last executing test programs: 8m16.165149086s ago: executing program 2 (id=12): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"}) r3 = syz_open_pts(r2, 0x141601) write(r3, &(0x7f0000000000)="d5", 0xfffffedf) close_range(r1, 0xffffffffffffffff, 0x0) 8m15.876918063s ago: executing program 2 (id=15): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0xd03, 0xffffffff, 0x76f1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc02, {0x0, 0x0, 0x0, r3, {}, {0x10, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x240408a0}, 0x20004890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05", 0x1, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 8m15.57343762s ago: executing program 2 (id=18): r0 = syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') getdents64(r0, &(0x7f0000000040)=""/48, 0x59) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="ad00"/16, 0x10) recvmsg$unix(r3, &(0x7f0000003980)={0x0, 0x0, &(0x7f0000003880)=[{&(0x7f00000035c0)=""/74, 0x4a}], 0x1}, 0x101) getdents(r0, &(0x7f00000005c0)=""/180, 0xb4) 8m14.033084716s ago: executing program 2 (id=24): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x385a, 0x0, 0x2, 0x115a}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xf000, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x3881, 0x10005009, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x13, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) 8m12.734573037s ago: executing program 2 (id=28): syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f00003b6000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1e64, &(0x7f0000000040)={0x0, 0xc89a, 0xc000, 0x7fff, 0x65}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 8m12.577542711s ago: executing program 2 (id=29): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x20040084) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x4, 0xfff1}}]}}]}, 0x38}}, 0x200c8080) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) 7m57.3313455s ago: executing program 32 (id=29): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x20040084) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x4, 0xfff1}}]}}]}, 0x38}}, 0x200c8080) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) 1m10.514801479s ago: executing program 0 (id=942): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() r0 = getpid() fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$sequencer(0xffffffffffffffff, &(0x7f0000000940)=""/167, 0xa7) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b05003034313230300603551f030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000900)=0x61) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="5c00000002060500000000000000000000000000120003006269746d61703a69702c6d616300000005000400000000000900020073797a3100000000100007800c0001800800014000001c0205000500020000000500010006000000bacd41cbe54a6ea70f11967bf34172a3a1cf5d2e70a51a395bd35e739f6f8daca036d232d3291c96adcb80173764421a0444a2ee03f5524a9be20cae8fdeb0"], 0x5c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(r5, 0x84, 0xd, 0xffffffffffffffff, &(0x7f0000000140)=0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES16=r4], 0x50}}, 0x0) 1m9.534998792s ago: executing program 0 (id=943): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0x1a) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x121a02, 0x0) sendfile(r4, 0xffffffffffffffff, &(0x7f0000002700)=0x23, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) prlimit64(r0, 0xf, 0x0, &(0x7f0000000240)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x1) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000bfd000/0x400000)=nil) syz_kvm_add_vcpu$x86(r6, &(0x7f00000000c0)={0x0, 0x0}) syz_kvm_add_vcpu$x86(r6, &(0x7f0000000540)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1c0) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/kvm/exits\x00', 0x1, 0x0) 1m2.482412829s ago: executing program 0 (id=954): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0xa, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) sendmsg$802154_dgram(r6, &(0x7f00000018c0)={&(0x7f0000000500)={0x24, @short}, 0x14, &(0x7f0000001880)={0x0}}, 0x0) gettimeofday(0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x20000090) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000740), 0x0) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) 1m1.271054497s ago: executing program 0 (id=956): r0 = syz_usb_connect(0x6, 0x371, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_usb_ep_write(r0, 0x9, 0x32, &(0x7f0000000100)="e66374624e9c4cb17eaea87f902e576b49f6e3e8fdba6d923385c877b137a2f79ad7023f7eb632b0beb82d7b4c06d9cf037d") syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = fsopen(&(0x7f0000000140)='vfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) socket$netlink(0x10, 0x3, 0x8000000004) openat$ttyS3(0xffffff9c, 0x0, 0x208801, 0x0) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffffff, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), 0xffffffffffffffff) write(r3, &(0x7f00000000c0)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r4, &(0x7f00000001c0)='1', 0x1) 57.361088419s ago: executing program 0 (id=962): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000140)={0x1d, r7, 0x3, {0x0, 0xff, 0x3}, 0xfd}, 0x18) write$P9_RSTATu(r4, &(0x7f0000000700)=ANY=[@ANYBLOB="930200007d00000005f0000000000000000000000000000000000000000000000000000000000000000000000000000000001f00206e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f700000000187b8200b500003b595fcb14034354b9fd9ef1d67ae52c842ec898c8f37c1047a196a51cd5157adc8106b494e11200cfc2001000000000000000000000f313f6005500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8d489da649a37002c016f6465762d6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000db6d7f41e36e28a7374d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d0d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1", @ANYRES32=0x0, @ANYRES32=0x0], 0x232) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4004055}, 0x2000c044) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x20040054) 56.204536336s ago: executing program 0 (id=963): bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendto(r2, &(0x7f0000000180)='%', 0x300000, 0x840, 0x0, 0x60) 40.922099716s ago: executing program 33 (id=963): bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendto(r2, &(0x7f0000000180)='%', 0x300000, 0x840, 0x0, 0x60) 17.446886459s ago: executing program 1 (id=1001): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x80000000000002, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, 0x0, 0x0) bind$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, '\x00', 0x18}, 0x1}, 0x1c, &(0x7f00000004c0)=[{0x0}, {&(0x7f0000000440)}, {&(0x7f0000000480)="0c7d18b0d81b997e4fee", 0xa}], 0x3}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000240)={0x0, 0x0, 0xc48f}, 0x7) capset(&(0x7f0000000180)={0x20080522}, &(0x7f0000000100)={0x200000, 0x200000, 0x1000002, 0x0, 0xd33, 0xd26d}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$stdev(r5, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r6, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000a40)={0x48, 0x7, r7, 0x0, 0x0, 0x0, 0x0, 0x1000}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000b80)={0x48, 0x6, r7, 0x0, r8}) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) 15.868587106s ago: executing