program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) getresgid(&(0x7f0000000240)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000000a00)=0xe8) mount$tmpfs(0x0, &(0x7f00000001c0)='./debug\x00', &(0x7f0000000200), 0x64045, &(0x7f0000000a40)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=r0, @ANYBLOB="2c73693a653fd524302c687567653d6e65768d002c736d61636b67736465663d5b2c657579643e", @ANYRESDEC=r1, @ANYBLOB=',context=staff_u,\x00']) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x8, 0xffffffffffffffff, 0x1}) connect(r2, &(0x7f0000000140)=@llc={0x1a, 0x110, 0x6, 0x1, 0x0, 0xed, @local}, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) r4 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000ac0)=ANY=[@ANYBLOB="120100004898b610c2154500201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000b00)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0) syz_usb_control_io$printer(r5, &(0x7f0000000b40)={0x14, 0x0, &(0x7f0000000b80)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_disconnect(r5) write$char_usb(r6, 0x0, 0x0) write(r3, &(0x7f0000000100)='+p', 0x2) syz_mount_image$ocfs2(&(0x7f0000004740), &(0x7f0000004780)='./debug\x00', 0x100000a, &(0x7f0000000280)=ANY=[@ANYRES64=r3, @ANYRES16=r3], 0x0, 0x4714, &(0x7f00000047c0)="$eJzs212IXFcBB/BzJ6vZpMl2P9ImafoxSQQXLcumT9X6ENeqjabNh7bVVFlnN9vN6uzMujujBYPUIIiCoARBxQ+qQulLLYiBvtQiFPxAWoVSUbS+iBSq4INBG+jKzNybnXtntneyk7S0/f2gnb3n3nPumf3vPXfOPZNCrHZqYaW4sFIsVYrV2ftXbil+rlquL86FwqvktT4/vbkSOcn+tXPkfR/4yD23hPCHY1/70Orq6mpoGA5dHWj7+fy/T8+2vyYKmTqNdru31vLH+iMv/fwtr3REnhMhhB0d/WrYFEL42C9C2BxCGInLRuPXLSGEbSGEKITw6G/+9ePBfrrQ5uy9Lzx37MzhfWemHn/smQvzR9c9MArhu+XdN88vvrh/023Pv+MynR4AAF7RB48fufvo5IHwZBSGzg10fl7fGb8mn4/vfNun7np4YG3/Kr3Z9CqGCgAAABlr8//h6OUu63XJylqyJPjEAyfufipa229i+/p26K4jt79/8kC8/ht17L81Lvrnezc111Cz677Z9d+RTP3u679r53n4q8/+svLWjfc/6V9y3uEQFSZS24XCxEQIx6Za27uirYVydaX2zvur9crJjZ/3jSKdf3b1fm1Bv9f8RzPV89b/d3/i8z/bMtDPOxgL2b/axnax80+ZLtL5rz+W/+RLUU/5j2Xq5eV/x9Pbz/9qc2d57/Flz8ilSOffuhD3tR9QbA0Ajfy/OZCf/45M+3n5f3/q3KMnNvD9n8Y4Mxw1+jqYGgFejsvX+QoTGen8W0Gkrr34F7ne9f+/TP7XZNrPy//O6j9+97c+7v/rjf/jU/20+eaRzr8VRDF1xNr1P1LIv/6vzbSfl/9vT/352U/2da/uzL/R/3H3/56k849vxOnBs/mb7HX835lpPy//XWP3PbSwgX5/eEvcz6EojLV96/Rc4xY2tLZe3ZzSNHYvbeAkbwLp/Fu/tdSlM9R6aV7/w/nj/65M+3n5P7Tn6+853df3f7uP/5PG/56k89/SLLuU/F/K5L87035e/j88/fe/3HeZx//G9kH59ySd/9aO/WvPfwo9zf+uy9TPe/6zb/SpR/7ax/w/6V9y3uT5T/IcYjxqPf+hu3T+V617XK/3/z2ZennX/7f+8/zT+/sZ/6NBTwD6kM5/W6uwywSw1/yvz7Sfl/8X7vnyx/+0gflf8xPfYJJ/2/x/c6v8qPG/J+n8t7cKU/8Y6sHm/5v3/6gz9/9m8r8h035e/hcOTQx85TLf/xv9H+/yKJtO6fyH1j2ukf/ve7j/35ipl5f/F/f+9MWb+/r8H8Kkuf6GpfO/et3jmtf/YH7+N2Xq5eX/nW/8+okH++j/2/uoSzb/1r0+dTnFn817nf8XM+3n5f+j8fNn91+B+d+t7v89SeffWjW/lPyz8/+9mfbz8v/ekR8sD1yB5z93yB8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBDRuPX4RAVJlLbhcLERAhj8fausDWaKZ2cnilXZz+zEsKOuLwYRqP5cnWmVJ5eqFRPzk2XyuXqbAjXxPt3hMFopVytTS+Wlq692NaW6NRcabk2M1eqhRB2xuXXh+1JWzMLtcXSUvPYpM5VUemz9WqtNFFfmVsOuy+Wb0vK55er9aXrLrZ1daG6vHSqVJk+ubD87snJycmw52KfR6K5B2pzlVqrt629jTpJ3eGo7c00d9/Qdr5PV+vLlVK5WX5jW51ydbZUbqtzU9v5asv1