R13: 00007f4247226038 R14: 00007f4247225fa0 R15: 00007ffeec5635e8
[  150.861788][ T7193]  </TASK>
[  150.864918][    C0] vkms_vblank_simulate: vblank timer overrun
[  150.925131][ T7193] XFS (loop0): Corruption detected. Unmount and run xfs_repair
[  151.051949][ T5774] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  151.448075][ T7218] netlink: 12 bytes leftover after parsing attributes in process `syz.0.407'.
[  152.069595][ T7227] FAULT_INJECTION: forcing a failure.
[  152.069595][ T7227] name failslab, interval 1, probability 0, space 0, times 0
[  152.086877][ T7227] CPU: 0 PID: 7227 Comm: syz.0.422 Not tainted syzkaller #0
[  152.094217][ T7227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  152.104301][ T7227] Call Trace:
[  152.107606][ T7227]  <TASK>
[  152.110558][ T7227]  dump_stack_lvl+0x18c/0x250
[  152.115281][ T7227]  ? show_regs_print_info+0x20/0x20
[  152.120510][ T7227]  ? load_image+0x420/0x420
[  152.125082][ T7227]  ? __might_sleep+0xe0/0xe0
[  152.129703][ T7227]  ? __lock_acquire+0x7d80/0x7d80
[  152.134764][ T7227]  should_fail_ex+0x394/0x4c0
[  152.139502][ T7227]  should_failslab+0x9/0x20
[  152.144052][ T7227]  slab_pre_alloc_hook+0x59/0x300
[  152.149138][ T7227]  kmem_cache_alloc+0x5a/0x2c0
[  152.153958][ T7227]  ? security_file_alloc+0x34/0x120
[  152.159226][ T7227]  security_file_alloc+0x34/0x120
[  152.164303][ T7227]  init_file+0x94/0x1f0
[  152.168501][ T7227]  alloc_empty_file+0xb7/0x1d0
[  152.173310][ T7227]  alloc_file+0x5b/0x600
[  152.177594][ T7227]  alloc_file_pseudo+0x184/0x210
[  152.182576][ T7227]  ? fput+0x1a0/0x1a0
[  152.186595][ T7227]  ? alloc_fd+0x590/0x640
[  152.190975][ T7227]  anon_inode_getfd+0xca/0x1c0
[  152.195793][ T7227]  do_inotify_init+0x33e/0x450
[  152.200602][ T7227]  __ia32_sys_inotify_init+0x10/0x20
[  152.206151][ T7227]  do_syscall_64+0x55/0xb0
[  152.210601][ T7227]  ? clear_bhb_loop+0x40/0x90
[  152.215375][ T7227]  ? clear_bhb_loop+0x40/0x90
[  152.220135][ T7227]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  152.226062][ T7227] RIP: 0033:0x7f4246f9e159
[  152.230500][ T7227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  152.250110][ T7227] RSP: 002b:00007f4247dd3028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fd
[  152.258533][ T7227] RAX: ffffffffffffffda RBX: 00007f4247225fa0 RCX: 00007f4246f9e159
[  152.266513][ T7227] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  152.274494][ T7227] RBP: 00007f4247225fa0 R08: 0000000000000000 R09: 0000000000000000
[  152.282494][ T7227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  152.290481][ T7227] R13: 00007f4247226038 R14: 00007f4247225fa0 R15: 00007ffeec5635e8
[  152.298494][ T7227]  </TASK>
[  152.301646][    C0] vkms_vblank_simulate: vblank timer overrun
[  152.380832][ T7221] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  152.390373][ T7221] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  152.415180][ T7221] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  152.433658][ T7221] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  152.440153][ T7232] netlink: 24 bytes leftover after parsing attributes in process `syz.0.415'.
[  152.449360][ T7221] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  152.461109][ T7221] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  152.469616][ T7221] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  152.488878][ T7221] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  152.500070][ T7221] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  152.522446][ T7221] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  152.528637][ T7221] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  152.538498][ T7221] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  152.713877][ T7238] 9p: Unknown uid 00000000004294967295
[  153.433726][ T7241] loop2: detected capacity change from 0 to 32768
[  153.584344][ T7241] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  153.671813][ T5779] Bluetooth: hci1: command 0x0c1a tx timeout
[  153.778867][ T7241] XFS (loop2): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51.
[  153.869334][ T7241] XFS (loop2): Starting recovery (logdev: internal)
[  153.929201][ T7241] XFS (loop2): Ending recovery (logdev: internal)
[  154.090573][ T7292] FAULT_INJECTION: forcing a failure.
[  154.090573][ T7292] name failslab, interval 1, probability 0, space 0, times 0
[  154.125151][ T7292] CPU: 0 PID: 7292 Comm: syz.0.423 Not tainted syzkaller #0
[  154.132500][ T7292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  154.142583][ T7292] Call Trace:
[  154.145906][ T7292]  <TASK>
[  154.148876][ T7292]  dump_stack_lvl+0x18c/0x250
[  154.153608][ T7292]  ? show_regs_print_info+0x20/0x20
[  154.158857][ T7292]  ? load_image+0x420/0x420
[  154.163416][ T7292]  ? __might_sleep+0xe0/0xe0
[  154.168040][ T7292]  ? __lock_acquire+0x7d80/0x7d80
[  154.173104][ T7292]  should_fail_ex+0x394/0x4c0
[  154.177850][ T7292]  should_failslab+0x9/0x20
[  154.182406][ T7292]  slab_pre_alloc_hook+0x59/0x300
[  154.187475][ T7292]  ? drm_atomic_state_init+0x9c/0x310
[  154.192898][ T7292]  ? drm_atomic_state_init+0x9c/0x310
[  154.198351][ T7292]  __kmem_cache_alloc_node+0x53/0x250
[  154.203783][ T7292]  ? drm_atomic_state_init+0x9c/0x310
[  154.209226][ T7292]  __kmalloc+0xa7/0x240
[  154.213440][ T7292]  drm_atomic_state_init+0x9c/0x310
[  154.218698][ T7292]  drm_atomic_state_alloc+0xbb/0x100
[  154.224033][ T7292]  drm_client_modeset_commit_atomic+0x119/0x7b0
[  154.230334][ T7292]  ? trace_contention_end+0x39/0xe0
[  154.235582][ T7292]  ? __mutex_lock+0x30d/0xc80
[  154.240330][ T7292]  ? drm_client_modeset_check+0x180/0x180
[  154.246119][ T7292]  ? drm_master_internal_acquire+0x20/0x70
[  154.251969][ T7292]  ? mutex_lock_nested+0x20/0x20
[  154.256949][ T7292]  ? mutex_lock_nested+0x20/0x20
[  154.261929][ T7292]  ? drm_client_dev_restore+0xad/0x270
[  154.267448][ T7292]  drm_client_modeset_commit_locked+0xcb/0x4c0
[  154.273618][ T7292]  drm_client_modeset_commit+0x4a/0x70
[  154.279089][ T7292]  drm_fb_helper_lastclose+0x9f/0x150
[  154.284487][ T7292]  drm_fbdev_generic_client_restore+0x34/0x40
[  154.290583][ T7292]  drm_client_dev_restore+0x138/0x270
[  154.295982][ T7292]  drm_release+0x4b3/0x670
[  154.300430][ T7292]  ? drm_lastclose+0x100/0x100
[  154.305218][ T7292]  __fput+0x221/0x940
[  154.309229][ T7292]  __se_sys_close+0x15c/0x1e0
[  154.313937][ T7292]  do_syscall_64+0x55/0xb0
[  154.318383][ T7292]  ? clear_bhb_loop+0x40/0x90
[  154.323088][ T7292]  ? clear_bhb_loop+0x40/0x90
[  154.327790][ T7292]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  154.333696][ T7292] RIP: 0033:0x7f4246f9e159
[  154.338133][ T7292] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  154.357751][ T7292] RSP: 002b:00007f4247dd3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[  154.366193][ T7292] RAX: ffffffffffffffda RBX: 00007f4247225fa0 RCX: 00007f4246f9e159
[  154.374181][ T7292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
[  154.382175][ T7292] RBP: 00007f424703503b R08: 0000000000000000 R09: 0000000000000000
[  154.390176][ T7292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  154.398165][ T7292] R13: 00007f4247226038 R14: 00007f4247225fa0 R15: 00007ffeec5635e8
[  154.406168][ T7292]  </TASK>
[  154.427678][   T28] audit: type=1800 audit(1789135909.373:11): pid=7241 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.416" name="file1" dev="loop2" ino=4422 res=0 errno=0
[  154.480663][ T7296] XFS (loop2): Metadata corruption detected at xfs_btree_lookup_get_block+0x43f/0x660, xfs_bnobt block 0x8
[  154.481768][ T5783] Bluetooth: hci2: command 0x0c1a tx timeout
[  154.498407][ T5779] Bluetooth: hci3: command 0x0c1a tx timeout
[  154.505710][ T7296] XFS (loop2): Unmount and run xfs_repair
[  154.525940][ T7241] XFS (loop2): Internal error i != 1 at line 527 of file fs/xfs/libxfs/xfs_alloc.c.  Caller xfs_alloc_fixup_trees+0x5e7/0x820
[  154.539464][ T7241] CPU: 0 PID: 7241 Comm: syz.2.416 Not tainted syzkaller #0
[  154.546794][ T7241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  154.556867][ T7241] Call Trace:
[  154.560158][ T7241]  <TASK>
[  154.563104][ T7241]  dump_stack_lvl+0x18c/0x250
[  154.567795][ T7241]  ? __xfs_printk+0x90/0x90
[  154.572310][ T7241]  ? show_regs_print_info+0x20/0x20
[  154.577535][ T7241]  xfs_corruption_error+0x122/0x170
[  154.582778][ T7241]  ? xfs_alloc_fixup_trees+0x5e7/0x820
[  154.588303][ T7241]  xfs_alloc_fixup_trees+0x64e/0x820
[  154.593652][ T7241]  ? xfs_alloc_fixup_trees+0x5e7/0x820
[  154.599161][ T7241]  ? xfs_alloc_fix_len+0x280/0x280
[  154.604294][ T7241]  ? xfs_alloc_ag_vextent_lastblock+0x432/0x700
[  154.610560][ T7241]  xfs_alloc_cur_finish+0xd5/0x470
[  154.615694][ T7241]  ? xfs_allocbt_init_cursor+0x70/0x110
[  154.621256][ T7241]  xfs_alloc_ag_vextent_near+0xd69/0x1220
[  154.627013][ T7241]  ? __xfs_free_extent_later+0x650/0x650
[  154.632676][ T7241]  ? xfs_alloc_vextent_near_bno+0x540/0x540
[  154.638593][ T7241]  ? xfs_perag_grab+0x25/0x400
[  154.643379][ T7241]  ? xfs_perag_grab+0x25/0x400
[  154.648174][ T7241]  ? xfs_alloc_vextent_prepare_ag+0x19d/0x5d0
[  154.654262][ T7241]  xfs_alloc_vextent_iterate_ags+0x607/0x8e0
[  154.660272][ T7241]  xfs_alloc_vextent_start_ag+0x370/0x810
[  154.666012][ T7241]  xfs_bmapi_allocate+0x1446/0x2b60
[  154.671277][ T7241]  ? xfs_bmapi_write+0x1170/0x1170
[  154.676408][ T7241]  ? xfs_iext_find_level+0x445/0x490
[  154.681709][ T7241]  ? xfs_iext_lookup_extent+0x41f/0x7f0
[  154.687267][ T7241]  ? xfs_iext_prev+0x34a/0x360
[  154.692038][ T7241]  ? xfs_iext_get_extent+0x1b9/0x370
[  154.697340][ T7241]  xfs_bmapi_write+0x796/0x1170
[  154.702212][ T7241]  ? xfs_bmapi_minleft+0x200/0x200
[  154.707348][ T7241]  ? xfs_trans_alloc_inode+0x195/0x340
[  154.712829][ T7241]  xfs_iomap_write_direct+0x3ba/0x680
[  154.718223][ T7241]  ? xfs_eof_alignment+0x2c0/0x2c0
[  154.723364][ T7241]  ? down_read_nested+0x1ae/0x2e0
[  154.728405][ T7241]  ? xfs_direct_write_iomap_begin+0xbd8/0x1060
[  154.734584][ T7241]  ? xfs_direct_write_iomap_begin+0xbd8/0x1060
[  154.740753][ T7241]  ? xfs_iunlock+0x1c0/0x300
[  154.745386][ T7241]  xfs_direct_write_iomap_begin+0xbff/0x1060
[  154.751386][ T7241]  ? xfs_file_dio_write_aligned+0x148/0x1d0
[  154.757285][ T7241]  ? xfs_file_write_iter+0x4fe/0x610
[  154.762575][ T7241]  ? do_iter_write+0x747/0xc50
[  154.767372][ T7241]  ? xfs_iomap_write_unwritten+0xa50/0xa50
[  154.773194][ T7241]  ? filemap_write_and_wait_range+0x1a5/0x230
[  154.779285][ T7241]  ? xas_next_entry+0x3e0/0x3e0
[  154.784167][ T7241]  ? xfs_iomap_write_unwritten+0xa50/0xa50
[  154.789989][ T7241]  iomap_iter+0x65b/0xe70
[  154.794341][ T7241]  __iomap_dio_rw+0xc60/0x1d00
[  154.799138][ T7241]  ? xfs_trans_log_inode+0x11f/0x190
[  154.804447][ T7241]  ? iomap_dio_bio_end_io+0x630/0x630
[  154.809848][ T7241]  ? xfs_file_write_checks+0x90b/0xad0
[  154.815316][ T7241]  ? __lock_acquire+0x7d80/0x7d80
[  154.820359][ T7241]  ? xfs_file_buffered_write+0x940/0x940
[  154.825999][ T7241]  iomap_dio_rw+0x45/0xa0
[  154.830350][ T7241]  xfs_file_dio_write_aligned+0x148/0x1d0
[  154.836085][ T7241]  ? direct_splice_actor+0xe8/0x130
[  154.841291][ T7241]  ? splice_direct_to_actor+0x30b/0x8e0
[  154.846851][ T7241]  ? do_splice_direct+0x1d5/0x2f0
[  154.851888][ T7241]  ? xfs_file_dio_write_unaligned+0x670/0x670
[  154.857963][ T7241]  ? end_current_label_crit_section+0x149/0x170
[  154.864223][ T7241]  xfs_file_write_iter+0x4fe/0x610
[  154.869360][ T7241]  do_iter_write+0x747/0xc50
[  154.873997][ T7241]  ? vfs_iter_write+0xa0/0xa0
[  154.878699][ T7241]  ? __asan_memset+0x22/0x40
[  154.883314][ T7241]  ? iov_iter_bvec+0xd4/0x1b0
[  154.888006][ T7241]  ? vfs_iter_write+0x6e/0xa0
[  154.892728][ T7241]  iter_file_splice_write+0x6b6/0xcf0
[  154.898126][ T7241]  ? splice_from_pipe+0x180/0x180
[  154.903189][ T7241]  ? splice_shrink_spd+0xc0/0xc0
[  154.908148][ T7241]  ? common_file_perm+0x198/0x1f0
[  154.913192][ T7241]  ? splice_from_pipe+0x180/0x180
[  154.918234][ T7241]  direct_splice_actor+0xe8/0x130
[  154.923321][ T7241]  splice_direct_to_actor+0x30b/0x8e0
[  154.928718][ T7241]  ? direct_file_splice_eof+0xb0/0xb0
[  154.934112][ T7241]  ? warn_unsupported+0xc0/0xc0
[  154.938980][ T7241]  ? fsnotify_perm+0x5d/0x5e0
[  154.943681][ T7241]  ? security_file_permission+0x79/0xa0
[  154.949251][ T7241]  do_splice_direct+0x1d5/0x2f0
[  154.954124][ T7241]  ? splice_direct_to_actor+0x8e0/0x8e0
[  154.959690][ T7241]  ? rcu_read_lock_any_held+0xb4/0x140
[  154.965183][ T7241]  ? do_splice_direct+0x2f0/0x2f0
[  154.970230][ T7241]  do_sendfile+0x52b/0xe80
[  154.974661][ T7241]  ? __ia32_sys_get_robust_list+0x110/0x110
[  154.980565][ T7241]  ? do_pwritev+0x3a0/0x3a0
[  154.985094][ T7241]  __se_sys_sendfile64+0x145/0x1a0
[  154.990228][ T7241]  ? lock_chain_count+0x20/0x20
[  154.995094][ T7241]  ? __x64_sys_sendfile64+0xb0/0xb0
[  155.000320][ T7241]  ? lockdep_hardirqs_on+0x98/0x150
[  155.005547][ T7241]  do_syscall_64+0x55/0xb0
[  155.009977][ T7241]  ? clear_bhb_loop+0x40/0x90
[  155.014666][ T7241]  ? clear_bhb_loop+0x40/0x90
[  155.019368][ T7241]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  155.025284][ T7241] RIP: 0033:0x7fa96079e159
[  155.029730][ T7241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  155.049372][ T7241] RSP: 002b:00007fa96172a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  155.057809][ T7241] RAX: ffffffffffffffda RBX: 00007fa960a25fa0 RCX: 00007fa96079e159
[  155.065788][ T7241] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
[  155.073775][ T7241] RBP: 00007fa96083503b R08: 0000000000000000 R09: 0000000000000000
[  155.081759][ T7241] R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000
[  155.089740][ T7241] R13: 00007fa960a26038 R14: 00007fa960a25fa0 R15: 00007ffc7d901d98
[  155.097745][ T7241]  </TASK>
[  155.106177][ T5817] usb 5-1: new high-speed USB device number 8 using dummy_hcd
[  155.114854][ T5783] Bluetooth: hci0: command 0x0c1a tx timeout
[  155.149876][ T7241] XFS (loop2): Corruption detected. Unmount and run xfs_repair
[  155.231100][ T5773] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  155.316277][ T5817] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  155.349839][ T5817] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024
[  155.383445][ T5817] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  155.407076][ T5817] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  155.421371][ T5817] usb 5-1: Product: syz
[  155.427749][ T5817] usb 5-1: Manufacturer: syz
[  155.433346][ T5817] usb 5-1: SerialNumber: syz
[  155.462613][ T5817] cdc_mbim 5-1:1.0: skipping garbage
[  155.674471][ T7295] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  155.751575][ T5783] Bluetooth: hci1: command 0x0c1a tx timeout
[  156.236190][ T5835] input: syz0 as /devices/virtual/misc/uhid/0005:057C:0306.0005/input/input8
[  156.289664][ T7295] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  156.319677][ T5817] cdc_mbim 5-1:1.0: setting rx_max = 16384
[  156.321720][ T5835] hid-generic 0005:057C:0306.0005: input,hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0
[  156.523419][ T5817] cdc_mbim 5-1:1.0: setting tx_max = 16384
[  156.531488][ T5817] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device
[  156.551508][ T5783] Bluetooth: hci2: command 0x0c1a tx timeout
[  156.553200][ T5779] Bluetooth: hci3: command 0x0c1a tx timeout
[  156.573253][ T5817] wwan wwan0: port wwan0mbim0 attached
[  156.596548][ T5817] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, d6:86:db:da:78:98
[  156.668321][ T7305] loop2: detected capacity change from 0 to 40427
[  156.685134][ T7305] F2FS-fs (loop2): invalid crc value
[  156.704140][ T7305] F2FS-fs (loop2): Found nat_bits in checkpoint
[  156.754822][ T5817] usb 5-1: USB disconnect, device number 8
[  156.762430][ T5817] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM
[  156.806977][ T7305] F2FS-fs (loop2): Start checkpoint disabled!