program 1 (id=1004): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20b02, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x841fa2e66efa8cfe) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r4, 0x0, 0x6, &(0x7f0000000380)='\a', 0x1) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r4, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r4, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r4, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=""/29, 0x1d}, 0xfffffffa}], 0x1, 0x12141, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000400)={0xfffffff8, {{0xa, 0x4e21, 0x9, @mcast1, 0x8}}, 0x0, 0x5, [{{0xa, 0x4e21, 0x1, @mcast2, 0x1}}, {{0xa, 0x4e23, 0xd, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x5}}, {{0xa, 0x4e22, 0x5, @loopback, 0x80000000}}, {{0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00', 0x7}}, {{0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x41}, 0x100}}]}, 0x310) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2181) 13.292242167s ago: executing program 4 (id=1008): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x14, 0x10, 0x0, 0xfd, 0x0, 0x0, 0x6, 0x20002200}, [@RTA_TABLE={0x8, 0xf, 0x7fe}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) fsopen(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./tracing/events/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000800)='0', 0x1) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100)) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff3, 0xfff3}, {0x0, 0xfff3}, {0x1, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xe5e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041090}, 0x80) r8 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r8) r9 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsmount(r9, 0x1, 0x1) 12.182148143s ago: executing program 4 (id=1009): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setpriority(0x1, 0xffffffffffffffff, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) creat(&(0x7f0000000080)='./bus\x00', 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x80800) r1 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_int(r1, 0x29, 0x43, &(0x7f0000000540)=0x2, 0x4) bind$inet6(r1, &(0x7f0000000580)={0xa, 0x4e20, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}, 0x1c) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000000000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x400, &(0x7f00000001c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp12500xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) listen(0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8fc, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc.0', 0xb) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x5, &(0x7f0000000000)=@framed={{0x6, 0x0, 0x0, 0x500, 0x0, 0x71, 0x11, 0x24}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x288, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1f0, 0xffffff7a, 0xffffffff, 0x1f0, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x130, 0x150, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "007f0100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x80, 0x3, {0x4}}}]}, @common=@unspec=@NFQUEUE3={0x20, 'NFQUEUE\x00', 0x3, {0x9, 0x38, 0x1d}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x0, 0xff000000, 'team_slave_0\x00', 'ip6gre0\x00', {0xff}, {}, 0x6, 0x3}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x0, 0x4}, {0x4, 0x5, 0x6}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e8) syz_open_dev$evdev(&(0x7f0000000000), 0x8c, 0x200) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x6, 0x2, 0x0, &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x90}, 0x94) unlink(&(0x7f0000000300)='./config\x00') 8.853150281s ago: executing program 1 (id=1011): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x401, 0x0, 0x25dfdbff, {0x1, 0x0, 0x0, 0x1, {0x0, 0x1}, {0x1, 0xffff}}}, 0x24}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000002500000080000000000000bd1fbe5cf9b1d4faa6b2ba26ee74d636b99aad6b79956c4be9bbbd5f76f322efa78b51b7f76fc42acb5cbf4e", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r1, &(0x7f0000000040)="03c01707c3aeb47d75731af790f08487d29c38429bb24408057f21baa9abcf4b48477a15e1669fa3665763d8c8294dc805853991cafb859f1a45a3a2ccf61fad430da3d1ee67656ac73b107564bd1cc8d6820a4a00f77b8a0264e26c602a829d1f2d3d83789e77fed731", &(0x7f0000000200)=@buf="e6848ce4dad251375a0406efd6857ed6893bc6cf774e42f6c8e142ed4d3ed010891aefabd702b15f48e09384195025bdf0dde571070b0c35df32760f509e863708235936ba92490c34892c3e37c60c3a69475f3caf02d2a37d07661a7d7c826750aad974d7a77ee1aa93bd67ad1ac304d936ed73a3d97671152a7e90c62c3409d05dc228e225f3e9c87e421e2d0a3bc9325560ea8f748e4868b2db1bfa62b965d1db396150"}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000200000000000000fcffffff18110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000f0ffff940000000000478dc94c4a31e224cf379fe2e1200000bf910000000000009702000000000000850000008403000000000000000000009500000000000000fbe841c4ea4d326de0c55569874666be553be7742095a497bf6586bc6435d5d1ade62b5846ad5eeb456d76d2477eb6b4b678bc17d63de11998c294e0a7d011774cea6b8d4e37727a279a96f53295be3b5865820e49f73b940c2424a87026f6f94c3354b8410b4f12cf2bbb7d3ae6d87c241875e309f752893f9de781edfc185c7383850c7f511c62af455458fd59de137baf060a6660c71a1a389b8487053c7c79d8c468c063c2f80bc17066c6f015006f94852d2b3c1dfb0500bf4410c8294bcb61d481c5a91a015386bfb912d26c4315b4c77014046007a1a97d985e83853f239a59cc18537f932989a018d124b761041f429d0ebda6d8bdade4c7fc381424cc270991347837093cba6e221e17a74caf5306c80c517de6aff84b"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900014000000003140000001100010000000000000000000000000a00"/100], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x400) r8 = dup3(r7, r6, 0x80000) openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) read$FUSE(r8, 0x0, 0x0) r9 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) close_range(r9, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r10, 0x4b66, &(0x7f0000000040)={0x0, 0x0}) 8.244694766s ago: executing program 4 (id=1012): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0xa, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) sendmsg$802154_dgram(r6, &(0x7f00000018c0)={&(0x7f0000000500)={0x24, @short}, 0x14, &(0x7f0000001880)={0x0}}, 0x0) gettimeofday(0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x20000090) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000740), 0x0) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) 8.190384867s ago: executing program 3 (id=1013): r0 = socket$netlink(0x10, 0x3, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), r0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x6, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fchdir(0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, 0x0, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(r4, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0xc) vmsplice(r3, &(0x7f0000000200)=[{&(0x7f0000001740)}], 0x1, 0x6) 6.436860338s ago: executing program 4 (id=1014): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000380)=@generic={0x0, 0x0, 0x4}, 0x14) socket$unix(0x1, 0x2, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001700)=0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) acct(&(0x7f0000000040)='./file0\x00') 6.273544632s ago: executing program 1 (id=1015): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x3e000, 0x1000}, 0x20) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000002d40)=0x1, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_ublk_setup_io_uring(0x155a, &(0x7f0000000500)={0x0, 0xa355, 0x10000, 0x2, 0x15a}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x144, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@broadcast, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d6, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x8}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x350759, 0x6eb0}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r12 = dup(r10) syz_ublk_setup_queues(r12, r9, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x6, 0x15e, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000004, 0x142, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x2000, 0x20003, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8256, 0x2, 0x3, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x8, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r8, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_RX_RING(r12, 0x11b, 0x2, &(0x7f0000000080)=0x800, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r2, &(0x7f00000003c0)={0x2c, 0x18, r13}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)={0xa002803f}) 6.090520726s ago: executing program 3 (id=1016): r0 = socket$packet(0x11, 0x2, 0x300) openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, &(0x7f0000000000)=0x1, 0x4) syz_mount_image$msdos(&(0x7f00000000c0), &(0x7f00000001c0)='./file1\x00', 0x800082, &(0x7f0000000680)=ANY=[@ANYBLOB="756d61736b3d30303030303030303030303030303030303030333737372c616c6c6f775f7574696d653d30303030303030332c000000000083ec4c0d6e84de0249d09f31ef580c3d00000000"], 0x1, 0x1c5, &(0x7f0000000340)="$eJzs3UFr02AYB/AnXZdVUdhZPAS8eCrqJ6jKBsOAoPSgJ4XpZRPBXaKnfgu/gV/FryM57VZpU1Y2IlNoktX8fqeH95/mfd63kPfU9N39TyfHn88+/vj5PUajJIaTmMR5EvsxiJ2ozOKSpHYUANga5/N5/JpX/uLyZy20BAA07B/PfwDgP+D8B4D+cf4DQP+8fvP2xdM8P3iVZaOIcnZrOVrOimmVHx7lB4+ypf31p8qimO5c5I+rPLuc78btVf6kNk/j4YMqX2TPX+a7y2hYXVFM9+K4ruFJsvE9AAAAAAAAAAAAAAAAAAAAAACAto2zC7Xv9xmP0z/kVXV4lK7Grr7fZxj3hjUTpo0sAwAAAAAAAAAAAAAAAAAAALba2ddvJ+9PTz98ublFuYn7xKDbVdyNTd/5TuPf4N5qhhY36tq5knb7aaVY7PMNaONKce2jY9DogwkAAAAAAAAAAAAAAAAAAHpo/aPfrjsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgO6s//+/uWIxz6DrhQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Gu/AwAA//+a6T6f") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) dup(r1) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1c0) landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x0, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file1/file3\x00', 0x0) setns(0xc9, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000180)=0xd0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x7800) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000000)='./bus\x00', 0xc1000, 0x0, 0x0, 0x0, &(0x7f0000000000)) rmdir(&(0x7f0000000080)='./bus\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x18}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090005000008090002007332000080de00050001000700000009000200797a3100000000050001000717030000797a3100"/66], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x20008010) 4.338639358s ago: executing program 3 (id=1017): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000840)={[{@noblock_validity}, {@resuid={'resuid', 0x3d, 0xee00}}]}, 0x0, 0x49b, &(0x7f0000001800)="$eJzs3MtrXFUcAODf3GTSpM/4qNqHGl9YUJsmfdiFG0XRhYKgi9qFENO01Ka2NBFsKaaK1KUU3ItLwb/AlW5EXQludS+FItk0PsAr9869Jk0ymZl0konO98G059x7Zs7rnjvnnnsnAXStoeyfSsTWiPg5Cyd59F9pkShLNzd7efz32cvjlUjT136r5Ptuzl4eL9OW79taRPYlEclHldizTL5TFy+dGZucnLhQxIenz54fnrp46anTZ8dOTZyaeGf06NFDB0eePjJ6uGEdKk3Uc1tW1t3vn9u766U3rr0yfuzaW99/2VuWdVE92mUohuqW7bF2Z9Zh2xaEK70dLAgt6YmIrLuq+fjfET0x33k74oUPO1o4YE2laZpur7/7Sgr8j1Wi0yUAOqP8or85OxD9a3QdvJHdeLZ2AZTVe6541fb0RlKkqS66vm2n/mL94tiVPz6LvP03dVX7AwDr7+ts/vNkbf5Tvmp7BuOeBem25+vB2daIOyLizoi4KyLujoidEXnaeyPivhbzH1oUXzr/TK6vqmJNyuZ/z0TEXG9E3DL/K2Z/f6eDPUVsWwzEYFQrJ09PThwo2mRfVDedrE5OjKyQxzfP//RJvX1DxdyvfGX5l3PBohzXezfd+p4TY9Njt1freTc+yNcAZ+aWzH/n71xloV0RsbvlTz/+4unz2f9f7K2XonH9V9CG+0zp5xGP1+5tXokV6r/4/uRAse/I6OHh/picODBcHhVL/fDj1Vfr5X9b9W+DrP83F/d26/T/YGXh/dqp1vO4+svHda9pWjj+j5dbsuO/r/J6Hu4rtr03Nj19YSSir/Ly0u2j859Wxsv0N7bujHhkufon+TkuO8ay+u+JiOwgvj8iHoiIB4uyPxQRD0f+EcuZmYuI75579O3V1D9p1LBtkPX/iVv6Pxr0f+uBnjPffrWa+tdk/X8oD+0rtix//usvA/lZodkCtqMNAQAAYKNL8mfgK8n+IjwQSbJ/f8SWfG13czJ5bmr6iZPn3v3zRO1Z+cGoJuVKV209uLYeOlKsDZfx0UXxg8W68ac9A3l888IrdqAjtiwc//mCY238Z37tWf49zfzeBviP8Hst6F7GP3Qv4x+6V3Pjv3gKcWZtywKsr2a//9M1Lgew/pYb/3W/5t9cj8eSgfXi+h+6l/EP3cv4h+5l/ENXup3f9Qs0CMy03Lz9sVKavvYXNU1X+/ZI8kA608F2/qv4MyzNJV678pTPxDdOXC3G3UY5ROsHOndOAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaKd/AgAA//9XstwK") socket(0x10, 0x3, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000580)='`', 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) recvmmsg(r0, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 4.25250636s ago: executing program 4 (id=1018): r0 = userfaultfd(0x80001) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x40eb, 0x0, 0x0, 0x0, &(0x7f0000000080)) socket(0x10, 0x803, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)={0x7ff}) r1 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x200) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffb, 0x6, 0x0, 0x1, 'syz1\x00'}, 0x6, 0x100, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00'}) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000100)=[{{0x3}, {0x3, 0x0, 0x1, 0x1}}, {{0x2, 0x1}, {0x1, 0x1, 0x1}}], 0x10) close(r3) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newtaction={0xb0, 0x30, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{0x9c, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x9, 0x4, 0x8be6, 0x5}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_skbedit={0x48, 0x2, 0x0, 0x0, {{0xc}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x0, 0x6, 0xffffffff, 0x10000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4001}, 0x2400c800) 4.133161003s ago: executing program 1 (id=1019): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() r0 = getpid() fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4) read$sequencer(0xffffffffffffffff, &(0x7f0000000940)=""/167, 0xa7) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mq_notify(0xffffffffffffffff, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b05003034313230300603551f030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000900)=0x61) r4 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r4, 0xc0884123, &(0x7f0000000280)={0x0, "728d0a484585ec93a59baeb6831b8ef110181595fe49bc4ac10b67b1b99eeeaa18e15a525115cc71983456358ceb7e1a6f926168ce0c3c2b0f3513a5f2674185", {0x800000000000004, 0x50000000000}}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, 0x0, 0x884) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="5c00000002060500000000000000000000000000120003006269746d61703a69702c6d616300000005000400000000000900020073797a3100000000100007800c0001800800014000001c0205000500020000000500010006000000bacd41cbe54a6ea70f11967bf34172a3a1cf5d2e70a51a395bd35e739f6f8daca036d232d3291c96adcb80173764421a0444a2ee03f5524a9be20c"], 0x5c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(r8, 0x84, 0xd, 