ymypNjddrs4n5yu21W17b83de+N942Ek9f6SulkH49fbDx3/6PHDBzr2F6N03pX64tzk9u5/EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8cT1527u+HUIYaG0VQggHkx+i+L+Us/e+8NyxM4f3nZl6/LFnLswf7XYMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP/ZgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqws79vEQRxnEAfmdss8BS6SLkMTBERG8SFvSLSCrXyI5dOgd1SsigKDCM6FgQBEHdooKgU1D5F0QdPHaqLnXoYBBBxehMLjvCllKz7jwPDO87jPPOFwbced/PMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADSPszsWOpL20q7Ni1tXXwjt6bGNIYSRaKn/eW9b6A4hfP0yfTqs0Ga668Z/MzE7lr9q9Lu3f+zh9ZFo9fVn52bX7QpRPFizvzOK48HB1Y/fqu4MPJsaiEKIiy6EQsyPPjlTCSG0FV0Ihfj5ce5i8v99Q9GFUIi+D3c7kvtfKboQCtG5+1NvJX3Go3zOVy8M1P72N3oEX8MjOk3o7ckr72I3tfRepvP/KN3MB9erzpp+41ndzIkj75//03poZjOzk0eLrgEAAPi/zjXI/8PWpf79y1Ho7srn/t/q8v+euvFXzv+X3dt+Y3R6TSHEttzaZLI/tG8tY7a+U/1Xb7+uWO9pCVv+/hT5f7nJ/8tN/l9u8v9yk/+Xm/yfxCv5fyk9vrln4UXRRVAY+T8AAJTPoePjk9Wh4WTyv+lHez6v703bapqnP7g11f+oZt1Ifri+HT42fuDg0HB63/MLgsvff4gXj35P3/eobzMTde9dNPr+Q8/T+blr7fm/qP7h+xtZfdl1ff8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAX+zOsQmDYBCA0f+SJhtkjWSKQJpEwT2cwdIBHMXaGZzDygW0ENHC1kbea+7gg+MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALi+T/4r/q936iLdpojUZ/V335/rUi5jaKp2vG89Dq8+TvsXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZ24EAGAAAAQJi/dR7tBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgpwAAAP//52PLYw==") syz_emit_ethernet(0x5a3, &(0x7f0000000440)={@broadcast, @remote, @void, {@ipv6={0x86dd, @esp={0xc, 0x6, "6d3eae", 0x56d, 0x32, 0x0, @private2, @local, {[@routing={0x73, 0x6, 0x1, 0x6, 0x0, [@mcast2, @empty, @mcast2]}, @dstopts={0x2f, 0xd, '\x00', [@generic={0x6, 0x50, "0478790202b666243e5b9d13436fbac5145dc8c7bdf85727e6f4e28f395f02d027dca9dccc1f4f51fcc140d446dec7b3fe71245794156490f9ab2ac3c8ccba1c02145cd7aac026e8d845539bb2a8092b"}, @ra={0x5, 0x2, 0xa6c2}, @padn={0x1, 0x1, [0x0]}, @pad1, @pad1, @jumbo={0xc2, 0x4, 0x3}, @jumbo={0xc2, 0x4, 0xa}]}, @fragment={0x33, 0x0, 0x79, 0x1, 0x0, 0x18, 0x64}, @srh={0x0, 0x2, 0x4, 0x1, 0x80, 0x30, 0x9, [@ipv4={'\x00', '\xff\xff', @multicast1}]}, @routing={0x8, 0xa, 0x1, 0x3, 0x0, [@loopback, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, @private2]}], {0x4d4, 0x4, @basic={0x0, 0x0, 0x4, [@ipv6=@udp={0x5, 0x6, 'O*>', 0x2c1, 0x11, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4={'\x00', '\xff\xff', @broadcast}, {[@routing={0x33, 0x10, 0x2, 0x7, 0x0, [@mcast1, @local, @private0={0xfc, 0x0, '\x00', 0x1}, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x0, 0x2, 0x2, 0x5, 0x0, [@loopback]}, @srh={0x2f, 0x4, 0x4, 0x2, 0x8, 0x78, 0x2d2, [@loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}, @routing={0x33, 0xe, 0x1, 0x6, 0x0, [@private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private1, @local, @local, @loopback, @empty]}, @routing={0x32, 0x14, 0x1, 0xc, 0x0, [@mcast2, @remote, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, @empty]}], {0x4e22, 0x4e22, 0xd9, 