[  156.836195][ T7305] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6
[  156.874978][ T5817] wwan wwan0: port wwan0mbim0 disconnected
[  156.898703][   T28] audit: type=1800 audit(1789135911.843:12): pid=7305 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.426" name="file1" dev="loop2" ino=10 res=0 errno=0
[  156.938527][ T7305] syz.2.426: attempt to access beyond end of device
[  156.938527][ T7305] loop2: rw=2049, sector=45096, nr_sectors = 128 limit=40427
[  156.987948][ T7305] syz.2.426: attempt to access beyond end of device
[  156.987948][ T7305] loop2: rw=2049, sector=45224, nr_sectors = 128 limit=40427
[  157.010119][ T7305] syz.2.426: attempt to access beyond end of device
[  157.010119][ T7305] loop2: rw=2049, sector=45352, nr_sectors = 128 limit=40427
[  157.046725][ T7305] syz.2.426: attempt to access beyond end of device
[  157.046725][ T7305] loop2: rw=2049, sector=45480, nr_sectors = 128 limit=40427
[  157.079662][ T7305] syz.2.426: attempt to access beyond end of device
[  157.079662][ T7305] loop2: rw=2049, sector=45608, nr_sectors = 128 limit=40427
[  157.097797][ T7305] syz.2.426: attempt to access beyond end of device
[  157.097797][ T7305] loop2: rw=2049, sector=45736, nr_sectors = 128 limit=40427
[  157.117531][ T7305] syz.2.426: attempt to access beyond end of device
[  157.117531][ T7305] loop2: rw=2049, sector=45864, nr_sectors = 128 limit=40427
[  157.133948][ T7305] syz.2.426: attempt to access beyond end of device
[  157.133948][ T7305] loop2: rw=2049, sector=45992, nr_sectors = 128 limit=40427
[  157.173559][ T7305] syz.2.426: attempt to access beyond end of device
[  157.173559][ T7305] loop2: rw=2049, sector=46120, nr_sectors = 128 limit=40427
[  157.194061][ T5779] Bluetooth: hci0: command 0x0c1a tx timeout
[  157.409016][   T37] kworker/u4:2: attempt to access beyond end of device
[  157.409016][   T37] loop2: rw=2049, sector=40960, nr_sectors = 16 limit=40427
[  157.424872][   T37] F2FS-fs (loop2): Stopped filesystem due to reason: 3
[  157.434407][   T37] F2FS-fs (loop2): Stopped filesystem due to reason: 3
[  157.841963][ T5779] Bluetooth: hci1: command 0x0c1a tx timeout
[  158.351383][ T5890] usb 3-1: new high-speed USB device number 10 using dummy_hcd
[  158.534015][ T5890] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  158.549268][ T5890] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[  158.559156][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[  158.567367][ T5890] usb 3-1: Product: syz
[  158.571696][ T5890] usb 3-1: Manufacturer: syz
[  158.576323][ T5890] usb 3-1: SerialNumber: syz
[  158.631290][ T5779] Bluetooth: hci3: command 0x0c1a tx timeout
[  158.631477][ T5783] Bluetooth: hci2: command 0x0c1a tx timeout
[  158.799821][ T5890] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[  159.281745][ T5783] Bluetooth: hci0: command 0x0c1a tx timeout
[  159.674379][ T7367] loop4: detected capacity change from 0 to 256
[  159.684708][ T7367] exfat: Deprecated parameter 'utf8'
[  159.729664][ T7367] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xabf88b1f, utbl_chksum : 0xe619d30d)
[  159.753846][ T7369] FAULT_INJECTION: forcing a failure.
[  159.753846][ T7369] name failslab, interval 1, probability 0, space 0, times 0
[  159.766908][ T7369] CPU: 0 PID: 7369 Comm: syz.0.443 Not tainted syzkaller #0
[  159.774235][ T7369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  159.784322][ T7369] Call Trace:
[  159.787624][ T7369]  <TASK>
[  159.790580][ T7369]  dump_stack_lvl+0x18c/0x250
[  159.795300][ T7369]  ? show_regs_print_info+0x20/0x20
[  159.800535][ T7369]  ? load_image+0x420/0x420
[  159.805092][ T7369]  should_fail_ex+0x394/0x4c0
[  159.809812][ T7369]  should_failslab+0x9/0x20
[  159.814359][ T7369]  slab_pre_alloc_hook+0x59/0x300
[  159.819434][ T7369]  ? do_raw_spin_lock+0x11f/0x2b0
[  159.824515][ T7369]  ? tipc_nametbl_subscribe+0x275/0x11d0
[  159.830210][ T7369]  __kmem_cache_alloc_node+0x53/0x250
[  159.835642][ T7369]  ? tipc_nametbl_subscribe+0x275/0x11d0
[  159.841305][ T7369]  kmalloc_trace+0x2a/0xe0
[  159.845760][ T7369]  tipc_nametbl_subscribe+0x275/0x11d0
[  159.851251][ T7369]  ? lockdep_softirqs_off+0x440/0x440
[  159.856670][ T7369]  ? tipc_nametbl_withdraw+0x270/0x270
[  159.862199][ T7369]  ? __raw_spin_lock_init+0x45/0x100
[  159.867543][ T7369]  tipc_sub_subscribe+0x3a5/0x690
[  159.872618][ T7369]  tipc_conn_rcv_sub+0x14f/0x370
[  159.877595][ T7369]  tipc_topsrv_kern_subscr+0x189/0x250
[  159.883094][ T7369]  ? conn_put+0x320/0x320
[  159.887480][ T7369]  ? __asan_memset+0x22/0x40
[  159.892115][ T7369]  tipc_group_create+0x35b/0x4e0
[  159.897105][ T7369]  tipc_sk_join+0x25a/0x6a0
[  159.901655][ T7369]  ? __tipc_sendstream+0x1290/0x1290
[  159.906989][ T7369]  tipc_setsockopt+0x73f/0x990
[  159.911822][ T7369]  ? tipc_shutdown+0x4d0/0x4d0
[  159.916637][ T7369]  ? security_socket_setsockopt+0x44/0xa0
[  159.922389][ T7369]  ? bpf_lsm_socket_setsockopt+0x9/0x10
[  159.927967][ T7369]  ? security_socket_setsockopt+0x7e/0xa0
[  159.933720][ T7369]  ? tipc_shutdown+0x4d0/0x4d0
[  159.938542][ T7369]  do_sock_setsockopt+0x175/0x1a0
[  159.943618][ T7369]  ? __fdget+0x180/0x210
[  159.947894][ T7369]  __x64_sys_setsockopt+0x182/0x200
[  159.953133][ T7369]  do_syscall_64+0x55/0xb0
[  159.957591][ T7369]  ? clear_bhb_loop+0x40/0x90
[  159.962304][ T7369]  ? clear_bhb_loop+0x40/0x90
[  159.967018][ T7369]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  159.972945][ T7369] RIP: 0033:0x7f4246f9e159
[  159.977394][ T7369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  159.997029][ T7369] RSP: 002b:00007f4247dd3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  160.005482][ T7369] RAX: ffffffffffffffda RBX: 00007f4247225fa0 RCX: 00007f4246f9e159
[  160.013492][ T7369] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003
[  160.021488][ T7369] RBP: 00007f424703503b R08: 0000000000000010 R09: 0000000000000000
[  160.029508][ T7369] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000
[  160.037506][ T7369] R13: 00007f4247226038 R14: 00007f4247225fa0 R15: 00007ffeec5635e8
[  160.045524][ T7369]  </TASK>
[  160.048763][ T7369] tipc: Service creation failed, no memory
[  160.054640][ T7369] tipc: Failed to subscribe for {67,0,4294967295}
[  160.213309][ T7371] ip_tables: iptables: counters copy to user failed while replacing table
[  160.387868][ T5779] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  160.402296][ T5779] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  160.418635][ T5779] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  160.431108][ T5779] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  160.441670][ T5779] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  160.449231][ T5779] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  160.930693][ T7375] chnl_net:caif_netlink_parms(): no params data found
[  161.032317][ T7375] bridge0: port 1(bridge_slave_0) entered blocking state
[  161.039515][ T7375] bridge0: port 1(bridge_slave_0) entered disabled state
[  161.047509][ T7375] bridge_slave_0: entered allmulticast mode
[  161.055454][ T7375] bridge_slave_0: entered promiscuous mode
[  161.067267][ T7375] bridge0: port 2(bridge_slave_1) entered blocking state
[  161.077039][ T7375] bridge0: port 2(bridge_slave_1) entered disabled state
[  161.086220][ T7375] bridge_slave_1: entered allmulticast mode
[  161.093797][ T7375] bridge_slave_1: entered promiscuous mode
[  161.127344][ T7375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  161.140103][ T7375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  161.181183][ T7375] team0: Port device team_slave_0 added
[  161.201501][ T7375] team0: Port device team_slave_1 added
[  161.260941][ T7375] batman_adv: batadv0: Adding interface: batadv_slave_0
[  161.285849][ T7375] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  161.318512][ T7375] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  161.331948][ T7375] batman_adv: batadv0: Adding interface: batadv_slave_1
[  161.338925][ T7375] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  161.431467][ T7375] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  161.533507][ T7375] hsr_slave_0: entered promiscuous mode
[  161.546674][ T7375] hsr_slave_1: entered promiscuous mode
[  161.559749][ T7375] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  161.572265][ T7375] Cannot create hsr debugfs directory
[  161.907841][ T7375] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  161.919688][ T7375] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  161.933174][ T7375] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  161.953198][ T7375] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  162.054427][ T7375] 8021q: adding VLAN 0 to HW filter on device bond0
[  162.088699][ T7375] 8021q: adding VLAN 0 to HW filter on device team0
[  162.130064][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state
[  162.137841][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state
[  162.154612][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state
[  162.161801][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state
[  162.549576][ T7375] 8021q: adding VLAN 0 to HW filter on device batadv0
[  162.561509][ T5783] Bluetooth: hci4: command tx timeout
[  162.952241][ T7375] veth0_vlan: entered promiscuous mode
[  162.978507][ T7375] veth1_vlan: entered promiscuous mode
[  163.035138][ T7375] veth0_macvtap: entered promiscuous mode
[  163.056522][ T7426] bridge1: entered promiscuous mode
[  163.062110][ T7426] bridge1: entered allmulticast mode
[  163.072685][ T7375] veth1_macvtap: entered promiscuous mode
[  163.093412][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  163.104988][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.117368][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  163.128469][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.138665][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  163.150499][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.160598][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  163.181067][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.195390][ T7375] batman_adv: batadv0: Interface activated: batadv_slave_0
[  163.214463][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  163.236833][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.246882][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  163.257581][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.267650][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  163.279049][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.289154][ T7375] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  163.305759][ T7375] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  163.317672][ T7375] batman_adv: batadv0: Interface activated: batadv_slave_1
[  163.344405][ T7375] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  163.353728][ T7375] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  163.366886][ T7375] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  163.380869][ T7375] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  163.495503][   T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  163.503807][   T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  163.546320][   T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  163.556303][   T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  164.238422][ T7431] loop4: detected capacity change from 0 to 32768
[  164.310202][   T28] audit: type=1800 audit(1789135919.253:13): pid=7431 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.467" name="file1" dev="loop4" ino=4 res=0 errno=0
[  164.331619][ T7431] jfs_unlink: dtDelete returned -2
[  164.638478][ T5783] Bluetooth: hci4: command tx timeout
[  164.749114][ T7432] loop5: detected capacity change from 0 to 40427
[  164.833818][ T7432] F2FS-fs (loop5): invalid crc value
[  164.860893][ T7432] F2FS-fs (loop5): Found nat_bits in checkpoint
[  165.037572][ T7432] F2FS-fs (loop5): Start checkpoint disabled!