0xffffffffffffffff, &(0x7f0000000140)=0x4) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002000a000000"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES16=r6], 0x50}}, 0x0) 2.280331896s ago: executing program 1 (id=1020): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0xffffffff, 0x0, {{@in=@multicast1=0xe0000002, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0xfffc, 0x0, 0x3, 0xa, 0x0, 0x20}, {0x20000000, 0x7fffffffffffffff, 0x0, 0xffffffffffff0dac, 0x0, 0x14d, 0x0, 0xfffffffffffffffb}, {0x0, 0xfffffffffffffff7, 0x200000000000000}, 0x0, 0x0, 0x0, 0x1, 0x3, 0x2}}, 0xb8}}, 0x2c000010) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8000, 0x0) mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) open(&(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x241, 0x1ff) mkdir(&(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p\x00', 0x1ff) r2 = open(&(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/wWidth\x00', 0x241, 0x1ff) write(r2, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600), 0x0) close(0xffffffffffffffff) r3 = open(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/dwMaxVideoFrameBufferSize\x00', 0x241, 0x1ff) write(r3, &(0x7f00000006c0)='1843', 0x4) close(r3) write(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x2b, 0x1, 0x1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000000)={'ip_vti0\x00', &(0x7f00000046c0)={'gre0\x00', 0x0, 0x78a1, 0x7, 0x180, 0x5, {{0x5, 0x4, 0x0, 0x6, 0x14, 0x65, 0x0, 0x1, 0x4, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x11}}}}}) mkdir(&(0x7f00000007c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x0) symlink(&(0x7f0000000ac0)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x0) ioctl$COMEDI_BUFINFO(r1, 0xc02c640e, &(0x7f00000000c0)={0x300, 0x4, 0x3ff, 0xffffff01, 0x4, 0x2, 0xff}) readv(r0, &(0x7f0000003740)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r5, &(0x7f00000001c0)="703a732f70202e2f66696c65303a301125", 0x11) read$char_usb(r5, &(0x7f0000000200)=""/88, 0x58) 2.253355637s ago: executing program 3 (id=1021): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0xffffffffffffffff, 0x8, &(0x7f0000000100)=0x7) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x101002, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x3, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x800000000000001, 0x2000) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r4 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, &(0x7f0000000180)) syz_emit_ethernet(0x22, &(0x7f0000000380)=ANY=[@ANYBLOB], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40440, 0x100) 569.073387ms ago: executing program 3 (id=1022): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0xa, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) sendmsg$802154_dgram(r6, &(0x7f00000018c0)={&(0x7f0000000500)={0x24, @short}, 0x14, &(0x7f0000001880)={0x0}}, 0x0) gettimeofday(0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x20000090) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000740), 0x0) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) 553.211847ms ago: executing program 4 (id=1029): syz_usb_connect(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000220edf104c05c10687c20102030109022400010000ae0009040000024f69960009050f"], 0x0) 0s ago: executing program 5 (id=975): r0 = inotify_init() openat$autofs(0xffffffffffffff9c, 0x0, 0x40002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x50}}, 0x4008000) syz_mount_image$xfs(&(0x7f0000009700), &(0x7f0000009740)='./file0\x00', 0x4000000, &(0x7f00000000c0)={[{@filestreams}, {@usrquota}, {@noalign}, {@pquota}, {@inode32}, {@discard}, {@prjquota}, {@usrquota}, {@gquota}, {@nolargeio}]}, 0x1, 0x975c, &(0x7f000001c600)="$eJzs/QWcbXWhuP/PgUM3giBSUmKSEqJIhyJKihKCtKSACCgdSqigCCjd3d2d0t3d3R3/14EDKj5wvd/f/V+8Ps/zYmbPjlnz2Z/3Wou9Z83Ze6n5FptrYGDMgfd6//RvXbTbvcstPtpC6528y+Bb9t5x4SeGXjz8eydjzTH0dM6hp3MNDAwMGrqcQe9dNnj2k04eZmDwwJD//taoI408zKgDAyMPPTt0OQMzv3cyyiHv3+6dD8UDnXTIj9vhvY93G23IQoZ8sczyb609MDAw4t99/5BxTftPd1TaUnPOP9/frD5wG2bo1YP+dt27p4Pf+xjlgIGBUfYb+Oj1Y8hth/u77/3fbMjPHHPygSXu/QR+9v+5lppz/gU/5D9kWxx26GUzD9nGP7wNGvvwer7jYms8NnQKBw2duMF/t718Euv9/1NLzTnfQgMfvR0PLDzvpo++8+5+c/A8AwOD5x0YGDzfwMDg+T9pj/qf6RNd+aqqquoTac65ZhjynH2YDz0eGPH9x7X0uPCyN6d7cGBg8MLvPU8cvPz7zwWrqqqqqqqq6t+zOeeaYW54/j/mxz3/n/TMbcbq+X9VVVVVVVXV/50WnHOuGYY81//Q8//xP+75/7OPH33we3/7P8fM733X25/snaiqqqqqqqqqj22+BfH5/6Qf9/z/ipMmvbrn/1VVVVVVVVX/d1r0nXfe2fzvXmdv6MVTv389Pf8/+5G7l/3EBlxVVVVVVVVV/+3efuqMc/72mu8TD3zo9d7fbejvBQYdd961135iA/33aNA//z5ki096TP9fG+I84hGTDgysvcQnPZT6BPo/81r19f+X8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/cR9x/P+D1/8/+4QV338v+M9POcOtZ/ztO9997//BCy/41Jaf0NA/if5Tj/8PrD5oYGCo75irDwwMLDznootPPTAwcMatM0w5xcAH180y5LrZxh723TeIf/+ficw7Fi94i8neOx2yogyM88Eyjnt3+Qu+s/+wgz40iL9rrFMOPni1pV6Z8cOnU330/Rjmg69GO/nx9/8tyzAfutGIH/HN7y///fvyYeehY596yNin2WCtdadZf+NNvrL6WiusuvKqK6896/QzTTfjrLPONNM0q6y+5srTvvf5o+Zs0nc/z/2vzNmoH56zp+b8+zn78H37qDmb9OPn7N0l7nr5iN96f84G/zfnbO6Pn7NJVx/6g8aaY7iB5d+dm0EDA2PNM9zARkPOTDfCwMBY8w697fhDbvuNsYcZGNj5b3d0yFcjfLAODtpiyG2Wmm+xud7bTQ0M/O30b33E+9kPP3Tkcww9nXPo6Vzv/ZgxB/62Kg6e/aSThxkyF/8wHaOONPIwow4MjDz07NDlDMz63snIZ75/u494n/UPDfTdl1nZ4b2PdxttYGBglCFfTLzC2dsOmfr/hfdp/3/6//8/ec0y6IP1cdDQj6G3ec9rzvkX/NvPencahszdsEMvm3mIyf/wW9v/Q/803klHHJj0Y8b7Ma+L8260fq15xrhb/U+9Lg6Nd/yPGe/HvI7vR453yQf3eOy9Rf2PjfdD+7qF3v08x7+yrxv4+H3dsLSAla+a6MP7uu989BD/YXf5/hyN8KEbfdS+bvy9JtliyPLn+Ph93UJDxj7cP+zrhhkYGGvu9/d1Q3Z88w03sPOQM9MPOTP/cAOHDTkzw7tnRho4b8iZr664zporDblggX9eD6Ye9A9/oAnb2Xwf2s4G/d19H/Shv+8c/N7pKAe8/x5OH7HfHDT0bv2X+wpab8f8mPF+zPtP4TwPuWyl40cc93/q/adovCN+/Hg/6v2yP3K8O7189r3/w+P9YDsb7u+ma4F/ZTub9B+3syF3cdi/2zL+1cdhK8Ht3/t6/A+WtuFmj3/wmGK4Dy33v3pMscDHb2djrv6h79t+v4FBHzc38/8rczPhP+2Dtvz7uflXH29NPfl71w/7MXMzwqzLTfX+3Az/35yb+f+7czPHwLD/ODeDB+YdGBiYYuj+Yb5/ZW7G//i5+VfXm5Hh9u99vfIHF82z4xGXvD83H56L/2pu5vvvzs2kH6w3U7x73WTDDAw//MBGK2ywwXrTvff5/bPTv/f547fBef6VuRzzf2YuJxj8UXP5t1V11AevPuC/2Ab/aZ/+/vLn+e/O5cAHczmw+oc3lvp3rd//ucvfXf7u8neXv7v83eUv7iOO/3/w+v+7jznbLkN/uTHc1ZOMt90nPd5PuP/o4/9Dff/h+P92401y9TADH1z3scdn37vNv+Xx2ZnfOxnlkPdv9+HjgzzQjz4+u9+sM2/zv3R89v+p97fVf+H3cO3/3eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/uI+4vj/tO//HcAj0y3y/NADocM9sfXSi3zS4/2E+48+/j/U9x+O/y+y9NZPDDPwwXUfe/z/vds4jv/f/8Z8O/07H/9/f1vt+H/9F+XvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/uI+4vj/HO//HcDRR++xyft/D3DjWDuc8UmP9xPuP/X4f+//7639v7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y1/c0OP/Ax96e8vvt15gcPz//3Yf4b9I/pjFf9H8MYv/YvljFv/F88cs/kvkj1n8l8wfs/j/IH/M4r9U/pjF/4f5Yxb/H+WPWfyXzh+z+C+TP2bxXzZ/zOK/XP6Yxf/H+WMW/+Xzxyz+K+SPWfx/kj9m8V8xf8ziv1L+mMV/5fwxi/8q+WMW/1Xzxyz+q+WPWfxXzx+z+P80f8ziv0b+mMV/zfwxi/9a+WMW/7Xzxyz+6+SPWfzXzR+z+P8sf8ziv17+mMV//fwxi/8G+WMW/5/nj1n8N8wfs/j/In/M4r9R/pjFf+P8MYv/JvljFv9f5o9Z/H+VP2bx3zR/zOK/Wf6YxX/z/DGL/xb5Yxb/LfPHLP5b5Y9Z/LfOH7P4b5M/ZvHfNn/M4r9d/pjF/9f5Yxb/3+SPWfy3zx+z+O+QP2bx3zF/zOK/U/6Yxf+3+WMW/9/lj1n8f58/ZvHfOX/M4r9L/pjF/w/5Yxb/P+aPWfx3zR+z+P8pf8ziv1v+mMV/9/wxi/8e+WMW/z/nj1n8/5I/ZvHfM3/M4r9X/pjFf+/8MYv/PvljFv9988cs/vvlj1n8988fs/gfkD9m8T8wf8zif1D+mMX/4Pwxi/8h+WMW/0Pzxyz+h+WPWfwPzx+z+B+RP2bxPzJ/zOJ/VP6Yxf/o/DGL/zH5Yxb/Y/PHLP7H5Y9Z/I/PH7P4n5A/ZvE/MX/M4n9S/pjF/+T8MYv/KfljFv9T88cs/qflj1n8T88fs/ifkT9m8T8zf8zif1b+mMX/7Pwxi/85+WMW/3Pzxyz+5+WPWfzPzx+z+F+QP2bxvzB/zOJ/Uf6Yxf/i/DGL/yX5Yxb/S/PHLP6X5Y9Z/C/PH7P4X5E/ZvH/a/6Yxf/K/DGL/1X5Yxb/q/PHLP7X5I9Z/K/NH7P4X5c/ZvG/Pn/M4n9D/pjF/8b8MYv/TfljFv+b88cs/rfkj1n8b80fs/jflj9m8b89f8zif0f+mMX/zvwxi/9d+WMW/7vzxyz+9+SPWfzvzR+z+N+XP2bxvz9/zOL/QP6Yxf/B/DGL/0P5Yxb/h/PHLP6P5I9Z/B/NH7P4P5Y/ZvF/PH/M4v9E/pjF/8n8MYv/U/ljFv+n88cs/s/kj1n8n80fs/g/lz9m8X8+f8zi/0L+mMX/xfwxi/9L+WMW/5fzxyz+r+SPWfxfzR+z+L+WP2bxfz1/zOL/Rv6Yxf/N/DGL/1v5Yxb/t/PHLP7v5I9J/AcN5I9Z/Aflj1n8h8kfs/gPmz9m8R+cP2bxHy5/zOI/fP6YxX+E/DGL/4j5Yxb/kfLHLP4j549Z/EfJH7P4j5o/ZvEfLX/M4j96/pjFf4z8MYv/mPljFv+x8scs/mPnj1n8P5U/ZvEfJ3/M4j9u/pjF/9P5Yxb/8fLHLP7j549Z/D+TP2bxnyB/zOL/2fwxi/+E+WMW/4nyxyz+E+ePWfwnyR+z+E+aP2bx/1z+mMV/svf9R/yExvVvmsV/8rZ/zOI/Rf6YxX/K/DGL/1T5Yxb/z+ePWfynzh+z+H8hf8zi/8X8MYv/l/LHLP5fzh+z+H8lf8zi/9X8MYv/NPljFv9p88cs/tPlj1n8p88fs/jPkD9m8Z8xf8zi/7X8MYv/TPljFv+Z88cs/rPkj1n8Z80fs/h/PX/M4j9b/pjF/xv5Yxb/b+aPWfxnzx+z+H8rf8ziP0f+mMV/zvwxi/9c+WMW/7nzxyz+8+SPWfznzR+z+M+XP2bxnz9/zOK/QP6YxX/B/DGL/7fzxyz+38kfs/gvlD9m8f9u/pjFf+H8MYv/9/LHLP7fzx+z+C+SP2bxXzR/zOK/WP6YxX/x/DGL/xL5Yxb/JfPHLP4/yB+z+C+VP2bx/2H+mMX/R/ljFv+l88cs/svkj1n8l80fs/gvlz9m8f9x/pjFf/n8MYv/CvljFv+f5I9Z/FfMH7P4r5Q/ZvFfOX/M4r9K/pjFf9X8MYv/avljFv/V88cs/j/NH7P4r5E/ZvFfM3/M4r9W/pjFf+38MYv/OvljFv9188cs/j/LH7P4r5c/ZvFfP3/M4r9B/pjF/+f5Yxb/DfPHLP6/yB+z+G+UP2bx3zh/zOK/Sf6Yxf+X+WMW/1/lj1n8N80fs/hvlj9m8d88f8ziv0X+mMV/y/wxi/9W+WMW/63zxyz+2+SPWfy3zR+z+G+XP2bx/3X+mMX/N/ljFv/t88cs/jvkj1n8d8wfs/jvlD9m8f9t/pjF/3f5Yxb/3+ePWfx3zh+z+O+SP2bx/0P+mMX/j/ljFv9d88cs/n/KH7P475Y/ZvHfPX/M4r9H/pjF/8/5Yxb/v+SPWfz3zB+z+O+VP2bx3zt/zOK/T/6YxX/f/DGL/375Yxb//fPHLP4H5I9Z/A/MH7P4H5Q/ZvE/OH/M4n9I/pjF/9B/9H/4f31c/6ZZ/A9r+8cs/ofnj1n8j8gfs/gfmT9m8T8qf8zif3T+mMX/mPwxi/+x+WMW/+Pyxyz+x+ePWfxPyB+z+J+YP2bxPyl/zOJ/cv6Yxf+U/DGL/6n5Yxb/0/LHLP6n549Z/M/IH7P4n5k/ZvE/K3/M4n92/pjF/5z8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8b8of8zif3H+mMX/kvwxi/+l+WMW/8vyxyz+l+ePWfyvyB+T+L9b/v+cxH/QlfljFv+r8scs/lfnj1n8r8kfs/hfmz9m8b8uf8zif33+mMX/hvwxi/+N+WMW/5vyxyz+N+ePWfxvyR+z+N+aP2bxvy1/zOJ/e/6Yxf+O/DGL/535Yxb/u/LHLP53549Z/O/JH7P435s/ZvG/L3/M4n9//pjF/4H8MYv/g/ljFv+H8scs/g/nj1n8H8kfs/g/mj9m8X8sf8zi/3j+mMX/ifwxi/+T+WMW/6fyxyz+T+ePWfyfyR+z+D+bP2bxfy5/zOL/fP6Yxf+F/DGL/4v5Yxb/l/LHLP4v549Z/F/JH7P4v5o/ZvF/Lf/h6UKL/+v5Yxb/N/LHLP5v5o9Z/N/KH7P4v50/ZvF/J39M4v/ul/n/cxb/QfljFv9h8scs/sPmj1n8B+ePWfyHyx+z+A+fP2bxHyF/zOI/Yv6YxX+k/DGL/8j5Yxb/UfLHLP6j5o9Z/EfLH7P4j54/ZvEfI3/M4j9m/pjFf6z8MYv/2PljFv9P5Y9Z/MfJH7P4j5s/ZvH/dP6YxX+8/DGL//j5Yxb/z+SPWfwnyB+z+H82f8ziP2H+mMV/ovwxi//E+WMW/0nyxyz+k+aPWfw/lz9m8Z8sf8ziP3n+mMV/ivwxi/+U+WMW/6nyxyz+n88fs/hPnT9m8f9C/pjF/4v5Yxb/L+WPWfy/nD9m8f9K/pjF/6v5Yxb/afLHLP7T5o8Numi34QYGBv7j/afLH7Ns/9Pnj1n8Z8gfs/jPmD9m8f9a/pjFf6b8MYv/zPljFv9Z8scs/rPmj1n8v54/ZvGfLX/M4v+N/DGL/zfzxyz+s+ePWfy/lT9m8Z8jf8ziP2f+mMV/rvwxi//c+WMW/3nyxyz+8+aPWfznyx+z+M+fP2bxXyB/zOK/YP6Yxf/b+WMW/+/kj1n8F8ofs/h/N3/M4r9w/pjF/3v5Yxb/7+ePWfwXyR+z+C+aP2bxXyx/zOK/eP6YxX+J/DGL/5L5Yxb/H+SPWfyXyh+z+P8wf8zi/6P8MYv/0vljFv9l8scs/svmj1n8l8sfs/j/OH/M4r98/pjFf4X8MYv/T/LHLP4r5o9Z/FfKH7P4r5w/ZvFfJX/M4r9q/pjFf7X8MYv/6vljFv+f5o9Z/NfIH7P4r5k/ZvFfK3/M4r92/pjFf538MYv/uvljFv+f5Y9Z/NfLH7P4r58/ZvHfIH/M4v/z/DGL/4b5Yxb/X+SPWfw3yh+z+G+cP2bx3yR/zOL/y/wxi/+v8scs/pvmj1n8N8sfs/hvnj9m8d8if8ziv2X+mMV/q/wxi//W+WMW/23yxyz+2+aPWfy3yx+z+P86f8zi/5v8MYv/9vljFv8d8scs/jvmj1n8d8ofs/j/Nn/M4v+7/DGL/+/zxyz+O+ePWfx3yR+z+P8hf8zi/8f8MYv/rvljFv8/5Y9Z/HfLH7P4754/ZvHfI3/M4v/n/DGL/1/yxyz+e+aPWfz3yh+z+O+dP2bx3yd/zOK/b/6YxX+//DGL//75Yxb/A/LHLP4H5o9Z/A/KH7P4H5w/ZvE/JH/M4n9o/pjF/7D8MYv/4fljFv8j8scs/kfmj1n8j8ofs/gfnT9m8T8mf8zif2z+mMX/uPwxi//x+WMW/xPyxyz+J+aPWfxPyh+z+J+cP2bxPyV/zOJ/av6Yxf+0/DGL/+n5Yxb/M/LHLP5n5o9Z/M/KH7P4n50/ZvE/J3/M4n9u/pjF/7z8MYv/+fljFv8L8scs/hfmj1n8L8ofs/hfnD9m8b8kf8zif2n+mMX/svwxi//l+WMW/yvyxyz+f80fs/hfmT9m8b8qf8zif3X+mMX/mvwxi/+1+WMW/+vyxyz+1+ePWfxvyB+z+N+YP2bxvyl/zOJ/c/6Yxf+W/DGL/635Yxb/2/LHLP63549Z/O/IH7P435k/ZvG/K3/M4n93/pjF/578MYv/vfljFv/78scs/vfnj1n8H8gfs/g/mD9m8X8of8zi/3D+mMX/kfwxi/+j+WMW/8fyxyz+j+ePWfyfyB+z+D+ZP2bxfyp/zOL/dP6Yxf+Z/DGL/7P5Yxb/5/LHLP7P549Z/F/IH7P4v5g/ZvF/KX/M4v9y/pjF/5X8MYv/q/ljFv/X8scs/q/nj1n838gfs/i/mT9m8X8rf8zi/3b+mMX/nfwxif+wA/ljFv9B+WMW/2Hyxyz+w+aPWfwH549Z/IfLH7P4D58/ZvEfIX/M4j9i/pjFf6T8MYv/yPljFv9R8scs/qPmj1n8R8sfs/iPnj9m8R8jf8ziP2b+mMV/rPwxi//Y+WMW/0/lj1n8x8kfs/iPmz9m8f90/pjFf7z8MYv/+PljFv/P5I9Z/CfIH7P4fzZ/zOI/Yf6YxX+i/DGL/8T5Yxb/SfLHLP6T5o9Z/D+XP2bxnyx/zOI/ef6YxX+K/DGL/5T5Yxb/qfLHLP6fzx+z+E+dP2bx/0L+mMX/i/ljFv8v5Y9Z/L+cP2bx/0r+mMX/q/ljFv9p8scs/tPmj1n8p8sfs/hPnz9m8Z8hf8ziP2P+mMX/a/ljFv+Z8scs/jPnj1n8Z8kfs/jPmj9m8f96/pjFf7b8MYv/N/LHLP7fzB+z+M+eP2bx/1b+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/b+ePWfy/kz9m8V8of8zi/938MYv/wvljFv/v5Y9Z/L+fP2bxXyR/zOK/aP6YxX+x/DGL/+L5Yxb/JfLHLP5L5o9Z/H+QP2bxXyp/zOL/w/wxi/+P8scs/kvnj1n8l8kfs/gvmz9m8V8uf8zi/+P8MYv/8vljFv8V8scs/j/JH7P4r5g/ZvFfKX/M4r9y/pjFf5X8MYv/qvljFv/V8scs/qvnj1n8f5o/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n8f5Y/ZvFfL3/M4r9+/pjFf4P8MYv/z/PHLP4b5o9Z/H+RP2bx3yh/zOK/cf6YxX+T/DGL/y/zxyz+v8ofs/hvmj9m8d8sf8ziv3n+mMV/i/wxi/+W+WMW/63yxyz+W+ePWfy3yR+z+G+bP2bx3y5/zOL/6/wxi/9v8scs/tvnj1n8d8gfs/jvmD9m8d8pf8zi/9v8MYv/7/LHLP6/zx+z+O+cP2bx3yV/zOL/h/wxi/8f88cs/rvmj1n8/5Q/ZvHfLX/M4r97/pjFf4/8MYv/n/PHLP5/yR+z+O+ZP2bx3yt/zOK/d/6YxX+f/DGL/775Yxb//fLHLP77549Z/A/IH7P4H5g/ZvE/KH/M4n9w/pjF/5D8MYv/ofljFv/D8scs/ofnj1n8j8gfs/gfmT9m8T8qf8zif3T+mMX/mPwxi/+x+WMW/+Pyxyz+x+ePWfxPyB+z+J+YP2bxPyl/zOJ/cv6Yxf+U/DGL/6n5Yxb/0/LHLP6n549Z/M/IH7P4n5k/ZvE/K3/M4n92/pjF/5z8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8b8of8zif3H+mMX/kvwxi/+l+WMW/8vyxyz+l+ePWfyvyB+z+P81f8zif2X+mMX/qvwxi//V+WMW/2vyxyz+1+aPWfyvyx+z+F+fP2bxvyF/zOJ/Y/6Yxf+m/DGL/835Yxb/W/LHLP635o9Z/G/LH7P4354/ZvG/I3/M4n9n/pjF/678MYv/3fljFv978scs/vfmj1n878sfs/jfnz9m8X8gf8zi/2D+mMX/ofwxi//D+WMW/0fyxyz+j+aPWfwfyx+z+D+eP2bxfyJ/zOL/ZP6Yxf+p/DGL/9P5Yxb/Z/LHLP7P5o9Z/J/LH7P4P58/ZvF/IX/M4v9i/pjF/6X8MYv/y/ljFv9X8scs/q/mj1n8X8sfs/i/nj9m8X8jf8zi/2b+mMX/rfwxi//b+WMW/3fyxyT+gwfyxyz+g/LHLP7D5I9Z/IfNH7P4D84fs/gPlz9m8R8+f8ziP0L+mMV/xPwxi/9I+WMW/5Hzxyz+o+SPWfxHzR+z+I+WP2bxHz1/zOI/Rv6YxX/M/DGL/1j5Yxb/sfPHLP6fyh+z+I+TP2bxHzd/zOL/6fwxi/94+WMW//Hzxyz+n8kfs/hPkD9m8f9s/pjFf8L8MYv/RPljFv+J88cs/pPkj1n8J80fs/h/Ln/M4j9Z/pjFf/L8MYv/FPljFv8p88cs/lPlj1n8P58/ZvGfOn/M4v+F/DGL/xfzxyz+X8ofs/h/OX/M4v+V/DGL/1fzxyz+0+SPWfynzR+z+E+XP2bxnz5/zOI/Q/6YxX/G/DGL/9fyxyz+M+WPWfxnzh+z+M+SP2bxnzV/zOL/9fwxi/9s+WMW/2/kj1n8v5k/ZvGfPX/M4v+t/DGL/xz5Yxb/OfPHLP5z5Y9Z/OfOH7P4z5M/ZvGfN3/M4j9f/pjFf/78MYv/AvljFv8F88cs/t/OH7P4fyd/zOK/UP6Yxf+7+WMW/4Xzxyz+38sfs/h/P3/M4r9I/pjFf9H8MYv/YvljFv/F88cs/kvkj1n8l8wfs/j/IH/M4r9U/pjF/4f5Yxb/H+WPWfyXzh+z+C+TP2bxXzZ/zOK/XP6Yxf/H+WMW/+Xzxyz+K+SPWfx/kj9m8V8xf8ziv1L+mMV/5fwxi/8q+WMW/1Xzxyz+q+WPWfxXzx+z+P80f8ziv0b+mMV/zfwxi/9a+WMW/7Xzxyz+6+SPWfzXzR+z+P8sf8ziv17+mMV//fwxi/8G+WMW/5/nj1n8N8wfs/j/In/M4r9R/pjFf+P8MYv/JvljFv9f5o9Z/H+VP2bx3zR/zOK/Wf6YxX/z/DGL/xb5Yxb/LfPHLP5b5Y9Z/LfOH7P4b5M/ZvHfNn/M4r9d/pjF/9f5Yxb/3+SPWfy3zx+z+O+QP2bx3zF/zOK/U/6Yxf+3+WMW/9/lj1n8f58/ZvHfOX/M4r9L/pjF/w/5Yxb/P+aPWfx3zR+z+P8pf8ziv1v+mMV/9/wxi/8e+WMW/z/nj1n8/5I/ZvHfM3/M4r9X/pjFf+/8MYv/PvljFv9988cs/vvlj1n8988fs/gfkD9m8T8wf8zif1D+mMX/4Pwxi/8h+WMW/0Pzxyz+h+WPWfwPzx+z+B+RP2bxPzJ/zOJ/VP6Yxf/o/DGL/zH5Yxb/Y/PHLP7H5Y9Z/I/PH7P4n5A/ZvE/MX/M4n9S/pjF/+T8MYv/KfljFv9T88cs/qflj1n8T88fs/ifkT9m8T8zf8zif1b+mMX/7Pwxi/85+WMW/3Pzxyz+5+WPWfzPzx+z+F+QP2bxvzB/zOJ/Uf6Yxf/i/DGL/yX5Yxb/S/PHLP6X5Y9Z/C/PH7P4X5E/ZvH/a/6Yxf/K/DGL/1X5Yxb/q/PHLP7X5I9Z/K/NH7P4X5c/ZvG/Pn/M4n9D/pjF/8b8MYv/TfljFv+b88cs/rfkj1n8b80fs/jflj9m8b89f8zif0f+mMX/zvwxi/9d+WMW/7vzxyz+9+SPWfzvzR+z+N+XP2bxvz9/zOL/QP6Yxf/B/DGL/0P5Yxb/h/PHLP6P5I9Z/B/NH7P4P5Y/ZvF/PH/M4v9E/pjF/8n8MYv/U/ljFv+n88cs/s/kj1n8n80fs/g/lz9m8X8+f8zi/0L+mMX/xfwxi/9L+WMW/5fzxyz+r+SPWfxfzR+z+L+WP2bxfz1/zOL/Rv6Yxf/N/DGL/