0x0, @opaque="916714389d59aaedd9e7e2267f2aa783af3d1154e219e84b037e92a73592700e6ae4df79c986fba6fa338d77670f166843579d558573f3248c4e950db3832fe6225c452e0389137db02c8529d014f85c8ed37a50defd1b2b77fdd2fec02254fb07b39f763c24d9c75d95bec97aff29c0633b83f0207f1be41a4ba4df081636d6d97beb171457c57099351d1cd57cb08bea2b3505d4187f06c27b7cc1f3f651031886f2f333cdaee15726e82c1cd2fab128a8836d587c883c1d1110fd18f3ec01184718088fe7cf4be94ec8306a3dd726ea"}}}, @ipv4=@igmp={{0x15, 0x4, 0x3, 0x0, 0x117, 0x68, 0x0, 0x6, 0x2, 0x0, @rand_addr=0x64010101, @empty, {[@timestamp_addr={0x44, 0x34, 0xd4, 0x1, 0x8, [{@local, 0x3}, {@multicast2, 0x4}, {@remote, 0x4}, {@broadcast, 0x7}, {@local, 0x7}, {@multicast1, 0xe}]}, @generic={0x86, 0xc, "2144d4b60687f5c51803"}]}}, {0x1f, 0xf, 0x0, @multicast1, "8e8e5e02b3eab06a9194c1e8bb1c5d3162a8eea5427af7b4c939672183cef82b2ab29009000526492a58f065a9e81fade74dbf425f72a494a284ab6161416179de57f555f6b6d82e0d4917e9730c665915db188ba1727920d5b6af0c893792ab1c506f858e780b3682523ebe9e53f8288c39fc628cb8c9f3c67953b5a5c075d9da89d43332515f9308ea5f34932322b4e519b427839f21e024943bdd149f2c4ad8b6225dc83209ae7577d93880f2db54bdcf0752a686901c82ae62"}}, @runt="a80eb707cae443f2ae7b06e650bb8bb4e8162aa51922e5a4d9a028a2f1ff0852b6532a57b16832f5ea999dda6b3ff091c681ce7e7126"]}, '\f', 0x1}}}}}}, 0x0) [ 105.137933][ T5282] Bluetooth: hci0: command tx timeout [ 105.447188][ T935] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 105.595435][ T935] usb 5-1: Using ep0 maxpacket: 16 [ 105.597129][ T935] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 105.599054][ T935] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 105.599079][ T935] usb 5-1: config 0 interface 0 has no altsetting 0 [ 105.601708][ T935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.601723][ T935] usb 5-1: Product: syz [ 105.601731][ T935] usb 5-1: Manufacturer: syz [ 105.601738][ T935] usb 5-1: SerialNumber: syz [ 105.643367][ T935] usb 5-1: config 0 descriptor?? [ 105.881558][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 105.904724][ T935] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input5 [ 105.948990][ T935] imon:send_packet: packet tx failed (-71) [ 105.969146][ T935] imon 5-1:0.0: panel buttons/knobs setup failed [ 106.025613][ T935] rc_core: IR keymap rc-imon-pad not found [ 106.025630][ T935] Registered IR keymap rc-empty [ 106.025686][ T935] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 106.025696][ T935] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 106.026766][ T935] imon:send_packet: packet tx failed (-71) [ 106.053506][ T935] imon 5-1:0.0: remote input dev register failed [ 106.054468][ T935] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 106.113047][ T935] imon 5-1:0.0: unable to initialize intf0, err 0 [ 106.113064][ T935] imon:imon_probe: failed to initialize context! [ 106.113071][ T935] imon 5-1:0.0: unable to register, err -19 [ 106.134480][ T935] usb 5-1: USB disconnect, device number 2 [ 106.505358][ T935] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 106.657221][ T935] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 106.658407][ T935] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 