[  165.078147][ T7432] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6
[  165.208825][ T7454] loop0: detected capacity change from 0 to 512
[  165.227654][ T7454] EXT4-fs: Ignoring removed bh option
[  165.281665][ T7454] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  165.294770][   T28] audit: type=1800 audit(1789135920.213:14): pid=7432 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.439" name="file1" dev="loop5" ino=10 res=0 errno=0
[  165.436360][ T7452] loop4: detected capacity change from 0 to 32768
[  165.452503][ T7452] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.469 (7452)
[  165.471010][ T7452] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  165.481663][ T7452] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[  165.490417][ T7452] BTRFS info (device loop4): setting nodatasum
[  165.496771][ T7452] BTRFS info (device loop4): force zlib compression, level 3
[  165.504607][ T7452] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8)
[  165.514272][ T7452] BTRFS info (device loop4): use lzo compression, level 0
[  165.521495][ T7452] BTRFS info (device loop4): turning on flush-on-commit
[  165.528480][ T7452] BTRFS info (device loop4): enabling auto defrag
[  165.530422][ T7454] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  165.534999][ T7452] BTRFS info (device loop4): max_inline at 4096
[  165.535025][ T7452] BTRFS info (device loop4): using free space tree
[  165.686097][ T7452] BTRFS info (device loop4): enabling ssd optimizations
[  165.697330][ T7454] ext4 filesystem being mounted at /136/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  165.708987][ T1138] kworker/u4:7: attempt to access beyond end of device
[  165.708987][ T1138] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427
[  165.727007][ T5890] usb 3-1: USB disconnect, device number 10
[  165.762356][ T5890] usblp0: removed
[  165.813588][ T1138] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  165.820518][ T1138] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  165.836730][ T7452] BTRFS warning (device loop4): qgroup rescan init failed, qgroup is not enabled
[  165.974890][ T6396] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  166.012963][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  166.272360][ T7480] sg_write: data in/out 2143289310/14 bytes for SCSI command 0x0-- guessing data in;
[  166.272360][ T7480]    program syz.2.474 not setting count and/or reply_len properly
[  166.591372][ T5890] usb 5-1: new high-speed USB device number 9 using dummy_hcd
[  166.711398][ T5783] Bluetooth: hci4: command tx timeout
[  166.783312][ T5890] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  166.800856][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  166.825322][ T5890] usb 5-1: config 0 descriptor??
[  166.840057][ T5890] cp210x 5-1:0.0: cp210x converter detected
[  167.194554][ T7501] loop2: detected capacity change from 0 to 128
[  167.264572][ T7499] loop5: detected capacity change from 0 to 32768
[  167.292212][ T7499] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.482 (7499)
[  167.323467][ T7499] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  167.334280][ T7499] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[  167.343060][ T7499] BTRFS info (device loop5): setting nodatasum
[  167.349260][ T7499] BTRFS info (device loop5): force zlib compression, level 3
[  167.357161][ T7499] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_LZO (0x8)
[  167.366435][ T7499] BTRFS info (device loop5): use lzo compression, level 0
[  167.373609][ T7499] BTRFS info (device loop5): turning on flush-on-commit
[  167.380577][ T7499] BTRFS info (device loop5): enabling auto defrag
[  167.387148][ T7499] BTRFS info (device loop5): max_inline at 4096
[  167.393462][ T7499] BTRFS info (device loop5): using free space tree
[  167.453958][ T7483] loop4: detected capacity change from 0 to 4096
[  167.462316][ T7483] EXT4-fs: Ignoring removed nobh option
[  167.501000][ T7483] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  167.547953][ T7499] BTRFS info (device loop5): enabling ssd optimizations
[  167.609360][ T5890] cp210x 5-1:0.0: failed to get vendor val 0x0010 size 3: -32
[  167.632143][ T5890] usb 5-1: cp210x converter now attached to ttyUSB0
[  167.771600][ T7499] BTRFS warning (device loop5): qgroup rescan init failed, qgroup is not enabled
[  167.829247][ T5890] usb 5-1: USB disconnect, device number 9
[  167.859032][ T5890] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  167.871597][ T7375] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  167.905835][ T5890] cp210x 5-1:0.0: device disconnected
[  168.433774][ T6396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  168.851548][ T5783] Bluetooth: hci4: command tx timeout
[  168.969427][ T7550] loop2: detected capacity change from 0 to 32768
[  168.987546][ T7550] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.496 (7550)
[  169.024027][ T7550] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  169.034809][ T7550] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[  169.043707][ T7550] BTRFS info (device loop2): setting nodatasum
[  169.049901][ T7550] BTRFS info (device loop2): force zlib compression, level 3
[  169.057380][ T7550] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8)
[  169.067664][ T7550] BTRFS info (device loop2): use lzo compression, level 0
[  169.074848][ T7550] BTRFS info (device loop2): turning on flush-on-commit
[  169.081875][ T7550] BTRFS info (device loop2): enabling auto defrag
[  169.088402][ T7550] BTRFS info (device loop2): max_inline at 4096
[  169.094891][ T7550] BTRFS info (device loop2): using free space tree
[  169.236623][ T7550] BTRFS info (device loop2): enabling ssd optimizations
[  169.390284][ T7550] BTRFS warning (device loop2): qgroup rescan init failed, qgroup is not enabled
[  169.467487][ T5773] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  169.490832][ T7581] FAULT_INJECTION: forcing a failure.
[  169.490832][ T7581] name failslab, interval 1, probability 0, space 0, times 0
[  169.521343][ T7581] CPU: 0 PID: 7581 Comm: syz.0.501 Not tainted syzkaller #0
[  169.528683][ T7581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  169.538774][ T7581] Call Trace:
[  169.542089][ T7581]  <TASK>
[  169.545067][ T7581]  dump_stack_lvl+0x18c/0x250
[  169.549787][ T7581]  ? show_regs_print_info+0x20/0x20
[  169.555024][ T7581]  ? load_image+0x420/0x420
[  169.559557][ T7581]  ? __might_sleep+0xe0/0xe0
[  169.564184][ T7581]  ? __lock_acquire+0x7d80/0x7d80
[  169.569250][ T7581]  should_fail_ex+0x394/0x4c0
[  169.573980][ T7581]  should_failslab+0x9/0x20
[  169.578526][ T7581]  slab_pre_alloc_hook+0x59/0x300
[  169.583624][ T7581]  ? sk_prot_alloc+0xe7/0x210
[  169.588372][ T7581]  ? sk_prot_alloc+0xe7/0x210
[  169.593099][ T7581]  __kmem_cache_alloc_node+0x53/0x250
[  169.598518][ T7581]  ? sk_prot_alloc+0xe7/0x210
[  169.603232][ T7581]  __kmalloc+0xa7/0x240
[  169.607415][ T7581]  ? bpf_lsm_inode_alloc_security+0x9/0x10
[  169.613255][ T7581]  sk_prot_alloc+0xe7/0x210
[  169.617773][ T7581]  ? sk_alloc+0x24/0x350
[  169.622029][ T7581]  sk_alloc+0x3a/0x350
[  169.626117][ T7581]  __netlink_create+0x6c/0x290
[  169.630894][ T7581]  __netlink_kernel_create+0x148/0x7b0
[  169.636362][ T7581]  ? netlink_set_err+0x3b0/0x3b0
[  169.641306][ T7581]  ? __asan_memset+0x22/0x40
[  169.645919][ T7581]  ? genl_pernet_init+0xa8/0x170
[  169.650879][ T7581]  genl_pernet_init+0xba/0x170
[  169.655661][ T7581]  ? ctrl_dumppolicy_put_op+0xa30/0xa30
[  169.661231][ T7581]  ? genl_pernet_exit+0x60/0x60
[  169.666096][ T7581]  ? genl_rcv+0x40/0x40
[  169.670269][ T7581]  ? __raw_spin_lock_init+0x45/0x100
[  169.675595][ T7581]  ? debug_mutex_init+0x38/0x70
[  169.680464][ T7581]  ops_init+0x391/0x640
[  169.684644][ T7581]  setup_net+0x3b6/0xa20
[  169.688910][ T7581]  ? copy_net_ns+0x5d0/0x5d0
[  169.693521][ T7581]  ? copy_net_ns+0x342/0x5d0
[  169.698146][ T7581]  ? down_read_killable+0x1d0/0x340
[  169.703375][ T7581]  copy_net_ns+0x35e/0x5d0
[  169.707801][ T7581]  create_new_namespaces+0x3ce/0x700
[  169.713113][ T7581]  unshare_nsproxy_namespaces+0x11a/0x160
[  169.718858][ T7581]  ksys_unshare+0x4fa/0x8f0
[  169.723393][ T7581]  ? sighand_ctor+0x50/0x50
[  169.727911][ T7581]  ? lock_chain_count+0x20/0x20
[  169.732780][ T7581]  ? syscall_enter_from_user_mode+0x25/0x80
[  169.738698][ T7581]  __x64_sys_unshare+0x38/0x40
[  169.743486][ T7581]  do_syscall_64+0x55/0xb0
[  169.747924][ T7581]  ? clear_bhb_loop+0x40/0x90
[  169.752635][ T7581]  ? clear_bhb_loop+0x40/0x90
[  169.757350][ T7581]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  169.763270][ T7581] RIP: 0033:0x7f4246f9e159
[  169.767708][ T7581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  169.787337][ T7581] RSP: 002b:00007f4247dd3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
[  169.795781][ T7581] RAX: ffffffffffffffda RBX: 00007f4247225fa0 RCX: 00007f4246f9e159
[  169.803774][ T7581] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000
[  169.811760][ T7581] RBP: 00007f424703503b R08: 0000000000000000 R09: 0000000000000000
[  169.819742][ T7581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  169.827717][ T7581] R13: 00007f4247226038 R14: 00007f4247225fa0 R15: 00007ffeec5635e8
[  169.835728][ T7581]  </TASK>
[  170.059964][ T5780] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop2 scanned by udevd (5780)
[  170.152514][ T7588] netlink: 48 bytes leftover after parsing attributes in process `syz.2.502'.
[  170.333324][ T7591] loop4: detected capacity change from 0 to 16
[  170.389789][ T7592] input: syz0 as /devices/virtual/input/input9
[  170.439202][ T7591] erofs: (device loop4): mounted with root inode @ nid 36.
[  171.149519][ T7615] iommufd_mock iommufd_mock1: Adding to iommu group 0
[  171.854844][ T7621] loop2: detected capacity change from 0 to 32768
[  171.913493][ T7621]  loop2: p1 p3 < >
[  172.351609][ T5780] udevd[5780]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory
[  172.372197][ T6172] udevd[6172]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory
[  172.562460][ T7280] Bluetooth: hci5: Frame reassembly failed (-84)
[  172.576223][ T7648] veth1_to_bond: entered allmulticast mode
[  172.583156][ T7648] netlink: 4 bytes leftover after parsing attributes in process `syz.0.527'.
[  172.782711][ T7648] bond0: (slave bond_slave_1): Releasing backup interface
[  173.997844][ T7686] netlink: 12 bytes leftover after parsing attributes in process `syz.4.544'.
[  174.011539][ T7686] netlink: 12 bytes leftover after parsing attributes in process `syz.4.544'.
[  174.551386][ T5783] Bluetooth: hci5: Opcode 0x1003 failed: -110
[  175.301912][ T7709] loop4: detected capacity change from 0 to 32768
[  175.333988][ T7709] XFS (loop4): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
[  175.386217][ T7709] XFS (loop4): Ending clean mount
[  175.406829][ T7709] XFS (loop4): Quotacheck needed: Please wait.
[  175.455567][ T7709] XFS (loop4): Quotacheck: Done.
[  175.471746][ T1192] usb 3-1: new full-speed USB device number 11 using dummy_hcd
[  175.560663][ T6396] XFS (loop4): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
[  175.662935][ T1192] usb 3-1: not running at top speed; connect to a high speed hub
[  175.673481][ T1192] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  175.687045][ T1192] usb 3-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00
[  175.699844][ T1192] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  175.707953][ T1192] usb 3-1: Product: syz
[  175.715856][ T1192] usb 3-1: Manufacturer: syz
[  175.721490][ T1192] usb 3-1: SerialNumber: syz
[  175.733825][ T1192] keyspan 3-1:1.0: Keyspan 4 port adapter converter detected
[  175.741782][ T1192] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 81
[  175.749587][ T1192] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88
[  175.759089][ T1192] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 1
[  175.768451][ T1192] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0
[  175.778837][ T1192] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2
[  175.787675][ T1192] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1
[  175.798053][ T1192] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 4
[  175.807741][ T1192] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2
[  175.817237][ T1192] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6
[  175.827746][ T1192] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3
[  176.093597][ T5890] usb 3-1: USB disconnect, device number 11
[  176.116802][ T5890] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0
[  176.143189][ T5890] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1
[  176.158528][ T5890] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2
[  176.180219][ T5890] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3
[  176.200991][ T5890] keyspan 3-1:1.0: device disconnected
[  176.941653][ T5890] usb 3-1: new high-speed USB device number 12 using dummy_hcd
[  176.974504][ T7733] loop4: detected capacity change from 0 to 256
[  177.015767][ T7733] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d)
[  177.143137][ T5890] usb 3-1: Using ep0 maxpacket: 8
[  177.163844][ T5890] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11
[  177.186162][ T5890] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  177.200372][ T5890] usb 3-1: config 0 interface 0 has no altsetting 0
[  177.207337][ T5890] usb 3-1: New USB device found, idVendor=04e7, idProduct=0030, bcdDevice= 0.00
[  177.216586][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  177.237433][ T5890] usb 3-1: config 0 descriptor??
[  177.679624][ T5890] input: HID 04e7:0030 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:04E7:0030.0006/input/input10
[  177.784296][ T7753] netlink: 12 bytes leftover after parsing attributes in process `syz.5.570'.
[  177.810113][ T7753] netlink: 165 bytes leftover after parsing attributes in process `syz.5.570'.
[  177.870689][ T5890] elo 0003:04E7:0030.0006: input,hiddev0,hidraw0: USB HID v0.01 Device [HID 04e7:0030] on usb-dummy_hcd.2-1/input0
[  177.961592][ T7758] bond_slave_0: entered promiscuous mode
[  177.967618][ T7758] bond_slave_1: entered promiscuous mode
[  177.991276][  T789] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[  178.010122][ T7758] bond_slave_0: left promiscuous mode
[  178.015960][ T7758] bond_slave_1: left promiscuous mode
[  178.190318][ T7760] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  178.194238][  T789] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  178.236713][  T789] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  178.266599][  T789] usb 5-1: config 0 descriptor??