1v5Yxb/t/PHLP7v5I9J/IcbyB+z+A/KH7P4D5M/ZvEfNn/M4j84f8ziP1z+mMV/+Pwxi/8I+WMW/xHzxyz+I+WPWfxHzh+z+I+SP2bxHzV/zOI/Wv6YxX/0/DGL/xj5Yxb/MfPHLP5j5Y9Z/MfOH7P4fyp/zOI/Tv6YxX/c/DGL/6fzxyz+4+WPWfzHzx+z+H8mf8ziP0H+mMX/s/ljFv8J88cs/hPlj1n8J84fs/hPkj9m8Z80f8zi/7n8MYv/ZPljFv/J88cs/lPkj1n8p8wfs/hPlT9m8f98/pjFf+r8MYv/F/LHLP5fzB+z+H8pf8zi/+X8MYv/V/LHLP5fzR+z+E+TP2bxnzZ/zOI/Xf6YxX/6/DGL/wz5Yxb/GfPHLP5fyx+z+M+UP2bxnzl/zOI/S/6YxX/W/DGL/9fzxyz+s+WPWfy/kT9m8f9m/pjFf/b8MYv/t/LHLP5z5I9Z/OfMH7P4z5U/ZvGfO3/M4j9P/pjFf978MYv/fPljFv/588cs/gvkj1n8F8wfs/h/O3/M4v+d/DGL/0L5Yxb/7+aPWfwXzh+z+H8vf8zi//38MYv/IvljFv9F88cs/ovlj1n8F88fs/gvkT9m8V8yf8zi/4P8MYv/UvljFv8f5o9Z/H+UP2bxXzp/zOK/TP6YxX/Z/DGL/3L5Yxb/H+ePWfyXzx+z+K+QP2bx/0n+mMV/xfwxi/9K+WMW/5Xzxyz+q+SPWfxXzR+z+K+WP2bxXz1/zOL/0/wxi/8a+WMW/zXzxyz+a+WPWfzXzh+z+K+TP2bxXzd/zOL/s/wxi/96+WMW//Xzxyz+G+SPWfx/nj9m8d8wf8zi/4v8MYv/RvljFv+N88cs/pvkj1n8f5k/ZvH/Vf6YxX/T/DGL/2b5Yxb/zfPHLP5b5I9Z/LfMH7P4b5U/ZvHfOn/M4r9N/pjFf9v8MYv/dvljFv9f549Z/H+TP2bx3z5/zOK/Q/6YxX/H/DGL/075Yxb/3+aPWfx/lz9m8f99/pjFf+f8MYv/LvljFv8/5I9Z/P+YP2bx3zV/zOL/p/wxi/9u+WMW/93zxyz+e+SPWfz/nD9m8f9L/pjFf8/8MYv/XvljFv+988cs/vvkj1n8980fs/jvlz9m8d8/f8zif0D+mMX/wPwxi/9B+WMW/4Pzxyz+h+SPWfwPzR+z+B+WP2bxPzx/zOJ/RP6Yxf/I/DGL/1H5Yxb/o/PHLP7H5I9Z/I/NH7P4H5c/ZvE/Pn/M4n9C/pjF/8T8MYv/SfljFv+T88cs/qfkj1n8T80fs/iflj9m8T89f8zif0b+mMX/zPwxi/9Z+WMW/7Pzxyz+5+SPWfzPzR+z+J+XP2bxPz9/zOJ/Qf6Yxf/C/DGL/0X5Yxb/i/PHLP6X5I9Z/C/NH7P4X5Y/ZvG/PH/M4n9F/pjF/6/5Yxb/K/PHLP5X5Y9Z/K/OH7P4X5M/ZvG/Nn/M4n9d/pjF//r8MYv/DfljFv8b88cs/jflj1n8b84fs/jfkj9m8b81f8zif1v+mMX/9vwxi/8d+WMW/zvzxyz+d+WPWfzvzh+z+N+TP2bxvzd/zOJ/X/6Yxf/+/DGL/wP5Yxb/B/PHLP4P5Y9Z/B/OH7P4P5I/ZvF/NH/M4v9Y/pjF//H8MYv/E/ljFv8n88cs/k/lj1n8n84fs/g/kz9m8X82f8zi/1z+mMX/+fwxi/8L+WMW/xfzxyz+L+WPWfxfzh+z+L+SP2bxfzV/zOL/Wv6Yxf/1/DGL/xv5Yxb/N/PHLP5v5Y9Z/N/OH7P4v5M/JvEffiB/zOI/KH/M4j9M/pjFf9j8MYv/4Pwxi/9w+WMW/+Hzxyz+I+SPWfxHzB+z+I+UP2bxHzl/zOI/Sv6YxX/U/DGL/2j5Yxb/0fPHLP5j5I9Z/MfMH7P4j5U/ZvEfO3/M4v+p/DGL/zj5Yxb/cfPHLP6fzh+z+I+XP2bxHz9/zOL/mfwxi/8E+WMW/8/mj1n8J8wfs/hPlD9m8Z84f8ziP0n+mMV/0vwxi//n8scs/pPlj1n8J88fs/hPkT9m8Z8yf8ziP1X+mMX/8/ljFv+p88cs/l/IH7P4fzF/zOL/pfwxi/+X88cs/l/JH7P4fzV/zOI/Tf6YxX/a/DGL/3T5Yxb/6fPHLP4z5I9Z/GfMH7P4fy1/zOI/U/6YxX/m/DGL/yz5Yxb/WfPHLP5fzx+z+M+WP2bx/0b+mMX/m/ljFv/Z88cs/t/KH7P4z5E/ZvGfM3/M4j9X/pjFf+78MYv/PPljFv9588cs/vPlj1n8588fs/gvkD9m8V8wf8zi/+38MYv/d/LHLP4L5Y9Z/L+bP2bxXzh/zOL/vfwxi//388cs/ovkj1n8F80fs/gvlj9m8V88f8ziv0T+mMV/yfwxi/8P8scs/kvlj1n8f5g/ZvH/Uf6YxX/p/LH/UP9BH7Iefpn8sf9Q/3f7++1/2fwxi/9y+WMW/x/nj1n8l88fs/ivkD9m8f9J/pjFf8X8sUEXDRo6M//Z/ivlj1m2/5Xzxyz+q+SPWfxXzR+z+K+WP2bxXz1/zOL/0/wxi/8a+WMW/zXzxyz+a+WPWfzXzh+z+K+TP2bxXzd/zOL/s/wxi/96+WMW//Xzxyz+G+SPWfx/nj9m8d8wf8zi/4v8MYv/RvljFv+N88cs/pvkj1n8f5k/ZvH/Vf6YxX/T/DGL/2b5Yxb/zfPHLP5b5I9Z/LfMH7P4b5U/ZvHfOn/M4r9N/pjFf9v8MYv/dvljFv9f549Z/H+TP2bx3z5/zOK/Q/6YxX/H/DGL/075Yxb/3+aPWfx/lz9m8f99/pjFf+f8MYv/LvljFv8/5I9Z/P+YP2bx3zV/zOL/p/wxi/9u+WMW/93zxyz+e+SPWfz/nD9m8f9L/pjFf8/8MYv/XvljFv+988cs/vvkj1n8980fs/jvlz9m8d8/f8zif0D+mMX/wPwxi/9B+WMW/4Pzxyz+h+SPWfwPzR+z+B+WP2bxPzx/zOJ/RP6Yxf/I/DGL/1H5Yxb/o/PHLP7H5I9Z/I/NH7P4H5c/ZvE/Pn/M4n9C/pjF/8T8MYv/SfljFv+T88cs/qfkj1n8T80fs/iflj9m8T89f8zif0b+mMX/zPwxi/9Z+WMW/7Pzxyz+5+SPWfzPzR+z+J+XP2bxPz9/zOJ/Qf6Yxf/C/DGL/0X5Yxb/i/PHLP6X5I9Z/C/NH7P4X5Y/ZvG/PH/M4n9F/pjF/6/5Yxb/K/PHLP5X5Y9Z/K/OH7P4X5M/ZvG/Nn/M4n9d/pjF//r8MYv/DfljFv8b88cs/jflj1n8b84fs/jfkj9m8b81f8zif1v+mMX/9vwxi/8d+WMW/zvzxyz+d+WPWfzvzh+z+N+TP2bxvzd/zOJ/X/6Yxf/+/DGL/wP5Yxb/B/PHLP4P5Y9Z/B/OH7P4P5I/ZvF/NH/M4v9Y/pjF//H8MYv/E/ljFv8n88cs/k/lj1n8n84fs/g/kz9m8X82f8zi/1z+mMX/+fwxi/8L+WMW/xfzHxgJLrP4v5Q/ZvF/OX/M4v9K/pjF/9X8MYv/a/ljFv/X88cs/m/kj1n838wfs/i/lT9m8X87f8zi/07+mMR/hIH8MYv/oPwxi/8w+WMW/2Hzxyz+g/PHLP7D5Y9Z/IfPH7P4j5A/ZvEfMX/M4j9S/pjFf+T8MYv/KPljFv9R88cs/qPlj1n8R88fs/iPkT9m8R8zf8ziP1b+QxvxH85Z/MfOH7P4fyp/zOI/Tv6YxX/c/DGL/6fzxyz+4+WPWfzHzx+z+H8mf8ziP0H+mMX/s/ljFv8J88cs/hPlj1n8J84fs/hPkj9m8Z80f8zi/7n8MYv/ZPljFv/J88cs/lPkj1n8p8wfs/hPlT9m8f98/pjFf+r8MYv/F/LHLP5fzB+z+H8pf8zi/+X8MYv/V/LHLP5fzR+z+E+TP2bxnzZ/zOI/Xf6YxX/6/DGL/wz5Yxb/GfPHLP5fyx+z+M+UP2bxnzl/zOI/S/6YxX/W/DGL/9fzxyz+s+WPWfy/kT9m8f9m/pjFf/b8MYv/t/LHLP5z5I9Z/OfMH7P4z5U/ZvGfO3/M4j9P/pjFf978MYv/fPljFv/588cs/gvkj1n8F8wfs/h/O3/M4v+d/DGL/0L5Yxb/7+aPWfwXzh+z+H8vf8zi//38MYv/IvljFv9F88cs/ovlj1n8F88fs/gvkT9m8V8yf8zi/4P8MYv/UvljFv8f5o9Z/H+UP2bxXzp/zOK/TP6YxX/Z/DGL/3L5Yxb/H+ePWfyXzx+z+K+QP2bx/0n+mMV/xfwxi/9K+WMW/5Xzxyz+q+SPWfxXzR+z+K+WP2bxXz1/zOL/0/wxi/8a+WMW/zXzxyz+a+WPWfzXzh+z+K+TP2bxXzd/zOL/s/wxi/96+WMW//Xzxyz+G+SPWfx/nj9m8d8wf8zi/4v8MYv/RvljFv+N88cs/pvkj1n8f5k/ZvH/Vf6YxX/T/DGL/2b5Yxb/zfPHLP5b5I9Z/LfMH7P4b5U/ZvHfOn/M4r9N/pjFf1v0b42w+G+XNmbx/3X+mMX/N/ljFv/t88cs/jvkj1n8d3zP/613Pqlx/Ztm8d+p7R+z+P82f8zi/7v8MYv/7/PHLP47549Z/HfJH7P4/yF/zOL/x/wxi/+u+WMW/z/lj1n8d8sfs/jvnj9m8d8jf8zi/+f8MYv/X/LHLP575o9Z/PfKH7P4750/ZvHfJ3/M4r9v/pjFf7/8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+B+dP2bxPyZ/zOJ/bP6Yxf+4/DGL//H5Yxb/E/LHLP4n5o9Z/E/KH7P4n5w/ZvE/JX/M4n9q/pjF/7T8MYv/6fljFv8z8scs/mfmj1n8z8ofs/ifnT9m8T8nf8zif27+mMX/vPwxi//5+WMW/wvyxyz+F+aPWfwvyh+z+F+cP2bxvyR/zOJ/af6Yxf+y/DGL/+X5Yxb/K/LHLP5/zR+z+F+ZP2bxvyp/zOJ/df6Yxf+a/DGL/7X5Yxb/6/LHLP7X549Z/G/IH7P435g/ZvG/KX/M4n9z/pjF/5b8MYv/rfljFv/b8scs/rfnj1n878gfs/jfmT9m8b8rf8zif3f+mMX/nvwxi/+9+WMW//vyxyz+9+ePWfwfyB+z+D+YP2bxfyh/zOL/cP6Yxf+R/DGL/6P5Yxb/x/LHLP6P549Z/J/IH7P4P5k/ZvF/Kn/M4v90/pjF/5n8MYv/s/ljFv/n8scs/s/nj1n8X8gfs/i/mD9m8X8pf8zi/3L+mMX/lfwxi/+r+WMW/9fyxyz+r+ePWfzfyB+z+L+ZP2bxfyt/zOL/dv6Yxf+d/DGJ/4gD+WMW/0H5Yxb/YfLHLP7D5o9Z/Afnj1n8h8sfs/gPnz9m8R8hf8ziP2L+mMV/pPwxi//I+WMW/1Hyxyz+o+aPWfxHyx+z+I+eP2bxHyN/zOI/Zv6YxX+s/DGL/9j5Yxb/T+WPWfzHyR+z+I+bP2bx/3T+mMV/vPwxi//4+WMW/8/kj1n8J8gfs/h/Nn/M4j9h/pjFf6L8MYv/xPljFv9J8scs/pPmj1n8P5c/ZvGfLH/M4j95/pjFf4r8MYv/lPljFv+p8scs/p/PH7P4T50/ZvH/Qv6Yxf+L+WMW/y/lj1n8v5w/ZvH/Sv6Yxf+r+WMW/2nyxyz+0+aPWfynyx+z+E+fP2bxnyF/zOI/Y/6Yxf9r+WMW/5nyxyz+M+ePWfxnyR+z+M+aP2bx/3r+mMV/tvwxi/838scs/t/MH7P4z54/ZvH/Vv6YxX+O/DGL/5z5Yxb/ufLHLP5z549Z/OfJH7P4z5s/ZvGfL3/M4j9//pjFf4H8MYv/gvljFv9v549Z/L+TP2bxXyh/zOL/3fwxi//C+WMW/+/lj1n8v58/ZvFfJH/M4r9o/pjFf7H8MYv/4vljFv8l8scs/kvmj1n8f5A/ZvFfKn/M4v/D/DGL/4/yxyz+S+ePWfyXyR+z+C+bP2bxXy5/zOL/4/wxi//y+WMW/xXyxyz+P8kfs/ivmD9m8V8pf8ziv3L+mMV/lfwxi/+q+WMW/9Xyxyz+q+ePWfx/mj9m8V8jf8ziv2b+mMV/rfwxi//a+WMW/3Xyxyz+6+aPWfx/lj9m8V8vf8ziv37+mMV/g/wxi//P88cs/hvmj1n8f5E/ZvHfKH/M4r9x/pjFf5P8MYv/L/PHLP6/yh+z+G+aP2bx3yx/zOK/ef6YxX+L/DGL/5b5Yxb/rfLHLP5b549Z/LfJH7P4b5s/ZvHfLn/M4v/r/DGL/2/yxyz+2+ePWfx3yB+z+O+YP2bx3yl/zOL/2/wxi//v8scs/r/PH7P475w/ZvHfJX/M4v+H/DGL/x/zxyz+u+aPWfz/lD9m8d8tf8ziv3v+mMV/j/wxi/+f88cs/n/JH7P475k/ZvHfK3/M4r93/pjFf5/8MYv/vvljFv/98scs/vvnj1n8D8gfs/gfmD9m8T8of8zif3D+mMX/kPwxi/+h+WMW/8Pyxyz+h+ePWfyPyB+z+B+ZP2bxPyp/zOJ/dP6Yxf+Y/DGL/7H5Yxb/4/LHLP7H549Z/E/IH7P4n5g/ZvE/KX/M4n9y/pjF/5T8MYv/qfljFv/T8scs/qfnj1n8z8gfs/ifmT9m8T8rf8zif3b+mMX/nPwxi/+5+WMW//Pyxyz+5+ePWfwvyB+z+F+YP2bxvyh/zOJ/cf6Yxf+S/DGL/6X5Yxb/y/LHLP6X549Z/K/IH7P4/zV/zOJ/Zf6Yxf+q/DGL/9X5Yxb/a/LHLP7X5o9Z/K/LH7P4X58/ZvG/IX/M4n9j/pjF/6b8MYv/zfljFv9b8scs/rfmj1n8b8sfs/jfnj9m8b8jf8zif2f+mMX/rvwxi//d+WMW/3vyxyz+9+aPWfzvyx+z+N+fP2bxfyB/zOL/YP6Yxf+h/DGL/8P5Yxb/R/LHLP6P5o9Z/B/LH7P4P54/ZvF/In/M4v9k/pjF/6n8MYP/oMEDIz6dP2bwH7L9P5M/ZvF/Nn/M4v9c/pjF//n8MYv/C/ljFv8X88cs/i/lj1n8X84fs/i/kj9m8X81f8zi/1r+mMX/9fwxi/8b+WMW/zfzxyz+b+WPWfzfzh+z+L+TPybxH2kgf8ziPyh/zOI/TP6YxX/Y/DGL/+D8MYv/cPljFv/h88cs/iPkj1n8R8wfs/iPlD9m8R85f8ziP0r+mMV/1Pwxi/9o+WMW/9Hzxyz+Y+SPWfzHzB+z+I+VP2bxHzt/zOL/qfwxi/84+WMW/3Hzxyz+n84fs/iPlz9m8R8/f8zi/5n8MYv/BPljFv/P5o9Z/CfMH7P4T5Q/ZvGfOH/M4j9J/pjFf9L8MYv/5/LHLP6T5Y9Z/CfPH7P4T5E/ZvGfMn/M4j9V/pjF//P5Yxb/qfPHLP5fyB+z+H8xf8zi/6X8MYv/l/PHLP5fyR+z+H81f8ziP03+mMV/2oGBzT+pIf07Z/Gfru0fs/hPnz9m8Z8hf8ziP2P+mMX/a/ljFv+Z8scs/jPnj1n8Z8kfs/jPmj9m8f96/pjFf7b8MYv/N/LHLP7fzB+z+M+eP2bx/1b+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/b+ePWfy/kz9m8V8of8zi/938MYv/wvljFv/v5Y9Z/L+fP2bxXyR/zOK/aP6YxX+x/DGL/+L5Yxb/JfLHLP5L5o9Z/H+QP2bxXyp/zOL/w/wxi/+P8scs/kvnj1n8l8kfs/gvmz9m8V8uf8zi/+P8MYv/8vljFv8V8scs/j/JH7P4r5g/ZvFfKX/M4r9y/pjFf5X8MYv/qvljFv/V8scs/qvnj1n8f5o/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n8f5Y/ZvFfL3/M4r9+/pjFf4P8MYv/z/PHLP4b5o9Z/H+RP2bx3yh/zOK/cf6YxX+T/DGL/y/zxyz+v8ofs/hvmj9m8d8sf8ziv3n+mMV/i/wxi/+W+WMW/63yxyz+W+ePWfy3yR+z+G+bP2bx3y5/zOL/6/wxi/9v8scs/tvnj1n8d8gfs/jvmD9m8d8pf8zi/9v8MYv/7/LHLP6/zx+z+O+cP2bx3yV/zOL/h/wxi/8f88cs/rvmj1n8/5Q/ZvHfLX/M4r97/pjFf4/8MYv/n/PHLP5/yR+z+O+ZP2bx3yt/zOK/d/6YxX+f/DGL/775Yxb//fLHLP77549Z/A/IH7P4H5g/ZvE/KH/M4n9w/pjF/5D8MYv/ofljFv/D8scs/ofnj1n8j8gfs/gfmT9m8T8qf8zif3T+mMX/mPwxi/+x+WMW/+Pyxyz+x+ePWfxPyB+z+J+YP2bxPyl/zOJ/cv6Yxf+U/DGL/6n5Yxb/0/LHLP6n549Z/M/IH7P4n5k/ZvE/K3/M4n92/pjF/5z8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8b8of8zif3H+mMX/kvwxi/+l+WMW/8vyxyz+l+ePWfyvyB+z+P81f8zif2X+mMX/qvwxi//V+WMW/2vyxyz+1+aPWfyvyx+z+F+fP2bxvyF/zOJ/Y/6Yxf+m/DGL/835Yxb/W/LHLP635o9Z/G/LH7P4354/ZvG/I3/M4n9n/pjF/678MYv/3fljFv978scs/vfmj1n878sfs/jfnz9m8X8gf8zi/2D+mMX/ofwxi//D+WMW/0fyxyz+j+aPWfwfyx+z+D+eP2bxfyJ/zOL/ZP6Yxf+p/DGL/9P5Yxb/Z/LHLP7P5o9Z/J/LH7P4P58/ZvF/IX/M4v9i/pjF/6X8MYv/y/ljFv9X8scs/q/mj1n8X8sfs/i/nj9m8X8jf8zi/2b+mMX/rfwxi//b+WMW/3fyxyT+Iw/kj1n8B+WPWfyHyR+z+A+bP2bxH5w/ZvEfLn/M4j98/pjFf4T8MYv/iPljFv+R8scs/iPnj1n8R8kfs/iPmj9m8R8tf8ziP3r+mMV/jPwxi/+Y+WMW/7Hyxyz+Y+ePWfw/lT9m8R8nf8ziP27+mMX/0/ljFv/x8scs/uPnj1n8P5M/ZvGfIH/M4v/Z/DGL/4T5Yxb/ifLHLP4T549Z/CfJH7P4T5o/ZvH/XP6YxX+y/DGL/+T5Yxb/KfLHLP5T5o9Z/KfKH7P4fz5/zOI/df6Yxf8L+WMW/y/mj1n8v5Q/ZvH/cv6Yxf8r+WMW/6/mj1n8p8kfs/hPmz9m8Z8uf8ziP33+mMV/hvwxi/+M+WMW/6/lj1n8Z8ofs/jPnD9m8Z8lf8ziP2v+mMX/6/ljFv/Z8scs/t/IH7P4fzN/zOI/e/6Yxf9b+WMW/znyxyz+c+aPWfznyh+z+M+dP2bxnyd/zOI/b/6YxX++/DGL//z5Yxb/BfLHLP4L5o9Z/L+dP2bx/07+mMV/ofwxi/9388cs/gvnj1n8v5c/ZvH/fv6YxX+R/DGL/6L5Yxb/xfLHLP6L549Z/JfIH7P4L5k/ZvH/Qf6YxX+p/DGL/w/zxyz+P8ofs/gvnT9m8V8mf8ziv2z+mMV/ufwxi/+P88cs/svnj1n8V8gfs/j/JH/M4r9i/pjFf6X8MYv/yvljFv9V8scs/qvmj1n8V8sfs/ivnj9m8f9p/pjFf438MYv/mvljFv+18scs/mvnj1n818kfs/ivmz9m8f9Z/pjFf738MYv/+vljFv8N8scs/j/PH7P4b5g/ZvH/Rf6YxX+j/DGL/8b5Yxb/TfLHLP6/zB+z+P8qf8ziv2n+mMV/s/wxi//m+WMW/y3yxyz+W+aPWfy3yh+z+G+dP2bx3yZ/zOK/bf6YxX+7/DGL/6/zxyz+v8kfs/hvnz9m8d8hf8ziv2P+mMV/p/wxi/9v88cs/r/LH7P4/z5/zOK/c/6YxX+X/DGL/x/yxyz+f8wfs/jvmj9m8f9T/pjFf7f8MYv/7vljFv898scs/n/OH7P4/yV/zOK/Z/6YxX+v/DGL/975Yxb/ffLHLP775o9Z/PfLH7P4758/ZvE/IH/M4n9g/pjF/6D8MYv/wfljFv9D8scs/ofmj1n8D8sfs/gfnj9m8T8if8zif2T+mMX/qPwxi//R+WMW/2Pyxyz+x+aPWfyPyx+z+B+fP2bxPyF/zOJ/Yv6Yxf+k/DGL/8n5Yxb/U/LHLP6n5o9Z/E/LH7P4n54/ZvE/I3/M4n9m/pjF/6z8MYv/2fljFv9z8scs/ufmj1n8z8sfs/ifnz9m8b8gf8zif2H+mMX/ovwxi//F+WMW/0vyxyz+l+aPWfwvyx+z+F+eP2bxvyJ/zOL/1/wxi/+V+WMW/6vyxyz+V+ePWfyvyR+z+F+bP2bxvy5/zOJ/ff6Yxf+G/DGL/435Yxb/m/LHLP43549Z/G/JH7P435o/ZvG/LX/M4n97/pjF/478MYv/nfljFv+78scs/nfnj1n878kfs/jfmz9m8b8vf8zif3/+mMX/gfwxi/+D+WMW/4fyxyz+D+ePWfwfyR+z+D+aP2bxfyx/zOL/eP6Yxf+J/DGL/5P5Yxb/p/LHLP5P549Z/J/JH7P4P5s/ZvF/Ln/M4v98/pjF/4X8MYv/i/ljFv+X8scs/i/nj1n8X8kfs/i/mj9m8X8tf8zi/3r+mMX/jfwxi/+b+WMW/7fyxyz+b+ePWfzfyR+T+I8ykD9m8R+UP2bxHyZ/zOI/bP6YxX9w/pjFf7j8MYv/8PljFv8R8scs/iPmj1n8R8ofs/iPnD9m8R8lf8ziP2r+mMV/tPwxi//o+WMW/zHyxyz+Y+aPWfzHyh+z+I+dP2bx/1T+mMV/nPwxi/+4+WMW/0/nj1n8x8sfs/iPnz9m8f9M/pjFf4L8MYv/Z/PHLP4T5o9Z/CfKH7P4T5w/ZvGfJH/M4j9p/pjF/3P5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4v/5/DGL/9T5Yxb/L+SPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfy/mj9m8Z8mf8ziP23+mMV/uvwxi//0+WMW/xnyxyz+M+aPWfy/lj9m8Z8pf8ziP3P+mMV/lvwxi/+s+WMW/6/nj1n8Z8sfs/h/I3/M4v/N/DGL/+z5Yxb/b+WPWfznyB+z+M+ZP2bxnyt/zOI/d/6YxX+e/DGL/7z5Yxb/+fLHLP7z549Z/BfIH7P4L5g/ZvH/dv6Yxf87+WMW/4Xyxyz+380fs/gvnD9m8f9e/pjF//v5Yxb/RfLHLP6L5o9Z/BfLH7P4L54/ZvFfIn/M4r9k/pjF/wf5Yxb/pfLHLP4/zB+z+P8of8ziv3T+mMV/mfwxi/+y+WMW/+Xyxyz+P84fs/gvnz9m8V8hf8zi/5P8MYv/ivljFv+V8scs/ivnj1n8V8kfs/ivmj9m8V8tf8ziv3r+mMX/p/ljFv818scs/mvmj1n818ofs/ivnT9m8V8nf8ziv27+mMX/Z/ljFv/18scs/uvnj1n8N8gfs/j/PH/M4r9h/pjF/xf5Yxb/jfLHLP4b549Z/DfJH7P4/zJ/zOL/q/wxi/+m+WMW/83yxyz+m+ePWfy3yB+z+G+ZP2bx3yp/zOK/df6YxX+b/DGL/7b5Yxb/7fLHLP6/zh+z+P8mf8ziv33+mMV/h/wxi/+O+WMW/53yxyz+v80fs/j/Ln/M4v/7/DGL/875Yxb/XfLHLP5/yB+z+P8xf8ziv2v+mMX/T/ljFv/d8scs/rvnj1n898gfs/j/OX/M4v+X/DGL/575Yxb/vfLHLP57549Z/PfJH7P475s/ZvHfL3/M4r9//pjF/4D8MYv/gfljFv+D8scs/gfnj1n8D8kfs/gfmj9m8T8sf8zif3j+mMX/iPwxi/+R+WMW/6Pyxyz+R+ePWfyPyR+z+B+bP2bxPy5/zOJ/fP6Yxf+E/DGL/4n5Yxb/k/LHLP4n549Z/E/JH7P4n5o/ZvE/LX/M4n96/pjF/4z8MYv/mflj7/sPjDgw8J/sf1b+mGX7Pzt/zOJ/Tv6Yxf/c/DGL/3n5Yxb/8/PHLP4X5I9Z/C/MH7P4X5Q/ZvG/OH/M4n9J/pjF/9L8MYv/ZfljFv/L88cs/lfkj1n8/5o/ZvG/Mn/M4n9V/pjF/+r8MYv/NfljFv9r88cs/tflj1n8r88fs/jfkD9m8b8xf8zif1P+mMX/5vwxi/8t+WMW/1vzxyz+t+WPWfxvzx+z+N+RP2bxvzN/zOJ/V/6Yxf/u/DGL/z35Yxb/e/PHLP735Y9Z/O/PH7P4P5A/ZvF/MH/M4v9Q/pjF/+H8MYv/I/ljFv9H88cs/o/ljzn8k/+oHP4DozzRWoBZ/J/MH7P4P5U/ZvF/On/M4v9M/pjF/9n8MYv/c/ljFv/n88cs/i/kj1n8X8wfs/i/lD9m8X85f8zi/0r+mMX/1fwxi/9r+WMW/9fzxyz+b+SPWfzfzB+z+L+VP2bxfzt/zOL/Tv6YxH/Ugfwxi/+g/DGL/zD5Yxb/YfPHLP6D88cs/sPlj1n8h88fs/iPkD9m8R8xf8ziP1L+mMV/5Pwxi/8o+WMW/1Hzxyz+o+WPWfxHzx+z+I+RP2bxHzN/zOI/Vv6YxX/s/DGL/6fyxyz+4+SPWfzHzR+z+H86f8ziP17+mMV//Pwxi/9n8scs/hPkj1n8P5s/ZvGfMH/M4j9R/pjFf+L8MYv/JPljFv9J88cs/p/LH7P4T5Y/ZvGfPH/M4j9F/pjFf8r8MYv/VPljFv/P549Z/KfOH7P4fyF/zOL/xfwxi/+X8scs/l/OH7P4fyV/zOL/1fwxi/80+WMW/2nzxyz+0+WPWfynzx+z+M+QP2bxnzF/zOL/tfwxi/9M+WMW/5nzxyz+s+SPWfxnzR+z+H89f8ziP1v+mMX/G/ljFv9v5o9Z/GfPH7P4fyt/zOI/R/6YxX/O/DGL/1z5Yxb/ufPHLP7z5I9Z/OfNH7P4z5c/ZvGfP3/M4r9A/pjFf8H8MYv/t/PHLP7fyR+z+C+UP2bx/27+mMV/4fwxi//38scs/t/PH7P4L5I/ZvFfNH/M4r9Y/pjFf/H8MYv/EvljFv8l88cs/j/IH7P4L5U/ZvH/Yf6Yxf9H+WMW/6Xzxyz+y+SPWfyXzR+z+C+XP2bx/3H+mMV/+fwxi/8K+WMW/5/kj1n8V8wfs/ivZPT/F+6wxX9lo/+/kMV/lfwxi/+q+WMW/9Xyxyz+q+ePWfx/mj9m8V8jf8ziv2b+mMV/rfwxi//a+WMW/3Xyxyz+6+aPWfx/lj9m8V8vf8ziv37+mMV/g/wxi//P88cs/hvmj1n8f5E/ZvHfKH/M4r9x/pjFf5P8MYv/L/PHLP6/yh+z+G+aP2bx3yx/zOK/ef6YxX+L/DGL/5b5Yxb/rfLHLP5b549Z/LfJH7P4b5s/ZvHfLn/M4v/r/DGL/2/yxyz+2+ePWfx3yB+z+O+YP2bx3yl/zOL/2/wxi//v8scs/r/PH7P475w/ZvHfJX/M4v+H/DGL/x/zxyz+u+aPWfz/lD9m8d8tf8ziv3v+mMV/j/wxi/+f88cs/n/JH7P475k/ZvHfK3/M4r93/pjFf5/8MYv/vvljFv/98scs/vvnj1n8D8gfs/gfmD9m8T8of8zif3D+mMX/kPwxi/+h+WMW/8Pyxyz+h+ePWfyPyB+z+B+ZP2bxPyp/zOJ/dP6Yxf+Y/DGL/7H5Yxb/4/LHLP7H549Z/E/IH7P4n5g/ZvE/KX/M4n9y/pjF/5T8MYv/qfljFv/T8scs/qfnj1n8z8gfs/ifmT9m8T8rf8zif3b+mMX/nPwxi/+5+WMW//Pyxyz+5+ePWfwvyB+z+F+YP2bxvyh/zOJ/cf6Yxf+S/DGL/6X5Yxb/y/LHLP6X549Z/K/IH7P4/zV/zOJ/Zf6Yxf+q/DGL/9X5Yxb/a/LHLP7X5o9Z/K/LH7P4X58/ZvG/IX/M4n9j/pjF/6b8MYv/zfljFv9b8scs/rfmj1n8b8sfs/jfnj9m8b8jf8zif2f+mMX/rvwxi//d+WMW/3vyxyz+9+aPWfzvyx+z+N+fP2bxfyB/zOL/YP6Yxf+h/DGL/8P5Yxb/R/LHLP6P5o9Z/B/LH7P4P54/ZvF/In/M4v9k/pjF/6n8MYv/0/ljFv9n8scs/s/mj1n8n8sfs/g/nz9m8X8hf8zi/2L+mMX/pfwxi//L+WMW/1fyxyz+r+aPWfxfyx+z+L+eP2bxfyN/zOL/Zv6Yxf+t/DGL/9v5Yxb/d/LHJP6jDeSPWfwH5Y9Z/IfJH7P4D5s/ZvEfnD9m8R8uf8ziP3z+mMV/hPwxi/+I+WMW/5Hyxyz+I+ePWfxHyR+z+I+aP2bxHy1/zOI/ev6YxX+M/DGL/5j5Yxb/sfLHLP5j549Z/D+VP2bxHyd/zOI/bv6Yxf/T+WMW//Hyxyz+4+ePWfw/kz9m8Z8gf8zi/9n8MYv/hPljFv+J8scs/hPnj1n8J8kfs/hPmj9m8f9c/pjFf7L8MYv/5PljFv8p8scs/lPmj1n8p8ofs/h/Pn/M4j91/pjF/wv5Yxb/L+aPWfy/lD9m8f9y/pjF/yv5Yxb/r+aPWfynyR+z+E+bP2bxny5/zOI/ff6YxX+G/DGL/4z5Yxb/r+WPWfxnyh+z+M+cP2bxnyV/7B/8h1425ic8pv9PfYT/rPljlu3/6/ljFv/Z8scs/t/IH7P4fzN/zOI/e/6Yxf