106.658429][ T935] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 106.658442][ T935] usb 5-1: config 0 interface 0 has no altsetting 0 [ 106.662328][ T935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.662345][ T935] usb 5-1: Product: syz [ 106.662353][ T935] usb 5-1: Manufacturer: syz [ 106.662360][ T935] usb 5-1: SerialNumber: syz [ 106.695713][ T935] usb 5-1: config 0 descriptor?? [ 106.699406][ T5334] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 106.904033][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 106.909930][ T935] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input7 [ 107.185214][ T935] rc_core: IR keymap rc-imon-pad not found [ 107.185230][ T935] Registered IR keymap rc-empty [ 107.185292][ T935] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 107.185302][ T935] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 107.215191][ T5282] Bluetooth: hci0: command tx timeout [ 107.317709][ T935] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 107.319846][ T935] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input8 [ 107.338299][ T935] imon 5-1:0.0: iMON device (15c2:0045, intf0) on usb<5:3> initialized [ 107.509533][ T935] usb 5-1: USB disconnect, device number 3 [ 108.318966][ T5335] loop0: detected capacity change from 0 to 32768 [ 108.333931][ T5335] ocfs2: Unknown parameter '' [ 108.353862][ T5333] ================================================================== [ 108.353875][ T5333] BUG: KASAN: slab-use-after-free in dev_driver_string+0x35/0xd0 [ 108.354036][ T5333] Read of size 8 at addr ffff88801470b0e0 by task syz.0.0/5333 [ 108.354053][ T5333] [ 108.354069][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 108.354088][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.354095][ T5333] Call Trace: [ 108.354142][ T5333] [ 108.354260][ T5333] dump_stack_lvl+0xe8/0x150 [ 108.356532][ T5333] print_address_description+0x55/0x1e0 [ 108.356556][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.356569][ T5333] print_report+0x58/0x70 [ 108.356583][ T5333] kasan_report+0x117/0x150 [ 108.356642][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.356656][ T5333] dev_driver_string+0x35/0xd0 [ 108.356669][ T5333] __dynamic_dev_dbg+0x1ae/0x2e0 [ 108.356724][ T5333] ? __mutex_lock+0x30b/0x1550 [ 108.356852][ T5333] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 108.356865][ T5333] ? __pfx_ima_file_free+0x10/0x10 [ 108.356906][ T5333] ? __asan_memset+0x22/0x50 [ 108.356922][ T5333] ? __fsnotify_parent+0x267/0x620 [ 108.356934][ T5333] ? display_close+0x4b/0x240 [ 108.357025][ T5333] display_close+0x1f9/0x240 [ 108.357041][ T5333] ? __pfx_display_close+0x10/0x10 [ 108.357055][ T5333] __fput+0x40d/0xa50 [ 108.357071][ T5333] task_work_run+0x1d9/0x270 [ 108.357114][ T5333] ? __pfx_task_work_run+0x10/0x10 [ 108.357129][ T5333] exit_to_user_mode_loop+0x204/0x770 [ 108.357142][ T5333] ? rcu_is_watching+0x16/0xb0 [ 108.357157][ T5333] do_syscall_64+0x328/0x520 [ 108.357170][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.357182][ T5333] ? clear_bhb_loop+0x70/0xc0 [ 108.357195][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.357207][ T5333] RIP: 0033:0x7fa609b9e559 [ 108.357231][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.357237][ T5333] RSP: 002b:00007ffcba91d618 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 108.357257][ T5333] RAX: 0000000000000000 RBX: 00007ffcba91d700 RCX: 00007fa609b9e559 [ 108.357265][ T5333] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 108.357271][ T5333] RBP: 0000000000019a45 R08: 0000000000000001 R09: 0000000000000000 [ 108.357278][ T5333] R10: 00007fa6099ff030 R11: 0000000000000246 R12: 00007ffcba91d740 [ 108.357284][ T5333] R13: 00007fa609e25fac R14: 000000000001a6ce R15: 00007fa609e25fa0 [ 108.357295][ T5333] [ 108.357300][ T5333] [ 108.357303][ T5333] Allocated by task 935: [ 108.357319][ T5333] kasan_save_track+0x3e/0x80 [ 108.357330][ T5333] __kasan_kmalloc+0x93/0xb0 [ 108.357339][ T5333] __kmalloc_cache_noprof+0x321/0x600 [ 108.357348][ T5333] usb_set_configuration+0x3c5/0x2260 [ 108.357386][ T5333] usb_generic_driver_probe+0x8d/0x150 [ 108.357398][ T5333] usb_probe_device+0x1c3/0x3b0 [ 108.357411][ T5333] really_probe+0x254/0xae0 [ 108.357424][ T5333] __driver_probe_device+0x1e8/0x360 [ 108.357435][ T5333] driver_probe_device+0x4f/0x240 [ 108.357447][ T5333] __device_attach_driver+0x270/0x410 [ 108.357459][ T5333] bus_for_each_drv+0x258/0x2f0 [ 108.357467][ T5333] __device_attach+0x2c4/0x450 [ 108.357485][ T5333] device_initial_probe+0xa1/0xd0 [ 108.357496][ T5333] bus_probe_device+0x12a/0x220 [ 108.357505][ T5333] device_add+0x7d7/0xb80 [ 108.357515][ T5333] usb_new_device+0x9aa/0x1690 [ 108.357524][ T5333] hub_event+0x28e8/0x4d30 [ 108.357535][ T5333] process_scheduled_works+0xc3d/0x1630 [ 108.357547][ T5333] worker_thread+0xa47/0xfb0 [ 108.357559][ T5333] kthread+0x38b/0x480 [ 108.357568][ T5333] ret_from_fork+0x514/0xb70 [ 108.357578][ T5333] ret_from_fork_asm+0x1a/0x30 [ 108.357587][ T5333] [ 108.357589][ T5333] Freed by task 935: [ 108.357594][ T5333] kasan_save_track+0x3e/0x80 [ 108.357603][ T5333] kasan_save_free_info+0x40/0x50 [ 108.357615][ T5333] __kasan_slab_free+0x5c/0x80 [ 108.357623][ T5333] kfree+0x1c5/0x650 [ 108.357634][ T5333] device_release+0xc4/0x1f0 [ 108.357647][ T5333] kobject_put+0x222/0x550 [ 108.357659][ T5333] usb_disable_device+0x611/0x8d0 [ 108.357670][ T5333] usb_disconnect+0x346/0x9a0 [ 108.357680][ T5333] hub_event+0x1bbb/0x4d30 [ 108.357691][ T5333] process_scheduled_works+0xc3d/0x1630 [ 108.357702][ T5333] worker_thread+0xa47/0xfb0 [ 108.357714][ T5333] kthread+0x38b/0x480 [ 108.357723][ T5333] ret_from_fork+0x514/0xb70 [ 108.357732][ T5333] ret_from_fork_asm+0x1a/0x30 [ 108.357740][ T5333] [ 108.357743][ T5333] The buggy address belongs to the object at ffff88801470b000 [ 108.357743][ T5333] which belongs to the cache kmalloc-2k of size 2048 [ 108.357752][ T5333] The buggy address is located 224 bytes inside of [ 108.357752][ T5333] freed 2048-byte region [ffff88801470b000, ffff88801470b800) [ 