[  178.286915][  T789] cp210x 5-1:0.0: cp210x converter detected
[  178.476712][ T5890] usb 3-1: USB disconnect, device number 12
[  178.900904][  T789] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -71
[  178.922593][  T789] cp210x 5-1:0.0: GPIO initialisation failed: -71
[  178.932291][  T789] usb 5-1: cp210x converter now attached to ttyUSB0
[  178.941581][  T789] usb 5-1: USB disconnect, device number 10
[  178.978708][  T789] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  178.998097][  T789] cp210x 5-1:0.0: device disconnected
[  179.180422][ T7786] loop2: detected capacity change from 0 to 4096
[  179.219029][ T7786] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  179.495438][ T5773] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  179.707858][ T7796] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  180.520617][ T7801] loop0: detected capacity change from 0 to 32768
[  180.729996][ T7817] loop4: detected capacity change from 0 to 8192
[  181.261562][ T5890] usb 3-1: new high-speed USB device number 13 using dummy_hcd
[  181.314351][   T28] audit: type=1326 audit(1789135936.263:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7840 comm="syz.5.602" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4c7c99e159 code=0x0
[  181.473621][ T5890] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  181.504275][ T5890] usb 3-1: config 0 has no interfaces?
[  181.555377][ T5890] usb 3-1: New USB device found, idVendor=1199, idProduct=0fff, bcdDevice= 0.00
[  181.590273][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  181.628025][ T5890] usb 3-1: config 0 descriptor??
[  181.692284][ T7851] loop4: detected capacity change from 0 to 512
[  181.896436][ T5890] usb 3-1: USB disconnect, device number 13
[  182.601301][ T5817] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[  182.797904][ T5817] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00
[  182.840730][ T5817] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  183.085819][ T5817] cdc_acm 6-1:1.0: ttyACM0: USB ACM device
[  183.386911][ T1192] usb 6-1: USB disconnect, device number 2
[  183.646062][ T7910] loop2: detected capacity change from 0 to 512
[  183.724260][ T7913] FAULT_INJECTION: forcing a failure.
[  183.724260][ T7913] name failslab, interval 1, probability 0, space 0, times 0
[  183.725094][ T6172] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  183.749278][ T7913] CPU: 1 PID: 7913 Comm: syz.4.623 Not tainted syzkaller #0
[  183.756628][ T7913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  183.766736][ T7913] Call Trace:
[  183.770041][ T7913]  <TASK>
[  183.772985][ T7913]  dump_stack_lvl+0x18c/0x250
[  183.777702][ T7913]  ? show_regs_print_info+0x20/0x20
[  183.782929][ T7913]  ? load_image+0x420/0x420
[  183.787447][ T7913]  ? __might_sleep+0xe0/0xe0
[  183.792051][ T7913]  ? __lock_acquire+0x7d80/0x7d80
[  183.797127][ T7913]  should_fail_ex+0x394/0x4c0
[  183.801831][ T7913]  should_failslab+0x9/0x20
[  183.806351][ T7913]  slab_pre_alloc_hook+0x59/0x300
[  183.811398][ T7913]  ? __kasan_slab_alloc+0x6c/0x80
[  183.816451][ T7913]  kmem_cache_alloc_node+0x5e/0x310
[  183.821667][ T7913]  ? __alloc_skb+0x103/0x2c0
[  183.826269][ T7913]  __alloc_skb+0x103/0x2c0
[  183.830701][ T7913]  audit_log_start+0x15e/0x890
[  183.835496][ T7913]  ? audit_serial+0x30/0x30
[  183.840022][ T7913]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  183.846017][ T7913]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  183.852022][ T7913]  audit_seccomp+0x63/0x180
[  183.856546][ T7913]  __secure_computing+0x22c/0x2f0
[  183.861601][ T7913]  syscall_trace_enter+0xa7/0x150
[  183.866671][ T7913]  do_syscall_64+0x28/0xb0
[  183.871106][ T7913]  ? clear_bhb_loop+0x40/0x90
[  183.875833][ T7913]  ? clear_bhb_loop+0x40/0x90
[  183.880526][ T7913]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  183.886428][ T7913] RIP: 0033:0x7f800179e159
[  183.890849][ T7913] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  183.910467][ T7913] RSP: 002b:00007f80026359f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[  183.918904][ T7913] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f800179e159
[  183.926893][ T7913] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000b
[  183.934879][ T7913] RBP: 00007f8002636030 R08: 0000000000000000 R09: 000000000000000b
[  183.942874][ T7913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010
[  183.950868][ T7913] R13: 00007f8001a26038 R14: 00007fff6c3fa080 R15: 00000000000085e8
[  183.958866][ T7913]  </TASK>
[  183.985580][ T7913] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64
[  184.006121][ T7913] audit: out of memory in audit_log_start
[  184.757242][ T7933] netlink: 276 bytes leftover after parsing attributes in process `syz.5.631'.
[  184.911918][ T7936] loop5: detected capacity change from 0 to 16
[  184.932989][ T7936] erofs: (device loop5): mounted with root inode @ nid 36.
[  184.951534][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 155 @ nid 36
[  184.961170][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 154 @ nid 36
[  184.970518][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 153 @ nid 36
[  184.979906][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 152 @ nid 36
[  184.990024][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 139 @ nid 36
[  184.999405][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 138 @ nid 36
[  185.008802][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 137 @ nid 36
[  185.018122][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 136 @ nid 36
[  185.028293][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 128 @ nid 36
[  185.038859][ T7936] erofs: (device loop5): z_erofs_readahead: readahead error at folio 120 @ nid 36
[  185.049677][ T7936] syz.5.632: attempt to access beyond end of device
[  185.049677][ T7936] loop5: rw=524288, sector=13478624032, nr_sectors = 32 limit=16
[  185.063945][ T7936] syz.5.632: attempt to access beyond end of device
[  185.063945][ T7936] loop5: rw=524288, sector=13478624040, nr_sectors = 32 limit=16
[  185.078222][ T7936] syz.5.632: attempt to access beyond end of device
[  185.078222][ T7936] loop5: rw=524288, sector=14550774152, nr_sectors = 32 limit=16
[  185.092543][ T7936] syz.5.632: attempt to access beyond end of device
[  185.092543][ T7936] loop5: rw=524288, sector=14550774160, nr_sectors = 32 limit=16
[  185.107458][ T7936] syz.5.632: attempt to access beyond end of device
[  185.107458][ T7936] loop5: rw=524288, sector=13716630376, nr_sectors = 32 limit=16
[  185.121862][ T7936] syz.5.632: attempt to access beyond end of device
[  185.121862][ T7936] loop5: rw=524288, sector=13716630384, nr_sectors = 32 limit=16
[  185.136329][ T7936] syz.5.632: attempt to access beyond end of device
[  185.136329][ T7936] loop5: rw=524288, sector=790384, nr_sectors = 32 limit=16
[  185.151369][ T7936] syz.5.632: attempt to access beyond end of device
[  185.151369][ T7936] loop5: rw=524288, sector=790392, nr_sectors = 32 limit=16
[  185.165863][ T7936] syz.5.632: attempt to access beyond end of device
[  185.165863][ T7936] loop5: rw=524288, sector=72, nr_sectors = 32 limit=16
[  185.179459][ T7936] syz.5.632: attempt to access beyond end of device
[  185.179459][ T7936] loop5: rw=524288, sector=80, nr_sectors = 32 limit=16
[  185.294336][ T7939] loop2: detected capacity change from 0 to 256
[  185.308924][ T7939] exfat: Deprecated parameter 'utf8'
[  185.324698][ T7939] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d)
[  185.980428][ T7961] FAULT_INJECTION: forcing a failure.
[  185.980428][ T7961] name failslab, interval 1, probability 0, space 0, times 0
[  185.994124][ T7961] CPU: 1 PID: 7961 Comm: syz.4.642 Not tainted syzkaller #0
[  186.001451][ T7961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  186.011541][ T7961] Call Trace:
[  186.014849][ T7961]  <TASK>
[  186.017793][ T7961]  dump_stack_lvl+0x18c/0x250
[  186.022493][ T7961]  ? show_regs_print_info+0x20/0x20
[  186.027705][ T7961]  ? load_image+0x420/0x420
[  186.032243][ T7961]  ? __lock_acquire+0x7d80/0x7d80
[  186.037284][ T7961]  ? ida_alloc_range+0x7d0/0x860
[  186.042252][ T7961]  should_fail_ex+0x394/0x4c0
[  186.046957][ T7961]  should_failslab+0x9/0x20
[  186.051482][ T7961]  slab_pre_alloc_hook+0x59/0x300
[  186.056527][ T7961]  ? alloc_vfsmnt+0x9d/0x450
[  186.061140][ T7961]  ? alloc_vfsmnt+0x9d/0x450
[  186.065756][ T7961]  __kmem_cache_alloc_node+0x53/0x250
[  186.071157][ T7961]  ? alloc_vfsmnt+0x9d/0x450
[  186.075757][ T7961]  __kmalloc_node_track_caller+0xa4/0x230
[  186.081506][ T7961]  kstrdup+0x3b/0x80
[  186.085427][ T7961]  alloc_vfsmnt+0x9d/0x450
[  186.089863][ T7961]  clone_mnt+0x65/0xc60
[  186.094038][ T7961]  copy_tree+0xe0/0x7e0
[  186.098222][ T7961]  ? __raw_spin_lock_init+0x45/0x100
[  186.103529][ T7961]  ? alloc_mnt_ns+0x2f2/0x3b0
[  186.108215][ T7961]  copy_mnt_ns+0x16a/0x8f0
[  186.112646][ T7961]  ? create_new_namespaces+0x34/0x700
[  186.118029][ T7961]  create_new_namespaces+0xd3/0x700
[  186.123241][ T7961]  ? bpf_lsm_capable+0x9/0x10
[  186.127946][ T7961]  ? security_capable+0x89/0xb0
[  186.132819][ T7961]  unshare_nsproxy_namespaces+0x11a/0x160
[  186.138663][ T7961]  ksys_unshare+0x4fa/0x8f0
[  186.143201][ T7961]  ? sighand_ctor+0x50/0x50
[  186.147723][ T7961]  ? lock_chain_count+0x20/0x20
[  186.152592][ T7961]  ? syscall_enter_from_user_mode+0x25/0x80
[  186.158514][ T7961]  __x64_sys_unshare+0x38/0x40
[  186.163308][ T7961]  do_syscall_64+0x55/0xb0
[  186.167750][ T7961]  ? clear_bhb_loop+0x40/0x90
[  186.172437][ T7961]  ? clear_bhb_loop+0x40/0x90
[  186.177132][ T7961]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  186.183046][ T7961] RIP: 0033:0x7f800179e159
[  186.187474][ T7961] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  186.207096][ T7961] RSP: 002b:00007f8002636028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
[  186.215524][ T7961] RAX: ffffffffffffffda RBX: 00007f8001a25fa0 RCX: 00007f800179e159
[  186.223509][ T7961] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000006020400
[  186.231496][ T7961] RBP: 00007f800183503b R08: 0000000000000000 R09: 0000000000000000
[  186.239482][ T7961] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  186.247483][ T7961] R13: 00007f8001a26038 R14: 00007f8001a25fa0 R15: 00007fff6c3d5f28
[  186.255473][ T7961]  </TASK>
[  186.465641][ T5817] kernel write not supported for file bpf-map (pid: 5817 comm: kworker/1:4)
[  187.359217][ T5783] Bluetooth: hci2: unexpected event for opcode 0x2016
[  187.466908][ T8007] loop2: detected capacity change from 0 to 1764
[  187.570182][ T5780] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  187.620398][ T8007] loop2: detected capacity change from 0 to 256
[  187.627907][ T5780] I/O error, dev loop2, sector 16 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  187.651990][ T8007] exfat: Unknown parameter 'iso9660'
[  188.495617][ T8040] loop5: detected capacity change from 0 to 64
[  188.644208][ T1138] buffer_io_error: 16 callbacks suppressed
[  188.644225][ T1138] Buffer I/O error on dev loop5, logical block 2320, lost async page write
[  188.673524][ T1138] Buffer I/O error on dev loop5, logical block 2321, lost async page write
[  188.686500][ T8045] loop2: detected capacity change from 0 to 512
[  188.690897][ T1138] Buffer I/O error on dev loop5, logical block 2322, lost async page write
[  188.700976][ T8045] EXT4-fs: Ignoring removed mblk_io_submit option
[  188.708840][ T1138] Buffer I/O error on dev loop5, logical block 2323, lost async page write
[  188.739111][ T8045] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  188.770985][ T8045] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck.
[  188.787406][   T37] Buffer I/O error on dev loop5, logical block 2320, lost async page write
[  188.797160][ T8045] EXT4-fs (loop2): 1 truncate cleaned up
[  188.804346][ T8045] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  188.826463][   T37] Buffer I/O error on dev loop5, logical block 2321, lost async page write
[  188.856415][   T37] Buffer I/O error on dev loop5, logical block 2322, lost async page write
[  188.901691][   T37] Buffer I/O error on dev loop5, logical block 2323, lost async page write
[  188.926501][ T5773] EXT4-fs error (device loop2): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /154/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0
[  188.956896][ T5773] EXT4-fs (loop2): Remounting filesystem read-only
[  189.058250][ T8052] netlink: 12 bytes leftover after parsing attributes in process `syz.5.676'.
[  189.485838][ T8049] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  189.604751][   T28] audit: type=1326 audit(1789135944.553:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c7c99e159 code=0x7ffc0000
[  189.688928][   T28] audit: type=1326 audit(1789135944.573:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c7c99e159 code=0x7ffc0000
[  189.739231][   T28] audit: type=1326 audit(1789135944.573:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c7c99e159 code=0x7ffc0000
[  189.795210][   T28] audit: type=1326 audit(1789135944.573:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c7c99e159 code=0x7ffc0000
[  189.859357][   T28] audit: type=1326 audit(1789135944.573:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f4c7c99e159 code=0x7ffc0000
[  189.921276][   T28] audit: type=1326 audit(1789135944.583:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c7c99e159 code=0x7ffc0000
[  189.971389][   T28] audit: type=1326 audit(1789135944.633:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f4c7c95e98e code=0x7ffc0000
[  190.030508][   T28] audit: type=1326 audit(1789135944.633:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f4c7c95e98e code=0x7ffc0000
[  190.085749][   T28] audit: type=1326 audit(1789135944.673:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f4c7c95e98e code=0x7ffc0000
[  190.140395][   T28] audit: type=1326 audit(1789135944.683:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.5.684" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f4c7c95e98e code=0x7ffc0000
[  190.411708][ T8075] netlink: 8 bytes leftover after parsing attributes in process `syz.5.689'.
[  190.572727][ T5779] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  190.587852][ T5779] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  190.597808][ T5779] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  190.607593][ T5779] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  190.615838][ T5779] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  190.623400][ T5779] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  190.817875][ T8089] loop4: detected capacity change from 0 to 512
[  190.866807][ T8089] EXT4-fs: Ignoring removed nobh option
[  190.970721][ T8089] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  191.000170][ T8089] ext4 filesystem being mounted at /125/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  191.040507][ T8098] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #2: comm syz.4.694: corrupted inode contents
[  191.056751][ T8098] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #2: comm syz.4.694: mark_inode_dirty error
[  191.071756][ T8098] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #2: comm syz.4.694: corrupted inode contents
[  191.085090][ T8098] EXT4-fs error (device loop4): __ext4_ext_dirty:208: inode #2: comm syz.4.694: mark_inode_dirty error
[  191.104486][ T8089] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #2: comm syz.4.694: corrupted inode contents
[  191.171047][ T6396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  191.184103][ T8076] chnl_net:caif_netlink_parms(): no params data found
[  191.354544][ T8076] bridge0: port 1(bridge_slave_0) entered blocking state
[  191.384173][ T8076] bridge0: port 1(bridge_slave_0) entered disabled state
[  191.416883][ T8076] bridge_slave_0: entered allmulticast mode
[  191.429155][ T8076] bridge_slave_0: entered promiscuous mode
[  191.445350][ T5783] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0
[  191.456525][ T5783] Bluetooth: hci2: Injecting HCI hardware error event
[  191.465854][ T5783] Bluetooth: hci2: hardware error 0x00
[  191.472774][ T8076] bridge0: port 2(bridge_slave_1) entered blocking state
[  191.511671][ T8076] bridge0: port 2(bridge_slave_1) entered disabled state
[  191.518911][ T8076] bridge_slave_1: entered allmulticast mode
[  191.527615][ T8076] bridge_slave_1: entered promiscuous mode
[  191.596580][ T8076] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  191.652930][ T8076] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  191.778730][ T8076] team0: Port device team_slave_0 added
[  191.789790][ T8076] team0: Port device team_slave_1 added
[  191.822641][ T8076] batman_adv: batadv0: Adding interface: batadv_slave_0
[  191.829707][ T8076] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  191.830561][ T8118] gadgetfs: bound to dummy_udc driver
[  191.871905][ T8076] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  191.885453][ T8076] batman_adv: batadv0: Adding interface: batadv_slave_1
[  191.892782][ T8076] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  191.937268][ T8076] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  192.053725][ T8076] hsr_slave_0: entered promiscuous mode
[  192.064450][ T8076] hsr_slave_1: entered promiscuous mode
[  192.077932][ T8076] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  192.089909][ T8076] Cannot create hsr debugfs directory
[  192.262836][ T8076] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  192.274147][ T8076] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  192.285595][ T8076] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  192.296139][ T8076] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  192.354346][   T23] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  192.388537][ T8076] 8021q: adding VLAN 0 to HW filter on device bond0
[  192.413425][ T8076] 8021q: adding VLAN 0 to HW filter on device team0
[  192.426604][   T59] bridge0: port 1(bridge_slave_0) entered blocking state
[  192.433763][   T59] bridge0: port 1(bridge_slave_0) entered forwarding state
[  192.450789][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state
[  192.457931][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state
[  192.559833][   T23] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32
[  192.581021][   T23] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 25970, setting to 1024
[  192.610117][   T23] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024
[  192.641416][   T23] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00
[  192.650486][   T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  192.694024][ T8123] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  192.711361][ T8123] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  192.722708][ T5779] Bluetooth: hci1: command tx timeout
[  192.732917][   T23] cyberjack 6-1:1.0: Reiner SCT Cyberjack USB card reader converter detected
[  192.752770][   T23] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0
[  192.976691][ T5817] usb 6-1: USB disconnect, device number 3
[  192.987603][ T5817] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0
[  193.026914][ T5817] cyberjack 6-1:1.0: device disconnected
[  193.086758][ T8076] 8021q: adding VLAN 0 to HW filter on device batadv0
[  193.511847][ T5783] Bluetooth: hci2: Opcode 0x0c03 failed: -110
[  193.859629][ T8076] veth0_vlan: entered promiscuous mode
[  193.912413][ T8076] veth1_vlan: entered promiscuous mode
[  193.934759][ T8172] loop5: detected capacity change from 0 to 128
[  193.966697][ T8172] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  193.990056][ T8172] ext4 filesystem being mounted at /74/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  194.047801][ T8076] veth0_macvtap: entered promiscuous mode
[  194.061096][ T8076] veth1_macvtap: entered promiscuous mode
[  194.082300][ T8172] fscrypt (loop5, inode 12): Unsupported encryption modes (contents 0, filenames 0)
[  194.103755][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  194.141612][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.171362][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  194.192766][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.207070][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  194.226216][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.253920][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  194.260287][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  194.271507][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  194.292189][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.302080][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  194.312622][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.334754][ T8076] batman_adv: batadv0: Interface activated: batadv_slave_0
[  194.353630][ T7375] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  194.369909][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  194.415217][ T8183] loop4: detected capacity change from 0 to 128
[  194.431234][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.441073][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  194.490557][ T8183] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only
[  194.491328][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.525664][ T8183] hpfs: filesystem error: improperly stopped
[  194.532183][ T8183] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[  194.540038][ T8183] hpfs: You really don't want any checks? You are crazy...
[  194.548547][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  194.559954][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.569987][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  194.580657][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.601135][ T8183] hpfs: Code page index out of array
[  194.619795][ T8183] hpfs: code page support is disabled
[  194.625294][ T8076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  194.642566][ T8183] hpfs: hpfs_map_4sectors(): unaligned read
[  194.651288][ T8076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  194.674204][ T8183] hpfs: hpfs_map_4sectors(): unaligned read
[  194.680131][ T8183] hpfs: filesystem error: unable to find root dir
[  194.690642][ T8076] batman_adv: batadv0: Interface activated: batadv_slave_1
[  194.732004][ T8181] netlink: 8 bytes leftover after parsing attributes in process `syz.0.718'.
[  194.793912][ T5783] Bluetooth: hci1: command tx timeout
[  194.855714][ T8076] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  194.874881][ T8076] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  194.908854][ T8076] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  194.921283][ T8076] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  195.196792][ T1138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  195.223554][ T1138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  195.296054][ T7280] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  195.349513][ T7280] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  195.840992][ T8218] overlayfs: invalid redirect ((null))
[  196.881492][ T5783] Bluetooth: hci1: command tx timeout
[  197.155900][ T8255] loop2: detected capacity change from 0 to 7
[  197.200891][ T8258] binder: 8253:8258 ioctl c0306201 200000000080 returned -14
[  197.208610][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  197.224076][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  197.233271][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  197.242339][    C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  197.251544][    C0] Buffer I/O error on dev loop2, logical block 0, async page read
[  197.303479][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  197.312743][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  197.332201][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  197.341399][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  197.361630][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  197.370846][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  198.084373][ T8282] loop0: detected capacity change from 0 to 512
[  198.088933][ T8281] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) !
[  198.120700][ T8282] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  198.133572][ T5816] usb 5-1: new full-speed USB device number 11 using dummy_hcd
[  198.141850][ T8282] ext4 filesystem being mounted at /206/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  198.185246][   T28] kauditd_printk_skb: 30 callbacks suppressed
[  198.185259][   T28] audit: type=1800 audit(1789135953.133:56): pid=8282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.756" name="file1" dev="loop0" ino=15 res=0 errno=0
[  198.260117][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  198.333326][ T5816] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  198.364001][ T5816] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0
[  198.394385][ T5816] usb 5-1: config 1 interface 1 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  198.431342][ T5816] usb 5-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00
[  198.462446][ T5816] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  198.726247][ T8300] netlink: 'syz.5.762': attribute type 1 has an invalid length.
[  198.854971][ T8302] netlink: 12 bytes leftover after parsing attributes in process `syz.0.764'.
[  198.917624][ T5816] dvb_ttusb_budget: ttusb_init_controller: error
[  198.943127][ T5816] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB)
[  198.961957][ T5783] Bluetooth: hci1: command tx timeout
[  199.067245][ T8308] futex_wake_op: syz.0.766 tries to shift op by 144; fix this program
[  199.214098][ T5816] DVB: Unable to find symbol stv0299_attach()
[  199.287237][ T8315] dvb_ttusb_budget: cmd xter failed, receive error -90
[  199.301723][ T5816] DVB: Unable to find symbol tda8083_attach()
[  199.313021][ T5816] dvb_ttusb_budget: no frontend driver found for device [0b48:1003]
[  199.400817][ T8319] loop6: detected capacity change from 0 to 512
[  199.421754][ T8319] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode
[  199.448212][ T8319] EXT4-fs (loop6): 1 truncate cleaned up
[  199.455424][ T8319] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  199.510205][   T27] usb 5-1: USB disconnect, device number 11
[  199.716866][ T8076] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  200.405986][ T8328] loop6: detected capacity change from 0 to 40427
[  200.443414][ T8328] F2FS-fs (loop6): Wrong segment_count / block_count (31 > 0)
[  200.453807][ T8328] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock
[  200.479865][ T8328] F2FS-fs (loop6): invalid crc value
[  200.504620][ T8328] F2FS-fs (loop6): Found nat_bits in checkpoint
[  200.679817][ T8328] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0
[  200.700683][ T5783] Bluetooth: hci0: ACL packet for unknown connection handle 200
[  200.713807][ T8328] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  200.815048][ T8328] bio_check_eod: 16 callbacks suppressed
[  200.815066][ T8328] syz.6.773: attempt to access beyond end of device
[  200.815066][ T8328] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  200.874682][ T8328] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  200.899236][ T8328] syz.6.773: attempt to access beyond end of device
[  200.899236][ T8328] loop6: rw=2049, sector=45120, nr_sectors = 8 limit=40427
[  200.968164][ T8328] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  201.031004][ T8351] loop4: detected capacity change from 0 to 1024
[  201.652830][ T8365] veth1_to_bridge: entered allmulticast mode
[  201.662056][ T8365] veth1_to_bridge: left allmulticast mode
[  202.331497][ T5890] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[  202.596785][ T5890] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  202.629836][ T5890] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  202.655909][ T8392] netlink: 4 bytes leftover after parsing attributes in process `syz.4.789'.
[  202.675091][ T5890] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  202.702766][ T5890] usb 7-1: config 0 descriptor??
[  202.860715][ T8399] Bluetooth: ISO socket layer initialized
[  202.972215][ T5890] usbhid 7-1:0.0: can't add hid device: -71
[  202.983114][ T5890] usbhid: probe of 7-1:0.0 failed with error -71
[  203.013884][ T5890] usb 7-1: USB disconnect, device number 2
[  203.220607][ T8410] loop4: detected capacity change from 0 to 128
[  203.287014][   T28] audit: type=1800 audit(1789135958.223:57): pid=8410 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.795" name="bus" dev="loop4" ino=1048629 res=0 errno=0
[  203.411880][ T6396] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF
[  203.420822][ T6396] FAT-fs (loop4): Filesystem has been set read-only
[  203.583687][ T5890] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[  203.781353][ T5890] usb 7-1: Using ep0 maxpacket: 32
[  203.812624][ T5890] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  203.864628][ T5890] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40
[  203.889662][ T5890] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  203.915517][ T5890] usb 7-1: config 0 descriptor??
[  203.932561][ T5890] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[  203.964231][ T5890] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[  204.403812][ T5890] usb 7-1: USB disconnect, device number 3
[  204.418331][ T5890] ldusb 7-1:0.0: LD USB Device #0 now disconnected
[  204.451924][   T27] usb 5-1: new high-speed USB device number 12 using dummy_hcd
[  204.631346][   T27] usb 5-1: Using ep0 maxpacket: 16
[  204.638633][   T27] usb 5-1: unable to get BOS descriptor or descriptor too short
[  204.647926][   T27] usb 5-1: config 1 interface 0 has no altsetting 0
[  204.658964][   T27] usb 5-1: string descriptor 0 read error: -22
[  204.665464][   T27] usb 5-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.40
[  204.676651][   T27] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  204.898124][ T8445] lo: entered promiscuous mode
[  204.903837][ T8445] lo: entered allmulticast mode
[  204.909242][ T8445] bond0: entered promiscuous mode
[  204.914545][ T8445] bond0: entered allmulticast mode
[  204.933419][ T8445] dummy0: entered promiscuous mode
[  204.938633][ T8445] dummy0: entered allmulticast mode
[  204.943862][    C0] vcan0: j1939_tp_rxtimer: 0xffff888024803c00: rx timeout, send abort
[  204.954717][    C0] vcan0: j1939_tp_rxtimer: 0xffff888024803000: rx timeout, send abort
[  204.963337][    C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888024803c00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
[  204.978617][ T8445] eql: entered promiscuous mode
[  204.980067][    C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888024803000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
[  204.983782][ T8445] eql: entered allmulticast mode
[  205.030469][ T8445] ifb0: entered promiscuous mode
[  205.046158][ T8445] ifb0: entered allmulticast mode
[  205.063309][ T8445] ifb1: entered promiscuous mode
[  205.078501][ T8445] ifb1: entered allmulticast mode
[  205.100664][ T8445] virtio_net virtio1 eth0: entered promiscuous mode
[  205.127654][ T8445] virtio_net virtio1 eth0: entered allmulticast mode
[  205.172263][ T8445] mac80211_hwsim hwsim0 wlan0: entered promiscuous mode
[  205.186371][ T8445] mac80211_hwsim hwsim0 wlan0: entered allmulticast mode
[  205.225083][ T8445] mac80211_hwsim hwsim1 wlan1: entered promiscuous mode
[  205.271530][ T8445] mac80211_hwsim hwsim1 wlan1: entered allmulticast mode
[  205.280394][ T8445] hwsim0: entered promiscuous mode
[  205.336957][ T8445] hwsim0: entered allmulticast mode
[  205.355814][ T8445] ieee802154 phy0 wpan0: entered promiscuous mode
[  205.384895][ T8445] ieee802154 phy0 wpan0: entered allmulticast mode
[  205.416712][ T8445] ieee802154 phy1 wpan1: entered promiscuous mode
[  205.439254][ T8445] ieee802154 phy1 wpan1: entered allmulticast mode
[  205.464525][ T8445] teql0: entered promiscuous mode
[  205.469591][ T8445] teql0: entered allmulticast mode
[  205.524549][ T8445] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check.
[  205.630764][   T27] usbhid 5-1:1.0: can't add hid device: -71
[  205.641094][   T27] usbhid: probe of 5-1:1.0 failed with error -71
[  205.657747][   T27] usb 5-1: USB disconnect, device number 12
[  206.827605][ T7284] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  206.964276][ T7284] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  207.129684][ T7284] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  207.333177][ T7284] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  207.765546][ T5783] Bluetooth: hci4: unexpected cc 0x203e length: 2 > 1
[  207.816062][ T5779] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  207.837422][ T5779] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  207.850857][ T5779] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  207.859844][ T5779] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  207.868061][ T5779] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  207.877011][ T5779] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  208.108464][ T8534] netlink: 'syz.5.843': attribute type 1 has an invalid length.
[  208.216944][ T8534] bond1: entered promiscuous mode
[  208.231488][ T8534] bond1: entered allmulticast mode
[  208.236962][ T8534] 8021q: adding VLAN 0 to HW filter on device bond1
[  208.290880][ T8538] erspan1: entered allmulticast mode
[  208.337842][ T8538] bond1: (slave erspan1): making interface the new active one
[  208.354326][ T8538] erspan1: entered promiscuous mode
[  208.368832][ T8538] bond1: (slave erspan1): Enslaving as an active interface with an up link
[  208.434798][ T8538] syz.5.843 (8538) used greatest stack depth: 18536 bytes left
[  208.664539][ T8557] netlink: 12 bytes leftover after parsing attributes in process `syz.5.847'.
[  208.726267][ T8559] netlink: 60 bytes leftover after parsing attributes in process `syz.5.847'.
[  208.855984][   T37] Bluetooth: hci5: Frame reassembly failed (-84)
[  209.260757][ T8527] chnl_net:caif_netlink_parms(): no params data found
[  209.427025][ T8585] netlink: 12 bytes leftover after parsing attributes in process `syz.5.853'.