108.357763][ T5333] [ 108.357766][ T5333] The buggy address belongs to the physical page: [ 108.357772][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14708 [ 108.357783][ T5333] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 108.357791][ T5333] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 108.357801][ T5333] page_type: f5(slab) [ 108.357811][ T5333] raw: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122 [ 108.357820][ T5333] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 108.357829][ T5333] head: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122 [ 108.357838][ T5333] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 108.357846][ T5333] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 108.357854][ T5333] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 108.357859][ T5333] page dumped because: kasan: bad access detected [ 108.357864][ T5333] page_owner tracks the page as allocated [ 108.357869][ T5333] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5281, tgid 5281 (syz-executor), ts 101202836695 [ 108.357885][ T5333] post_alloc_hook+0x1f9/0x250 [ 108.357900][ T5333] get_page_from_freelist+0x2209/0x2280 [ 108.357911][ T5333] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 108.357921][ T5333] allocate_slab+0x7d/0x620 [ 108.357933][ T5333] refill_objects+0x2d5/0x350 [ 108.357944][ T5333] __pcs_replace_empty_main+0x2c8/0x6c0 [ 108.357956][ T5333] __kmalloc_cache_noprof+0x39b/0x600 [ 108.357964][ T5333] rtnl_newlink+0x143/0x1c30 [ 108.358000][ T5333] rtnetlink_rcv_msg+0x802/0xc00 [ 108.358013][ T5333] netlink_rcv_skb+0x226/0x4a0 [ 108.358023][ T5333] netlink_unicast+0x8ef/0xa80 [ 108.358033][ T5333] netlink_sendmsg+0x813/0xb40 [ 108.358043][ T5333] sock_sendmsg_nosec+0x13a/0x180 [ 108.358075][ T5333] __sys_sendto+0x408/0x5a0 [ 108.358087][ T5333] __x64_sys_sendto+0xde/0x100 [ 108.358099][ T5333] do_syscall_64+0x166/0x520 [ 108.358110][ T5333] page last free pid 4696 tgid 4696 ts 37112396834 stack trace: [ 108.358147][ T5333] __free_frozen_pages+0xc93/0xd90 [ 108.358160][ T5333] __slab_free+0x274/0x2c0 [ 108.358168][ T5333] qlist_free_all+0x99/0x100 [ 108.358177][ T5333] kasan_quarantine_reduce+0x148/0x160 [ 108.358185][ T5333] __kasan_slab_alloc+0x22/0x80 [ 108.358195][ T5333] kmem_cache_alloc_node_noprof+0x354/0x610 [ 108.358210][ T5333] __alloc_skb+0x1db/0x7a0 [ 108.358222][ T5333] netlink_sendmsg+0x5d4/0xb40 [ 108.358232][ T5333] sock_sendmsg_nosec+0x13a/0x180 [ 108.358243][ T5333] ____sys_sendmsg+0x54e/0x850 [ 108.358257][ T5333] ___sys_sendmsg+0x2a5/0x360 [ 108.358271][ T5333] __x64_sys_sendmsg+0x1b1/0x290 [ 108.358285][ T5333] do_syscall_64+0x166/0x520 [ 108.358294][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.358305][ T5333] [ 108.358307][ T5333] Memory state around the buggy address: [ 108.358313][ T5333] ffff88801470af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.358320][ T5333] ffff88801470b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.358327][ T5333] >ffff88801470b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.358332][ T5333] ^ [ 108.358338][ T5333] ffff88801470b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.358345][ T5333] ffff88801470b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.358350][ T5333] ================================================================== [ 108.731856][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 108.734812][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 108.738442][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.742601][ T5333] Call Trace: [ 108.743902][ T5333] [ 108.745090][ T5333] vpanic+0x56d/0xa60 [ 108.746683][ T5333] ? __pfx_vpanic+0x10/0x10 [ 108.748446][ T5333] panic+0xc5/0xd0 [ 108.750022][ T5333] ? __pfx_panic+0x10/0x10 [ 108.751986][ T5333] ? preempt_schedule_thunk+0x16/0x40 [ 108.754269][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.756400][ T5333] ? preempt_schedule_thunk+0x16/0x40 [ 108.758742][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.760897][ T5333] check_panic_on_warn+0x89/0xb0 [ 108.763071][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.765263][ T5333] end_report+0x73/0x170 [ 108.767150][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.769181][ T5333] kasan_report+0x128/0x150 [ 108.770935][ T5333] ? dev_driver_string+0x35/0xd0 [ 108.772941][ T5333] dev_driver_string+0x35/0xd0 [ 108.775073][ T5333] __dynamic_dev_dbg+0x1ae/0x2e0 [ 108.777198][ T5333] ? __mutex_lock+0x30b/0x1550 [ 108.779269][ T5333] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 108.781528][ T5333] ? __pfx_ima_file_free+0x10/0x10 [ 108.783682][ T5333] ? __asan_memset+0x22/0x50 [ 108.785675][ T5333] ? __fsnotify_parent+0x267/0x620 [ 108.787836][ T5333] ? display_close+0x4b/0x240 [ 108.789866][ T5333] display_close+0x1f9/0x240 [ 108.791878][ T5333] ? __pfx_display_close+0x10/0x10 [ 108.794014][ T5333] __fput+0x40d/0xa50 [ 108.795713][ T5333] task_work_run+0x1d9/0x270 [ 108.797627][ T5333] ? __pfx_task_work_run+0x10/0x10 [ 108.799825][ T5333] exit_to_user_mode_loop+0x204/0x770 [ 108.802141][ T5333] ? rcu_is_watching+0x16/0xb0 [ 108.804177][ T5333] do_syscall_64+0x328/0x520 [ 108.806208][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.808769][ T5333] ? clear_bhb_loop+0x70/0xc0 [ 108.810860][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.813423][ T5333] RIP: 0033:0x7fa609b9e559 [ 108.815384][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.822772][ T5333] RSP: 002b:00007ffcba91d618 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 108.825927][ T5333] RAX: 0000000000000000 RBX: 00007ffcba91d700 RCX: 00007fa609b9e559 [ 108.828786][ T5333] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 108.832102][ T5333] RBP: 0000000000019a45 R08: 0000000000000001 R09: 0000000000000000 [ 108.835399][ T5333] R10: 00007fa6099ff030 R11: 0000000000000246 R12: 00007ffcba91d740 [ 108.838638][ T5333] R13: 00007fa609e25fac R14: 000000000001a6ce R15: 00007fa609e25fa0 [ 108.841736][ T5333] [ 108.843452][ T5333] Kernel Offset: disabled [ 108.845220][ T5333] Rebooting in 86400 seconds..