[  209.550869][ T8527] bridge0: port 1(bridge_slave_0) entered blocking state
[  209.568585][ T8527] bridge0: port 1(bridge_slave_0) entered disabled state
[  209.568894][ T8591] loop5: detected capacity change from 0 to 256
[  209.578476][ T8527] bridge_slave_0: entered allmulticast mode
[  209.589981][ T8527] bridge_slave_0: entered promiscuous mode
[  209.649380][ T8527] bridge0: port 2(bridge_slave_1) entered blocking state
[  209.671399][ T8527] bridge0: port 2(bridge_slave_1) entered disabled state
[  209.681440][ T8591] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  209.699226][ T8527] bridge_slave_1: entered allmulticast mode
[  209.726500][ T8527] bridge_slave_1: entered promiscuous mode
[  209.912149][ T5783] Bluetooth: hci1: command tx timeout
[  210.258026][ T7284] hsr_slave_0: left promiscuous mode
[  210.334547][ T7284] hsr_slave_1: left promiscuous mode
[  210.381324][ T7284] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  210.388818][ T7284] batman_adv: batadv0: Removing interface: batadv_slave_0
[  210.442094][ T7284] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  210.449545][ T7284] batman_adv: batadv0: Removing interface: batadv_slave_1
[  210.483456][ T7284] bridge_slave_1: left allmulticast mode
[  210.489180][ T7284] bridge_slave_1: left promiscuous mode
[  210.521488][ T7284] bridge0: port 2(bridge_slave_1) entered disabled state
[  210.555382][ T7284] bridge_slave_0: left allmulticast mode
[  210.568458][ T7284] bridge_slave_0: left promiscuous mode
[  210.579862][ T7284] bridge0: port 1(bridge_slave_0) entered disabled state
[  210.624710][ T8612] loop0: detected capacity change from 0 to 8192
[  210.679840][ T7284] veth1_macvtap: left promiscuous mode
[  210.704454][ T7284] veth0_macvtap: left promiscuous mode
[  210.726119][ T7284] veth1_vlan: left promiscuous mode
[  210.742046][ T7284] veth0_vlan: left promiscuous mode
[  210.873170][ T5783] Bluetooth: hci5: command 0x1003 tx timeout
[  210.881243][ T5779] Bluetooth: hci5: Opcode 0x1003 failed: -110
[  211.607980][ T7284] team0 (unregistering): Port device team_slave_1 removed
[  211.656449][ T7284] team0 (unregistering): Port device team_slave_0 removed
[  211.704461][ T7284] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  211.753014][ T7284] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  211.836704][ T5779] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0
[  211.847512][ T5779] Bluetooth: hci4: Injecting HCI hardware error event
[  211.856543][ T5783] Bluetooth: hci4: hardware error 0x00
[  211.991399][ T5779] Bluetooth: hci1: command tx timeout
[  212.159945][ T7284] bond0 (unregistering): Released all slaves
[  212.232698][ T8527] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  212.243578][ T8604] syz_tun: entered allmulticast mode
[  212.253753][ T8608] syz_tun: left allmulticast mode
[  212.297812][ T8527] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  212.529261][ T8527] team0: Port device team_slave_0 added
[  212.539094][ T8527] team0: Port device team_slave_1 added
[  212.668987][ T8527] batman_adv: batadv0: Adding interface: batadv_slave_0
[  212.698149][ T8527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  212.744077][ T8527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  212.772252][ T8527] batman_adv: batadv0: Adding interface: batadv_slave_1
[  212.784222][ T8635] FAULT_INJECTION: forcing a failure.
[  212.784222][ T8635] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  212.800674][ T8527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  212.851343][ T8635] CPU: 0 PID: 8635 Comm: syz.5.864 Not tainted syzkaller #0
[  212.858691][ T8635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  212.868789][ T8635] Call Trace:
[  212.871966][ T8527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  212.872110][ T8635]  <TASK>
[  212.885613][ T8635]  dump_stack_lvl+0x18c/0x250
[  212.890342][ T8635]  ? show_regs_print_info+0x20/0x20
[  212.895589][ T8635]  ? load_image+0x420/0x420
[  212.900112][ T8635]  ? __lock_acquire+0x7d80/0x7d80
[  212.905173][ T8635]  ? __virt_addr_valid+0x10c/0x380
[  212.910322][ T8635]  should_fail_ex+0x394/0x4c0
[  212.915028][ T8635]  _copy_from_user+0x2f/0xe0
[  212.919661][ T8635]  bpf_vlog_reverse_ubuf+0xbb/0x3a0
[  212.924890][ T8635]  bpf_vlog_finalize+0x1b3/0x3e0
[  212.929880][ T8635]  btf_new_fd+0x4ca/0x9e0
[  212.934246][ T8635]  ? bpf_btf_show_fdinfo+0x80/0x80
[  212.939383][ T8635]  ? capable+0x88/0xe0
[  212.943498][ T8635]  __sys_bpf+0x670/0x890
[  212.947757][ T8635]  ? bpf_link_show_fdinfo+0x390/0x390
[  212.953151][ T8635]  ? lock_chain_count+0x20/0x20
[  212.958029][ T8635]  __x64_sys_bpf+0x7c/0x90
[  212.962467][ T8635]  do_syscall_64+0x55/0xb0
[  212.966902][ T8635]  ? clear_bhb_loop+0x40/0x90
[  212.971595][ T8635]  ? clear_bhb_loop+0x40/0x90
[  212.976288][ T8635]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  212.982195][ T8635] RIP: 0033:0x7f4c7c99e159
[  212.986626][ T8635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  213.006251][ T8635] RSP: 002b:00007f4c7d950028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  213.014705][ T8635] RAX: ffffffffffffffda RBX: 00007f4c7cc25fa0 RCX: 00007f4c7c99e159
[  213.023223][ T8635] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012
[  213.031208][ T8635] RBP: 00007f4c7ca3503b R08: 0000000000000000 R09: 0000000000000000
[  213.039203][ T8635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  213.047193][ T8635] R13: 00007f4c7cc26038 R14: 00007f4c7cc25fa0 R15: 00007fff4cb99a48
[  213.055191][ T8635]  </TASK>
[  213.058271][    C0] vkms_vblank_simulate: vblank timer overrun
[  213.155315][ T8527] hsr_slave_0: entered promiscuous mode
[  213.198254][ T8527] hsr_slave_1: entered promiscuous mode
[  213.223517][ T8527] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  213.247380][ T8527] Cannot create hsr debugfs directory
[  213.519673][ T8647] loop0: detected capacity change from 0 to 1024
[  213.931276][ T5783] Bluetooth: hci4: Opcode 0x0c03 failed: -110
[  214.015079][ T8527] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  214.071853][ T5783] Bluetooth: hci1: command tx timeout
[  214.158377][ T8527] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  214.224198][ T8527] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  214.278531][ T8527] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  214.292508][ T8671] loop0: detected capacity change from 0 to 512
[  214.543617][ T8527] 8021q: adding VLAN 0 to HW filter on device bond0
[  214.576061][ T8527] 8021q: adding VLAN 0 to HW filter on device team0
[  214.590909][ T7280] bridge0: port 1(bridge_slave_0) entered blocking state
[  214.598081][ T7280] bridge0: port 1(bridge_slave_0) entered forwarding state
[  214.647947][ T1075] bridge0: port 2(bridge_slave_1) entered blocking state
[  214.655166][ T1075] bridge0: port 2(bridge_slave_1) entered forwarding state
[  215.108596][ T8527] 8021q: adding VLAN 0 to HW filter on device batadv0
[  215.702957][ T8527] veth0_vlan: entered promiscuous mode
[  215.744303][ T8527] veth1_vlan: entered promiscuous mode
[  215.817166][ T8527] veth0_macvtap: entered promiscuous mode
[  215.829979][ T8527] veth1_macvtap: entered promiscuous mode
[  215.893380][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  215.936792][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  215.962699][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  215.993975][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.028799][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  216.046369][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.066727][ T8725] loop4: detected capacity change from 0 to 1024
[  216.071615][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  216.101268][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.121295][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  216.144024][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.154708][ T5783] Bluetooth: hci1: command tx timeout
[  216.192316][ T8527] batman_adv: batadv0: Interface activated: batadv_slave_0
[  216.258223][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  216.302339][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.328407][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  216.340815][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.351059][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  216.361910][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.373898][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  216.387172][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.398416][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  216.411007][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  216.443918][ T8527] batman_adv: batadv0: Interface activated: batadv_slave_1
[  216.509998][ T8731] netlink: 28 bytes leftover after parsing attributes in process `syz.0.883'.
[  216.569066][ T8527] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  216.587322][ T8527] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  216.597060][ T8527] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  216.608063][ T8527] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  216.845234][ T7284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  216.889152][ T7284] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  216.984254][ T7280] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  217.000715][ T7280] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  217.453373][   T27] usb 5-1: new high-speed USB device number 13 using dummy_hcd
[  217.673978][   T27] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  217.684648][   T27] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  217.714712][   T27] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  217.763801][   T27] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[  217.786997][   T27] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  217.813958][   T27] usb 5-1: Product: syz
[  217.835516][   T27] usb 5-1: Manufacturer: syz
[  217.844196][   T27] usb 5-1: SerialNumber: syz
[  217.885268][   T27] hub 5-1:1.0: bad descriptor, ignoring hub
[  217.908103][   T27] hub: probe of 5-1:1.0 failed with error -5
[  218.093801][   T27] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 13 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[  218.614925][ T8749] usb 5-1: reset high-speed USB device number 13 using dummy_hcd
[  218.643296][ T8781] loop7: detected capacity change from 0 to 16
[  218.703488][ T8781] erofs: (device loop7): mounted with root inode @ nid 36.
[  218.879987][   T28] audit: type=1326 audit(1789135973.823:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8785 comm="syz.7.898" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=39 compat=0 ip=0x7fafee597ed7 code=0x0
[  219.111715][   T27] usb 5-1: USB disconnect, device number 13
[  219.133618][   T27] usblp0: removed
[  220.016054][ T8802] input: syz0 as /devices/virtual/input/input11
[  220.123978][ T8805] loop7: detected capacity change from 0 to 256
[  220.161814][ T8805] exfat: Deprecated parameter 'namecase'
[  220.265546][ T8805] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0x36df086c, utbl_chksum : 0xe619d30d)
[  221.193712][ T8831] gadgetfs: bound to dummy_udc driver
[  221.356231][ T8835] loop0: detected capacity change from 0 to 256
[  221.455302][ T8835] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0xa9436649, utbl_chksum : 0xe619d30d)
[  221.934101][ T8851] Invalid argument reading file caps for ./file0
[  223.696755][ T8895] loop0: detected capacity change from 0 to 512
[  223.775358][ T8895] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[  223.997372][ T8895] EXT4-fs (loop0): 1 truncate cleaned up
[  224.082780][ T8895] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  224.321869][   T27] usb 5-1: new high-speed USB device number 14 using dummy_hcd
[  224.468490][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  224.559754][   T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  224.631494][   T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  224.671263][   T27] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  224.721322][   T27] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  224.730423][   T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  224.772606][   T27] usb 5-1: config 0 descriptor??
[  224.964052][ T8923] loop7: detected capacity change from 0 to 128
[  224.984685][ T8923] FAT-fs (loop7): bogus number of reserved sectors
[  224.992143][ T8923] FAT-fs (loop7): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero
[  225.031858][ T8923] FAT-fs (loop7): Can't find a valid FAT filesystem
[  225.087823][ T5780] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  225.194376][   T27] plantronics 0003:047F:FFFF.0007: unknown main item tag 0xd
[  225.225332][   T27] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving
[  225.312066][   T27] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0
[  225.407834][ T8933] loop0: detected capacity change from 0 to 256
[  225.505273][   T27] usb 5-1: USB disconnect, device number 14
[  226.009383][ T8944] loop0: detected capacity change from 0 to 512
[  226.114229][ T8944] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[  226.244410][ T8944] EXT4-fs (loop0): 1 truncate cleaned up
[  226.329475][ T8944] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  226.421366][   T27] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[  226.571232][   T28] audit: type=1800 audit(1789135981.513:59): pid=8944 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.938" name="file1" dev="loop0" ino=15 res=0 errno=0
[  226.651255][   T27] usb 8-1: Using ep0 maxpacket: 8
[  226.684117][   T27] usb 8-1: config 0 has an invalid interface number: 1 but max is 0
[  226.695043][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  226.721516][   T27] usb 8-1: config 0 has no interface number 0
[  226.727690][   T27] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  226.775838][   T27] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[  226.811565][   T27] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  226.838516][   T27] usb 8-1: config 0 descriptor??
[  226.908743][   T27] iowarrior 8-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0
[  227.093913][  T789] usb 8-1: USB disconnect, device number 2
[  227.099854][    C1] iowarrior 8-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19
[  227.661897][ T8957] loop4: detected capacity change from 0 to 40427
[  227.705018][ T8957] F2FS-fs (loop4): invalid crc value
[  227.741267][ T8957] F2FS-fs (loop4): Found nat_bits in checkpoint
[  227.980215][ T8957] F2FS-fs (loop4): Start checkpoint disabled!
[  228.062401][ T8957] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6
[  228.653888][ T8988] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  228.711619][ T1138] kworker/u4:7: attempt to access beyond end of device
[  228.711619][ T1138] loop4: rw=2049, sector=40960, nr_sectors = 8 limit=40427
[  228.745145][ T1138] F2FS-fs (loop4): Stopped filesystem due to reason: 3
[  229.413679][ T9000] bridge1: entered promiscuous mode
[  229.476002][ T9000] bridge1: entered allmulticast mode
[  229.526555][ T9004] netlink: 48 bytes leftover after parsing attributes in process `syz.7.953'.
[  230.107746][ T9016] netlink: 'syz.4.957': attribute type 10 has an invalid length.
[  230.157484][ T9016] bridge0: port 2(bridge_slave_1) entered disabled state
[  230.221766][ T9016] bridge_slave_1: left allmulticast mode
[  230.240381][ T9016] bridge_slave_1: left promiscuous mode
[  230.257591][ T9016] bridge0: port 2(bridge_slave_1) entered disabled state
[  230.290593][ T9019] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-22)
[  230.557218][ T9021] FAULT_INJECTION: forcing a failure.
[  230.557218][ T9021] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  230.581416][ T9021] CPU: 1 PID: 9021 Comm: syz.4.960 Not tainted syzkaller #0
[  230.588810][ T9021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  230.598926][ T9021] Call Trace:
[  230.602252][ T9021]  <TASK>
[  230.605232][ T9021]  dump_stack_lvl+0x18c/0x250
[  230.609986][ T9021]  ? show_regs_print_info+0x20/0x20
[  230.615248][ T9021]  ? load_image+0x420/0x420
[  230.619809][ T9021]  ? __lock_acquire+0x7d80/0x7d80
[  230.624908][ T9021]  should_fail_ex+0x394/0x4c0
[  230.629669][ T9021]  prepare_alloc_pages+0x1e1/0x5b0
[  230.634851][ T9021]  __alloc_pages+0x134/0x460
[  230.639510][ T9021]  ? zone_statistics+0x170/0x170
[  230.644568][ T9021]  ? alloc_pages+0x4e1/0x740
[  230.649213][ T9021]  ? do_raw_spin_unlock+0x121/0x230
[  230.654456][ T9021]  __get_free_pages+0xc/0x30
[  230.659083][ T9021]  kasan_populate_vmalloc_pte+0x35/0x100
[  230.664758][ T9021]  __apply_to_page_range+0x860/0xdd0
[  230.670081][ T9021]  ? kasan_populate_vmalloc+0x70/0x70
[  230.675494][ T9021]  ? apply_to_page_range+0x50/0x50
[  230.680648][ T9021]  ? do_raw_spin_unlock+0x121/0x230
[  230.685893][ T9021]  alloc_vmap_area+0x1d26/0x1e50
[  230.690887][ T9021]  ? vm_map_ram+0xcf0/0xcf0
[  230.695454][ T9021]  ? rcu_is_watching+0x15/0xb0
[  230.700254][ T9021]  __get_vm_area_node+0x162/0x370
[  230.705309][ T9021]  __vmalloc_node_range+0x36f/0x1320
[  230.710644][ T9021]  ? sock_hash_alloc+0x25e/0x4e0
[  230.715652][ T9021]  ? free_vm_area+0x50/0x50
[  230.720184][ T9021]  ? bpf_map_area_alloc+0x5e/0x110
[  230.725324][ T9021]  ? rcu_is_watching+0x15/0xb0
[  230.730115][ T9021]  ? bpf_map_area_alloc+0x5e/0x110
[  230.735260][ T9021]  bpf_map_area_alloc+0xf1/0x110
[  230.740228][ T9021]  ? sock_hash_alloc+0x25e/0x4e0
[  230.745198][ T9021]  sock_hash_alloc+0x25e/0x4e0
[  230.750004][ T9021]  map_create+0x877/0x12f0
[  230.754454][ T9021]  __sys_bpf+0x651/0x890
[  230.758742][ T9021]  ? bpf_link_show_fdinfo+0x390/0x390
[  230.764167][ T9021]  ? lock_chain_count+0x20/0x20
[  230.769060][ T9021]  __x64_sys_bpf+0x7c/0x90
[  230.773506][ T9021]  do_syscall_64+0x55/0xb0
[  230.777941][ T9021]  ? clear_bhb_loop+0x40/0x90
[  230.782636][ T9021]  ? clear_bhb_loop+0x40/0x90
[  230.787342][ T9021]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  230.793260][ T9021] RIP: 0033:0x7f800179e159
[  230.797714][ T9021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  230.817341][ T9021] RSP: 002b:00007f8002636028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  230.825776][ T9021] RAX: ffffffffffffffda RBX: 00007f8001a25fa0 RCX: 00007f800179e159
[  230.833762][ T9021] RDX: 0000000000000050 RSI: 0000200000000040 RDI: 0000000000000000
[  230.841757][ T9021] RBP: 00007f800183503b R08: 0000000000000000 R09: 0000000000000000
[  230.849758][ T9021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  230.857749][ T9021] R13: 00007f8001a26038 R14: 00007f8001a25fa0 R15: 00007fff6c3d5f28
[  230.865757][ T9021]  </TASK>
[  231.413677][ T9029] loop4: detected capacity change from 0 to 512
[  231.451878][ T9029] EXT4-fs: Ignoring removed bh option
[  231.476662][ T9029] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  231.577440][ T9029] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  231.598482][ T9029] ext4 filesystem being mounted at /208/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  231.819533][ T9031] loop0: detected capacity change from 0 to 8192
[  231.872437][ T6396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  231.905172][ T9031] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[  231.968934][ T9031] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal
[  232.059322][ T9031] REISERFS (device loop0): using ordered data mode
[  232.074221][ T9031] reiserfs: using flush barriers
[  232.085481][ T9031] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[  232.139828][ T9031] REISERFS (device loop0): checking transaction log (loop0)
[  232.399369][ T9031] REISERFS (device loop0): Using tea hash to sort names
[  232.412666][ T9031] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
[  233.064682][ T9056] input: syz0 as /devices/virtual/input/input13
[  233.233657][ T9059] loop0: detected capacity change from 0 to 64
[  233.731095][ T5779] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  233.760146][ T5779] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  233.779715][ T5779] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  233.800526][ T5779] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  233.808388][ T5779] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  233.816935][ T5779] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  234.014327][   T59] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  234.026279][ T1192] usb 5-1: new high-speed USB device number 15 using dummy_hcd
[  234.130280][   T59] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  234.218173][ T1192] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  234.225448][   T59] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  234.238223][ T1192] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[  234.250856][ T1192] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[  234.260522][ T1192] usb 5-1: Product: syz
[  234.265310][ T1192] usb 5-1: Manufacturer: syz
[  234.270007][ T1192] usb 5-1: SerialNumber: syz
[  234.366739][   T59] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  234.408168][ T9072] chnl_net:caif_netlink_parms(): no params data found
[  234.513025][ T1192] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 15 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[  234.628795][ T9072] bridge0: port 1(bridge_slave_0) entered blocking state
[  234.649243][ T9072] bridge0: port 1(bridge_slave_0) entered disabled state
[  234.663145][ T9072] bridge_slave_0: entered allmulticast mode
[  234.670758][ T9072] bridge_slave_0: entered promiscuous mode
[  234.691840][ T9072] bridge0: port 2(bridge_slave_1) entered blocking state
[  234.699089][ T9072] bridge0: port 2(bridge_slave_1) entered disabled state
[  234.724110][ T9072] bridge_slave_1: entered allmulticast mode
[  234.745079][ T9072] bridge_slave_1: entered promiscuous mode
[  234.807236][ T9072] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  234.860239][ T9100] sg_write: data in/out 2143289310/14 bytes for SCSI command 0x0-- guessing data in;
[  234.860239][ T9100]    program syz.7.982 not setting count and/or reply_len properly
[  234.908487][ T9072] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  235.146795][ T9072] team0: Port device team_slave_0 added
[  235.169666][ T9072] team0: Port device team_slave_1 added
[  235.267803][ T9072] batman_adv: batadv0: Adding interface: batadv_slave_0
[  235.277590][ T9072] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  235.305513][ T9072] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  235.347145][ T9072] batman_adv: batadv0: Adding interface: batadv_slave_1
[  235.355128][ T9072] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  235.385199][ T9072] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  235.549877][ T9072] hsr_slave_0: entered promiscuous mode
[  235.560807][ T9072] hsr_slave_1: entered promiscuous mode
[  235.567322][ T9072] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  235.585246][ T9072] Cannot create hsr debugfs directory
[  235.729002][   T59] bond1: (slave erspan1): Releasing active interface
[  235.742526][   T59] erspan1 (unregistering): left promiscuous mode
[  235.917538][ T5783] Bluetooth: hci4: command tx timeout
[  236.482078][   T59] hsr_slave_0: left promiscuous mode
[  236.494426][   T59] hsr_slave_1: left promiscuous mode
[  236.508881][   T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  236.530192][   T59] batman_adv: batadv0: Removing interface: batadv_slave_0
[  236.539810][   T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  236.559580][   T59] batman_adv: batadv0: Removing interface: batadv_slave_1
[  236.600985][   T59] bridge_slave_1: left allmulticast mode
[  236.624458][   T59] bridge_slave_1: left promiscuous mode
[  236.630261][   T59] bridge0: port 2(bridge_slave_1) entered disabled state
[  236.708925][   T59] bridge_slave_0: left allmulticast mode
[  236.724755][   T59] bridge_slave_0: left promiscuous mode
[  236.730545][   T59] bridge0: port 1(bridge_slave_0) entered disabled state
[  236.813518][   T59] veth1_macvtap: left promiscuous mode
[  236.819107][   T59] veth0_macvtap: left promiscuous mode
[  236.832290][   T59] veth1_vlan: left promiscuous mode
[  236.837777][   T59] veth0_vlan: left promiscuous mode
[  237.121600][   T29] INFO: task kworker/1:3:5764 blocked for more than 143 seconds.
[  237.129547][   T29]       Not tainted syzkaller #0
[  237.137059][   T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  237.152882][   T29] task:kworker/1:3     state:D stack:24920 pid:5764  ppid:2      flags:0x00004000
[  237.165864][   T29] Workqueue: usb_hub_wq hub_event
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  237.171037][   T29] Call Trace:
[  237.175937][   T29]  <TASK>
[  237.179033][   T29]  __schedule+0x15ae/0x4660
[  237.184248][   T29]  ? preempt_schedule_common+0x82/0xc0
[  237.190590][   T29]  ? asan.module_dtor+0x20/0x20
[  237.197675][   T29]  ? preempt_schedule+0xc0/0xd0
[  237.203045][   T29]  ? __lock_acquire+0x7d80/0x7d80
[  237.208258][   T29]  ? kick_pool+0x320/0x420
[  237.219469][   T29]  ? preempt_schedule_thunk+0x1a/0x30
[  237.225617][   T29]  schedule+0xbd/0x170
[  237.229924][   T29]  schedule_timeout+0xc1/0x2d0
[  237.235337][   T29]  ? console_conditional_schedule+0x40/0x40
[  237.250307][   T29]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  237.256789][   T29]  ? __lock_acquire+0x7d80/0x7d80
[  237.268904][   T29]  ? lock_chain_count+0x20/0x20
[  237.301412][   T29]  ? _raw_spin_lock_irq+0xbb/0xf0
[  237.307020][   T29]  ? _raw_spin_lock_irqsave+0x100/0x100
[  237.313149][   T29]  ? _raw_spin_unlock_irq+0x23/0x50
[  237.318530][   T29]  ? lockdep_hardirqs_on+0x98/0x150
[  237.331049][   T29]  ? wait_for_completion+0x273/0x5a0
[  237.336850][   T29]  wait_for_completion+0x2c6/0x5a0
[  237.342571][   T29]  ? io_schedule+0xd0/0xd0
[  237.347157][   T29]  ? _raw_spin_unlock_irq+0x23/0x50
[  237.389625][   T29]  ? __flush_work+0x120/0xac0
[  237.424644][   T29]  __flush_work+0x92f/0xac0
[  237.461531][   T29]  ? __flush_work+0x120/0xac0
[  237.475764][   T29]  ? flush_work+0x20/0x20
[  237.480169][   T29]  ? move_linked_works+0x230/0x230
[  237.508371][   T29]  ? mod_delayed_work_on+0x1c0/0x1c0
[  237.531337][   T29]  ? lock_chain_count+0x20/0x20
[  237.536362][   T29]  ? __cancel_work_timer+0x36e/0x560
[  237.557933][   T29]  __cancel_work_timer+0x3f8/0x560
[  237.563522][   T29]  ? cancel_work_sync+0x20/0x20
[  237.569325][   T29]  ? _raw_spin_unlock_irq+0x23/0x50
[  237.575071][   T29]  ? lockdep_hardirqs_on+0x98/0x150
[  237.580344][   T29]  ? _raw_spin_unlock_irq+0x2e/0x50
[  237.586043][   T29]  ? usb_hcd_flush_endpoint+0x3e5/0x400
[  237.601492][   T29]  ? lockdep_hardirqs_on+0x98/0x150
[  237.606839][   T29]  ? _raw_spin_unlock_irqrestore+0xc5/0x120
[  237.622706][   T29]  mmc_stop_host+0xd9/0x460
[  237.627306][   T29]  mmc_remove_host+0x15/0x60
[  237.639341][   T29]  vub300_disconnect+0x14f/0x2e0
[  237.644448][   T29]  usb_unbind_interface+0x207/0x870
[  237.649764][   T29]  ? kernfs_remove_by_name_ns+0x117/0x150
[  237.657360][   T29]  ? usb_driver_release_interface+0x1c0/0x1c0
[  237.663750][   T29]  device_release_driver_internal+0x458/0x6f0
[  237.670749][   T29]  bus_remove_device+0x43b/0x520
[  237.677418][   T29]  ? bus_probe_device+0x260/0x260
[  237.682858][   T29]  ? up_write+0x1be/0x410
[  237.687288][   T29]  ? kernfs_remove_by_name_ns+0x117/0x150
[  237.693158][   T29]  device_del+0x51f/0x910
[  237.697545][   T29]  ? device_release+0xbc/0x1e0
[  237.703597][   T29]  ? kill_device+0x160/0x160
[  237.708268][   T29]  ? kobject_put+0x421/0x450
[  237.713107][   T29]  usb_disable_device+0x3ee/0x8a0
[  237.718250][   T29]  usb_disconnect+0x340/0x8a0
[  237.723053][   T29]  hub_event+0x1d69/0x4a80
[  237.727566][   T29]  ? hub_post_resume+0x120/0x120
[  237.732959][   T29]  ? read_lock_is_recursive+0x20/0x20
[  237.738453][   T29]  ? _raw_spin_unlock_irq+0x23/0x50
[  237.743907][   T29]  ? process_scheduled_works+0x975/0x1600
[  237.749710][   T29]  ? process_scheduled_works+0x975/0x1600
[  237.756377][   T29]  process_scheduled_works+0xa60/0x1600
[  237.763364][   T29]  ? worker_attach_to_pool+0x370/0x370
[  237.769013][   T29]  ? assign_work+0x3cc/0x5d0
[  237.774661][   T29]  worker_thread+0xa5e/0xfe0
[  237.779405][   T29]  ? _raw_spin_unlock+0x40/0x40
[  237.784362][   T29]  ? __kthread_parkme+0x71/0x1c0
[  237.789381][   T29]  kthread+0x2fa/0x390
[  237.793783][   T29]  ? pr_cont_work+0x550/0x550
[  237.798564][   T29]  ? kthread_blkcg+0xd0/0xd0
[  237.803245][   T29]  ret_from_fork+0x48/0x80
[  237.807720][   T29]  ? kthread_blkcg+0xd0/0xd0
[  237.812443][   T29]  ret_from_fork_asm+0x11/0x20
[  237.817365][   T29]  </TASK>
[  237.820440][   T29] INFO: task kworker/0:5:5818 blocked for more than 144 seconds.
[  237.828243][   T29]       Not tainted syzkaller #0
[  237.833744][   T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  237.842628][   T29] task:kworker/0:5     state:D stack:24616 pid:5818  ppid:2      flags:0x00004000
[  237.852489][   T29] Workqueue: events_freezable mmc_rescan
[  237.858224][   T29] Call Trace:
[  237.861828][   T29]  <TASK>
[  237.864841][   T29]  __schedule+0x15ae/0x4660
[  237.869447][   T29]  ? mark_lock+0x94/0x320
[  237.874307][   T29]  ? asan.module_dtor+0x20/0x20
[  237.880391][   T29]  ? __lock_acquire+0x7d80/0x7d80
[  237.885781][   T29]  ? kick_pool+0x320/0x420
[  237.890241][   T29]  ? _raw_spin_unlock_irq+0x23/0x50
[  237.895640][   T29]  ? lockdep_hardirqs_on+0x98/0x150
[  237.900885][   T29]  schedule+0xbd/0x170
[  237.906057][   T29]  schedule_timeout+0xc1/0x2d0
[  237.910898][   T29]  ? console_conditional_schedule+0x40/0x40
[  237.916974][   T29]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  237.923159][   T29]  ? __lock_acquire+0x7d80/0x7d80
[  237.928238][   T29]  ? lock_chain_count+0x20/0x20
[  237.933194][   T29]  ? _raw_spin_lock_irq+0xbb/0xf0
[  237.938269][   T29]  ? _raw_spin_lock_irqsave+0x100/0x100
[  237.944036][   T29]  ? _raw_spin_unlock_irq+0x23/0x50
[  237.949293][   T29]  ? lockdep_hardirqs_on+0x98/0x150
[  237.954868][   T29]  ? wait_for_completion+0x273/0x5a0
[  237.960199][   T29]  wait_for_completion+0x2c6/0x5a0
[  237.966593][   T29]  ? io_schedule+0xd0/0xd0
[  237.971091][   T29]  ? vub300_mmc_request+0xffd/0x1900
[  237.976728][   T29]  mmc_wait_for_req_done+0x37/0x460
[  237.984729][   T29]  ? mmc_start_request+0x15d/0x1d0
[  237.989899][   T29]  ? mmc_wait_for_req+0x1b0/0x230
[  237.991753][ T5783] Bluetooth: hci4: command tx timeout
[  237.997196][   T29]  mmc_wait_for_cmd+0x178/0x280
[  238.006338][   T29]  ? mmc_cqe_post_req+0x90/0x90
[  238.017473][   T29]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  238.023712][   T29]  ? trace_raw_output_mmc_request_done+0xcf0/0xcf0
[  238.030261][   T29]  ? _raw_spin_unlock+0x40/0x40
[  238.036208][   T29]  sdio_reset+0xf8/0x3c0
[  238.040543][   T29]  ? mmc_io_rw_extended+0x9d0/0x9d0
[  238.048438][   T29]  ? __mmc_claim_host+0x163/0x620
[  238.053577][   T29]  ? mmc_set_data_timeout+0x8a0/0x8a0
[  238.059002][   T29]  ? mmc_power_up+0x5d/0x610
[  238.064194][   T29]  mmc_rescan+0x69b/0xfb0
[  238.068590][   T29]  ? process_scheduled_works+0x975/0x1600
[  238.077972][   T29]  process_scheduled_works+0xa60/0x1600
[  238.084968][   T29]  ? worker_attach_to_pool+0x370/0x370
[  238.090481][   T29]  ? assign_work+0x3cc/0x5d0
[  238.095471][   T29]  worker_thread+0xa5e/0xfe0
[  238.100131][   T29]  ? _raw_spin_unlock+0x40/0x40
[  238.110203][   T29]  ? __kthread_parkme+0x71/0x1c0
[  238.116345][   T29]  kthread+0x2fa/0x390
[  238.120443][   T29]  ? pr_cont_work+0x550/0x550
[  238.125420][   T29]  ? kthread_blkcg+0xd0/0xd0
[  238.130045][   T29]  ret_from_fork+0x48/0x80
[  238.134628][   T29]  ? kthread_blkcg+0xd0/0xd0
[  238.139261][   T29]  ret_from_fork_asm+0x11/0x20
[  238.144266][   T29]  </TASK>
[  238.158664][   T29] 
[  238.158664][   T29] Showing all locks held in the system:
[  238.190000][   T29] 5 locks held by kworker/u4:1/12:
[  238.196633][   T29]  #0: ffff8880b8f3c258 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130
[  238.206761][   T29]  #1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660
[  238.216170][   T29]  #2: ffff888021600768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x35/0x260
[  238.226942][   T29]  #3: ffffffff974ce740 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x6c/0x500
[  238.237522][   T29]  #4: ffffffff974d3de0 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_check_no_obj_freed+0x9e/0x520
[  238.248290][   T29] 1 lock held by khungtaskd/29:
[  238.253513][   T29]  #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290
[  238.263604][   T29] 2 locks held by kworker/u4:3/49:
[  238.268747][   T29]  #0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.280331][   T29]  #1: ffffc90000b9fd00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.294161][   T29] 5 locks held by kworker/u4:4/59:
[  238.299322][   T29]  #0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.310373][   T29]  #1: ffffc900015a7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.328375][   T29]  #2: ffffffff8e3ca510 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0
[  238.340122][   T29]  #3: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xf2/0xa00
[  238.350347][   T29]  #4: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880
[  238.361531][   T29] 2 locks held by kworker/u4:5/170:
[  238.366787][   T29]  #0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.379137][   T29]  #1: ffffc90002ea7d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.392170][   T29] 2 locks held by kworker/0:2/1192:
[  238.397412][   T29]  #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.409964][   T29]  #1: ffffc9000484fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.422178][   T29] 3 locks held by kworker/u4:9/3521:
[  238.427526][   T29]  #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.439429][   T29]  #1: ffffc9000cc27d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.453761][   T29]  #2: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60
[  238.463081][   T29] 2 locks held by kworker/u4:10/3542:
[  238.468630][   T29]  #0: ffff88814007ad38 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.482557][   T29]  #1: ffffc9000cc57d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.495994][   T29] 1 lock held by dhcpcd/5436:
[  238.500714][   T29]  #0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2fc/0x1d70
[  238.510072][   T29] 2 locks held by getty/5533:
[  238.515605][   T29]  #0: ffff88814cb950a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[  238.525638][   T29]  #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370
[  238.535864][   T29] 5 locks held by kworker/1:3/5764:
[  238.541386][   T29]  #0: ffff888019ab4538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.553343][   T29]  #1: ffffc9000471fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.565437][   T29]  #2: ffff88802515f1d8 (&dev->mutex){....}-{3:3}, at: hub_event+0x188/0x4a80
[  238.574635][   T29]  #3: ffff88807defc1d8 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0xfc/0x8a0
[  238.584038][   T29]  #4: ffff88807ad2b1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa7/0x6f0
[  238.595851][   T29] 3 locks held by kworker/1:4/5817:
[  238.601080][   T29]  #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.612750][   T29]  #1: ffffc90004aafd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.624623][   T29]  #2: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20
[  238.638288][   T29] 2 locks held by kworker/0:5/5818:
[  238.644199][   T29]  #0: ffff888017c72138 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.656374][   T29]  #1: ffffc90004f07d00 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600
[  238.669498][   T29] 3 locks held by syz.3.379/7092:
[  238.674860][   T29]  #0: ffff8880217afc48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330
[  238.684504][   T29]  #1: ffffffff8dce3548 (usb_bus_idr_lock){+.+.}-{3:3}, at: usb_device_read+0xe8/0x2c0
[  238.696159][   T29]  #2: ffff88802515f1d8 (&dev->mutex){....}-{3:3}, at: usb_device_read+0x17d/0x2c0
[  238.712860][   T29] 7 locks held by syz-executor/9072:
[  238.718190][   T29]  #0: ffff888031af8418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0
[  238.728535][   T29]  #1: ffff88805c69b888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520
[  238.738826][   T29]  #2: ffff8880247562f0 (kn->active#54){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520
[  238.749141][   T29]  #3: ffffffff8dcb7648 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: new_device_store+0x13d/0x690
[  238.759662][   T29]  #4: ffff88801c374130 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420
[  238.769471][   T29]  #5: ffff888023e5b250 (&devlink->lock_key#9){+.+.}-{3:3}, at: nsim_drv_probe+0xc8/0xb90
[  238.779564][   T29]  #6: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: nsim_create+0x378/0x4a0
[  238.788840][   T29] 2 locks held by syz.4.977/9074:
[  238.794179][   T29]  #0: ffff88802cdf4870 (&usblp->wmut){+.+.}-{3:3}, at: usblp_write+0x5c/0x900
[  238.809985][   T29]  #1: ffff88802cdf4900 (&usblp->mut){+.+.}-{3:3}, at: usblp_wwait+0x3be/0x9b0
[  238.819208][   T29] 1 lock held by syz.0.994/9132:
[  238.824823][   T29]  #0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x3f7/0x2070
[  238.834314][   T29] 1 lock held by syz.0.994/9136:
[  238.839289][   T29]  #0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x3f7/0x2070
[  238.849096][   T29] 1 lock held by syz.7.986/9135:
[  238.854193][   T29]  #0: ffffffff8e3d7548 (rtnl_mutex){+.+.}-{3:3}, at: wext_ioctl_dispatch+0x106/0x650
[  238.876592][   T29] 
[  238.878966][   T29] =============================================
[  238.878966][   T29] 
[  238.888441][   T29] NMI backtrace for cpu 0
[  238.892813][   T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
[  238.900041][   T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  238.910212][   T29] Call Trace:
[  238.913526][   T29]  <TASK>
[  238.916493][   T29]  dump_stack_lvl+0x18c/0x250
[  238.921218][   T29]  ? __wake_up_klogd+0xd9/0x100
[  238.926111][   T29]  ? show_regs_print_info+0x20/0x20
[  238.931354][   T29]  ? load_image+0x420/0x420
[  238.935903][   T29]  nmi_cpu_backtrace+0x3a6/0x3e0
[  238.940875][   T29]  ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0
[  238.947063][   T29]  ? load_image+0x420/0x420
[  238.951597][   T29]  ? wq_watchdog_touch+0xef/0x170
[  238.956666][   T29]  ? arch_trigger_cpumask_backtrace+0x10/0x10
[  238.962795][   T29]  nmi_trigger_cpumask_backtrace+0x17a/0x2f0
[  238.968816][   T29]  watchdog+0xf59/0xfa0
[  238.973014][   T29]  ? watchdog+0x1e1/0xfa0
[  238.977403][   T29]  kthread+0x2fa/0x390
[  238.981513][   T29]  ? hungtask_pm_notify+0x50/0x50
[  238.986580][   T29]  ? kthread_blkcg+0xd0/0xd0
[  238.991202][   T29]  ret_from_fork+0x48/0x80
[  238.995656][   T29]  ? kthread_blkcg+0xd0/0xd0
[  239.000273][   T29]  ret_from_fork_asm+0x11/0x20
[  239.005086][   T29]  </TASK>
[  239.009548][   T29] Sending NMI from CPU 0 to CPUs 1:
[  239.015158][    C1] NMI backtrace for cpu 1
[  239.015171][    C1] CPU: 1 PID: 1138 Comm: kworker/u4:7 Not tainted syzkaller #0
[  239.015187][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  239.015196][    C1] Workqueue: events_unbound cfg80211_wiphy_work
[  239.015219][    C1] RIP: 0010:kasan_check_range+0x12/0x290
[  239.015242][    C1] Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b4 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 13 02 00 00 49 89
[  239.015255][    C1] RSP: 0018:ffffc9000466f260 EFLAGS: 00000202
[  239.015267][    C1] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffffffff8a00cc12
[  239.015278][    C1] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88802ee124d2
[  239.015287][    C1] RBP: ffffc9000466f3d0 R08: ffff88801f73a1ae R09: 1ffff11003ee7435
[  239.015299][    C1] R10: dffffc0000000000 R11: ffffed1003ee7436 R12: ffffffff8a00cc12
[  239.015310][    C1] R13: dffffc0000000000 R14: ffff88801f73a1a7 R15: ffff88802ee124d2
[  239.015321][    C1] FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
[  239.015334][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  239.015344][    C1] CR2: 00007ff46a32ae9c CR3: 000000000cf32000 CR4: 00000000003506e0
[  239.015359][    C1] Call Trace:
[  239.015363][    C1]  <TASK>
[  239.015369][    C1]  __asan_memcpy+0x40/0x70
[  239.015392][    C1]  ieee80211_inform_bss+0x512/0xfd0
[  239.015421][    C1]  ? ieee80211_rx_bss_put+0x60/0x60
[  239.015446][    C1]  ? do_raw_spin_lock+0x11f/0x2b0
[  239.015469][    C1]  ? ieee80211_rx_bss_put+0x60/0x60
[  239.015492][    C1]  rdev_inform_bss+0x106/0x410
[  239.015512][    C1]  cfg80211_inform_bss_frame_data+0xb22/0x1330
[  239.015538][    C1]  ? cfg80211_parse_ml_sta_data+0x1a80/0x1a80
[  239.015576][    C1]  ? ieee80211_bss_info_update+0x387/0x9f0
[  239.015600][    C1]  ? ieee80211_bss_info_update+0x387/0x9f0
[  239.015624][    C1]  ieee80211_bss_info_update+0x789/0x9f0
[  239.015650][    C1]  ? ieee80211_inform_bss+0xfd0/0xfd0
[  239.015691][    C1]  ? ieee80211_mandatory_rates+0x1cc/0x230
[  239.015713][    C1]  ieee80211_ibss_rx_queued_mgmt+0x18f5/0x2dc0
[  239.015738][    C1]  ? verify_lock_unused+0x140/0x140
[  239.015761][    C1]  ? ieee80211_ibss_rx_queued_mgmt+0xecc/0x2dc0
[  239.015780][    C1]  ? ieee80211_ibss_rx_no_sta+0x790/0x790
[  239.015819][    C1]  ? mark_lock+0x94/0x320
[  239.015838][    C1]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  239.015856][    C1]  ? __lock_acquire+0x7d80/0x7d80
[  239.015873][    C1]  ? lock_chain_count+0x20/0x20
[  239.015889][    C1]  ? _raw_spin_unlock_irqrestore+0xc5/0x120
[  239.015909][    C1]  ? kcov_remote_start+0x8b/0x810
[  239.015940][    C1]  ? skb_dequeue+0x124/0x160
[  239.015960][    C1]  ieee80211_iface_work+0x730/0xc90
[  239.015983][    C1]  cfg80211_wiphy_work+0x228/0x260
[  239.016001][    C1]  ? process_scheduled_works+0x975/0x1600
[  239.016039][    C1]  process_scheduled_works+0xa60/0x1600
[  239.016073][    C1]  ? worker_attach_to_pool+0x370/0x370
[  239.016095][    C1]  ? assign_work+0x3cc/0x5d0
[  239.016117][    C1]  worker_thread+0xa5e/0xfe0
[  239.016141][    C1]  ? _raw_spin_unlock+0x40/0x40
[  239.016155][    C1]  ? __kthread_parkme+0x71/0x1c0
[  239.016174][    C1]  kthread+0x2fa/0x390
[  239.016188][    C1]  ? pr_cont_work+0x550/0x550
[  239.016207][    C1]  ? kthread_blkcg+0xd0/0xd0
[  239.016223][    C1]  ret_from_fork+0x48/0x80
[  239.016242][    C1]  ? kthread_blkcg+0xd0/0xd0
[  239.016257][    C1]  ret_from_fork_asm+0x11/0x20
[  239.016284][    C1]  </TASK>
[  239.379908][   T29] Kernel panic - not syncing: hung_task: blocked tasks
[  239.386814][   T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
[  239.394045][   T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  239.404140][   T29] Call Trace:
[  239.407458][   T29]  <TASK>
[  239.410454][   T29]  dump_stack_lvl+0x18c/0x250
[  239.415188][   T29]  ? show_regs_print_info+0x20/0x20
[  239.420437][   T29]  ? load_image+0x420/0x420
[  239.424990][   T29]  panic+0x2ca/0x720
[  239.428947][   T29]  ? bpf_jit_dump+0xd0/0xd0
[  239.433503][   T29]  ? __irq_work_queue_local+0x13a/0x3b0
[  239.439090][   T29]  ? preempt_schedule_thunk+0x1a/0x30
[  239.444514][   T29]  ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0
[  239.450724][   T29]  watchdog+0xf98/0xfa0
[  239.454951][   T29]  ? watchdog+0x1e1/0xfa0
[  239.459325][   T29]  kthread+0x2fa/0x390
[  239.463441][   T29]  ? hungtask_pm_notify+0x50/0x50
[  239.468500][   T29]  ? kthread_blkcg+0xd0/0xd0
[  239.473110][   T29]  ret_from_fork+0x48/0x80
[  239.477552][   T29]  ? kthread_blkcg+0xd0/0xd0
[  239.482160][   T29]  ret_from_fork_asm+0x11/0x20
[  239.486961][   T29]  </TASK>
[  239.490569][   T29] Kernel Offset: disabled
[  239.494911][   T29] Rebooting in 86400 seconds..