9b+WMW/znyxyz+c+aPWfznyh+z+M+dP2bxnyd/zOI/b/6YxX++/DGL//z5Yxb/BfLHLP4L5o9Z/L+dP2bx/07+mMV/ofwxi/9388cs/gvnj1n8v5c/ZvH/fv6YxX+R/DGL/6L5Yxb/xfLHLP6L549Z/JfIH7P4L5k/ZvH/Qf6YxX+p/DGL/w/zxyz+P8ofs/gvnT9m8V8mf8ziv2z+mMV/ufwxi/+P88cs/svnj1n8V8gfs/j/JH/M4r9i/pjFf6X8MYv/yvljFv9V8scs/qvmj1n8V8sfs/ivnj9m8f9p/pjFf438MYv/mvljFv+18scs/mvnj1n818kfs/ivmz9m8f9Z/pjFf738MYv/+vljFv8N8scs/j/PH7P4b5g/ZvH/Rf6YxX+j/DGL/8b5Yxb/TfLHLP6/zB+z+P8qf8ziv2n+mMV/s/wxi//m+WMW/y3yxyz+W+aPWfy3yh+z+G+dP2bx3yZ/zOK/bf6YxX+7/DGL/6/zxyz+v8kfs/hvnz9m8d8hf8ziv2P+mMV/p/wxi/9v88cs/r/LH7P4/z5/zOK/c/6YxX+X/LH/VP8RP+T/h/yx/1T/gQ/5/zF/zOK/a/6Yxf9P+WMW/93yxyz+u+ePWfz3yB+z+P85f8zi/5f8MYv/nvljFv+98scs/nvnj1n898kfs/jvmz9m8d8vf8ziv3/+mMX/gPwxi/+B+WMW/4Pyxyz+B+ePWfwPyR+z+B+aP2bxPyx/zOJ/eP6Yxf+I/DGL/5H5Yxb/o/LHLP5H549Z/I/JH7P4H5s/ZvE/Ln/M4n98/pjF/4T8MYv/ifljFv+T8scs/ifnj1n8T8kfs/ifmj9m8T8tf8zif3r+mMX/jPwxi/+Z+WMW/7Pyxyz+Z+ePWfzPyR+z+J+bP2bxPy9/zOJ/fv6Yxf+C/DGL/4X5Yxb/i/LHLP4X549Z/C/JH7P4X5o/ZvG/LH/M4n95/pjF/4r8MYv/X/PHLP5X5o9Z/K/KH7P4X50/ZvG/Jn/M4n9t/pjF/7r8MYv/9fljFv8b8scs/jfmj1n8b8ofs/jfnD9m8b8lf8zif2v+mMX/tvwxi//t+WMW/zvyxyz+d+aPWfzvyh+z+N+dP2bxvyd/zOJ/b/6Yxf++/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/5MP+W/wvj+vfNIv/o23/mMX/sfwxi//j+WMW/yfyxyz+T+aPWfyfyh+z+D+dP2bxfyZ/zOL/bP6Yxf+5/DGL//P5Yxb/F/LHLP4v5o9Z/F/KH7P4v5w/ZvF/JX/M4v9q/pjF/7X8MYv/6/ljFv838scs/m/mj1n838ofs/i/nT9m8X8nf0ziP/pA/pjFf1D+mMV/mPwxi/+w+WMW/8H5Yxb/4fLHLP7D549Z/EfIH7P4j5g/ZvEfKX/M4j9y/pjFf5T8MYv/qPljFv/R8scs/qPnj1n8x8gfs/iPmT9m8R8rf8ziP3b+mMX/U/ljFv9x8scs/uPmj1n8P50/ZvEfL3/M4j9+/pjF/zP5Yxb/CfLHLP6fzR+z+E+YP2bxnyh/zOI/cf6YxX+S/DGL/6T5Yxb/z+WPWfwnyx+z+E+eP2bxnyJ/zOI/Zf6YxX+q/DGL/+fzxyz+U+ePWfy/kD9m8f9i/pjF/0v5Yxb/L+ePWfy/kj9m8f9q/pjFf5r8MYv/tPljFv/p8scs/tPnj1n8Z8gfs/jPmD9m8f9a/pjFf6b8MYv/zPljFv9Z8scs/rPmj1n8v54/ZvGfLX/M4v+N/DGL/zfzxyz+s+ePWfy/lT9m8Z8jf8ziP2f+mMV/rvwxi//c+WMW/3nyxyz+8+aPWfznyx+z+M+fP2bxXyB/zOK/YP6Yxf/b+WMW/+/kj1n8F8ofs/h/N3/M4r9w/pjF/3v5Yxb/7+ePWfwXyR+z+C+aP2bxXyx/zOK/eP6YxX+J/DGL/5L5Yxb/H+SPWfyXyh+z+P8wf8zi/6P8MYv/0vljFv9l8scs/svmj1n8l8sfs/j/OH/M4r98/pjFf4X8MYv/T/LHLP4r5o9Z/FfKH7P4r5w/ZvFfJX/M4r9q/pjFf7X8MYv/6vljFv+f5o9Z/NfIH7P4r5k/ZvFfK3/M4r92/pjFf538MYv/uvljFv+f5Y9Z/NfLH7P4r58/ZvHfIH/M4v/z/DGL/4b5Yxb/X+SPWfw3yh+z+G+cP2bx3yR/zOL/y/wxi/+v8scs/pvmj1n8N8sfs/hvnj9m8d8if8ziv2X+mMV/q/wxi//W+WMW/23yxyz+2+aPWfy3yx+z+P86f8zi/5v8MYv/9vljFv8d8scs/jvmj1n8d8ofs/j/Nn/M4v+7/DGL/+/zxyz+O+ePWfx3yR+z+P8hf8zi/8f8MYv/rvljFv8/5Y9Z/HfLH7P4754/ZvHfI3/M4v/n/DGL/1/yxyz+e+aPWfz3yh+z+O+dP2bx3yd/zOK/b/6YxX+//DGL//75Yxb/A/LHLP4H5o9Z/A/KH7P4H5w/ZvE/JH/M4n9o/pjF/7D8MYv/4fljFv8j8scs/kfmj1n8j8ofs/gfnT9m8T8mf8zif2z+mMX/uPwxi//x+WMW/xPyxyz+J+aPWfxPyh+z+J+cP2bxPyV/zOJ/av6Yxf+0/DGL/+n5Yxb/M/LHLP5n5o9Z/M/KH7P4n50/ZvE/J3/M4n9u/pjF/7z8MYv/+fljFv8L8scs/hfmj1n8L8ofs/hfnD9m8b8kf8zif2n+mMX/svwxi//l+WMW/yvyxyz+f80fs/hfmT9m8b8qf8zif3X+mMX/mvwxi/+1+WMW/+vyxyz+1+ePWfxvyB+z+N+YP2bxvyl/zOJ/c/6Yxf+W/DGL/635Yxb/2/LHLP63549Z/O/IH7P435k/ZvG/K3/M4n93/pjF/578MYv/vfljFv/78scs/vfnj1n8H8gfs/g/mD9m8X8of8zi/3D+mMX/kfwxi/+j+WMW/8fyxyz+j+ePWfyfyB+z+D+ZP2bxfyp/zOL/dP6Yxf+Z/DGL/7P5Yxb/5/LHLP7P549Z/F/IH7P4v5g/ZvF/KX/M4v9y/pjF/5X8MYv/q/ljFv/X8scs/q/nj1n838gfs/i/mT9m8X8rf8zi/3b+mMX/nfwxif8YA/ljFv9B+WMW/2Hyxyz+w+aPWfwH549Z/IfLH7P4D58/ZvEfIX/M4j9i/pjFf6T8MYv/yPljFv9R8scs/qPmj1n8R8sfs/iPnj9m8R8jf8ziP2b+mMV/rPwxi//Y+WMW/0/lj1n8x8kfs/iPmz9m8f90/pjFf7z8MYv/+PljFv/P5I9Z/CfIH7P4fzZ/zOI/Yf6YxX+i/DGL/8T5Yxb/SfLHLP6T5o9Z/D+X//+PnbsP97qu7zj+454sZ592Xeo122UXGnNtRiKjUQtRUTzenDLRzHuEw01yIzcSYApstFLHpkvdLNjEwjFnq5Y43Fx3KxqWNVsjtlY5xbUwxhwsMmfsOnAOwdnbc+182ffr8v14/ME5v9/x/Ut5Xi9/Py+uq1CW/sP0D2Xpf5z+oSz9j9c/lKX/a/UPZek/XP9Qlv6/oH8oS/8T9A9l6f+L+oey9H+d/qEs/X9J/1CW/r+sfyhL/xP1D2Xp/3r9Q1n6j9A/lKX/G/QPZel/kv6hLP1H6h/K0v9k/UNZ+o/SP5Sl/6/oH8rSf7T+oSz936h/KEv/X9U/lKX/GP1DWfq/Sf9Qlv5v1j+Upf+v6R/K0v8t+oey9B+rfyhL/1P0D2XpP07/UJb+p+ofytL/NP1DWfqfrn8oS//x+oey9D9D/1CW/mfqH8rSf4L+oSz9z9I/lKV/m/6hLP3P1j+Upf85+oey9D9X/1CW/ufpH8rSv13/UJb+b9U/lKX/2/QPZel/vv6hLP3frn8oS/8L9A9l6T9R/1CW/hfqH8rS/yL9Q1n6v0P/UJb+F+sfytL/nfqHsvS/RP9Qlv6X6h/K0v8y/UNZ+l+ufyhL/yv0D2Xpf6X+oSz9r9I/lKX/JP1DWfpfrX8oS//J+oey9J+ifyhL/w79Q1n6T9U/lKX/NP1DWfpP1z+Upf8M/UNZ+r9L/1CW/tfoH8rSf6b+oSz9Z+kfytJ/tv6hLP3n6B/K0v9a/UNZ+s/VP5Sl/zz9Q1n6z9c/lKX/Av1DWfpfp38oS/+F+oey9H+3/qEs/RfpH8rSf7H+oSz9l+gfytL/ev1DWfq/R/9Qlv436B/K0v9G/UNZ+i/VP5Sl/zL9Q1n6L9c/lKX/r+sfytL/N/QPZem/Qv9Qlv7v1T+Upf9v6h/K0v99+oey9H+//qEs/W/SP5Sl/836h7L0v0X/UJb+v6V/KEv/lfqHsvT/bf1DWfr/jv6hLP1v1T+Upf9t+oey9P9d/UNZ+n9A/1CW/rfrH8rS/w79Q1n636l/KEv/39M/lKX/7+sfytL/Lv1DWfp/UP9Qlv4f0j+Upf8q/UNZ+q/WP5Sl/x/oH8rS/w/1D2Xpf7f+oSz91+gfytL/Hv1DWfp/WP9Qlv4f0T+Upf9a/UNZ+t+rfyhL/z/SP5Sl/zr9Q1n6/7H+oSz979M/lKX/n+gfytL/fv1DWfp/VP9Qlv5/qn8oS/+P6R/K0v/j+oey9P+E/qEs/f9M/1CW/p/UP5Sl/wP6h7L0X69/KEv/B/UPZen/5/qHsvTfoH8oS/+H9A9l6f8X+oey9P9L/UNZ+j+sfyhL/7/SP5Sl/6f0D2Xp/2n9Q1n6f0b/UJb+n9U/lKX/5/QPZen/1/qHsvT/vP6hLP2/oH8oS/+N+oey9P+i/qEs/f9G/1CW/pv0D2Xp/4j+oSz9v6R/KEv/L+sfytL/Uf1DWfp/Rf9Qlv5f1T+Upf/f6h/K0v8x/UNZ+n9N/1CW/n+nfyhL/6/rH8rS/+/1D2Xpv1n/UJb+39A/lKX/Fv1DWfr/g/6hLP3/Uf9Qlv7f1D+Upf8/6R/K0v9b+oey9P+2/qEs/b+jfyhL/8f1D2Xp/8/6h7L0f0L/UJb+T+ofytJ/q/6hLP2f0j+Upf+/6B/K0v+7+oey9P9X/UNZ+n9P/1CW/tv0D2Xp/7T+oSz9v69/KEv/7fqHsvT/N/1DWfrv0D+Upf+/6x/K0v8Z/UNZ+v+H/qEs/XfqH8rSf5f+oSz9/1P/UJb+P9A/lKX/bv1DWfr/UP9Qlv7P6h/K0v9H+oey9H9O/1CW/v+lfyhL/+f1D2Xp/2P9Q1n679E/lKT/K1v6h7L076d/KEv//vqHsvQfoH8oS/+B+oey9B+kfyhL/8H6h7L0H6J/KEv/ofqHsvR/mf6hLP0P0z+Upf/L9Q9l6f8K/UNZ+h+ufyhL/5/RP5Sl/xH6h15y/QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6/mb94yTWTZs7smOcb3/jGN/u/ebH/zQQAAPxf+8mH/hf77wQAAAAAAAAAAAAAAAAAAADyauL/TuzF/mcEAAAAAAAAAAAAAICfdm3tp24f0O+gpwYc+ODnH+3Y+3XU7ounr137YOn+2vXjc4KX7H/ggz179uxZ/czY8V0Ph7Rarc7/tVd2PR7a87jz9Zcdu+rofY/KuM/f+fgVEw8/d9762wZ+Y/Ut7U8P2vvsoNZVU2fM7HhD/1arnD6otajzwUn9Wq1y5qDWrZ0PRnY+mDCota7zwcl7H7ys9ZnOB6+fPGfmlM4nzqr8ewYvFW3ty1oDDlps66B/Gxy4/2XHPjG9+2svL9n9agNbXfsftv5LR/X4WbcX2H/365dTe+6/z/+AwAvq2/6f3dL9tZeX/B/v/x/etHtJ9LMX3n/365fT7B/qE3z+P2ijPT/39/j8/5rgJfffnzJ00+2d+2+78L5Xdz018H/z+f8nr19O77n//gd9/u/8HD+++/P/kFarnHGIvx2QSlv78u29vf/3vv+BP9fjpt+B+7/nK1tf0bn/e59rreh6alAf9z++t/f/m3r8vQJ909a+Zk+P9/8+7L81PHjJ/fvftv7wvZ//t94/+cgDftaX/Z/Rc/8jFsy6dsT8xUtOnDFr0rSOaR2zx4wcfdKoMWNGjx6x9xPBvl8P8TcFkji09//WYT1u+rVaHfvvN953y/jO/e94aMVHup4a2sf9n9nr+/9rvP9DaFj/1uDBrUWTFiyYd9K+X7sfjtz3676/LNh/H/77/7gTuv6y7j8z7NdqHb3/fvgVY4Z07v/6uWVD11OD+7j/Cb3uf9zBf1YJ9M0hvv9P6XFz0P5P2Xbjws79H/+DV23teqqv//1/Vq/7v9v7PxyKtvZWrW+infs/ecjys6tdlzZ//gf1aWL/x+68dVe163K2/UN9mtj/xJVvvrradTnH/qE+Tez/wVlXrqx2Xc61f6hPE/t//md3HVPtupxn/1CfJvb/2HefWlvturTbP9Snif1/8K72k6tdl7faP9Snif2feN0Px1a7Lm+zf6hPE/uf+vIL1lW7LufbP9Snif2fvee0I6tdl7fbP9Snif33W/69ZdWuywX2D/VpYv9PTlo5p9p1mWj/UJ8m9r/u2OHPVrsuF9o/1KeJ/a94+o0Tql2Xi+wf6tPE/r96x6rHql2Xd9g/1KeJ/X/isletqnZdLrZ/qE8T+//RsIcOq3Zd3mn/UJ8m9r9587oHql2XS+wf6tPE/levGzCs2nW51P6hPk3sf+lZ0x6tdl0us3+oTxP7HzX6y5dWuy6X2z/Up4n9H/25bz1V7bpcYf9Qnyb2f8HDC+dXuy5X2j/Up4n9Lzzm4z+udl2usn+oTxP7f0vHMdOrXZdJ9g/1aWL/5bbDNle7LlfbP9Snif1fsmPNuGrXZbL9Q32a2P+GI77wsWrXZYr9Q32a2P/OubPHVLsuHfYP9Wli/99579L3VbsuU+0f6tPE/m9/7uul2nWZZv9Qnyb2v23kJZdVuy7T7R/q08T+15z7zCPVrssM+4f6NLH/lRseX1DturzL/qE+Tex/48Zznqh2Xa6xf6hPE/s/fviIw6tdl5n2D/VpYv9zLl7xoWrXZZb9Q32a2P/p99/x2mrXZbb9Q32a2P/Qr439ZLXrMsf+oT5N7P/TY9//qWrX5Vr7h/o0sf9d4447odp1mWv/UJ8m9r/lgZF3Vrsu8+wf6tPE/j/wyF0Vr8t8+4f6NLH/ua97fke167LA/qE+Tez/TRMvWlztulxn/1CfJvZ/5N0Tvljtuiy0f6hPE/u//NvfP7/adXm3/UN9mtj/cUdd/epq12WR/UN9mtj/9Bmbbq52XRbbP9Snif2PX71lVLXrssT+oT5N7P+IJ+ffU+26XG//UJ8m9r99wFHnVbsu77F/qE8T+7/3hoe/We263GD/UJ8m9n/zTR/tqHZdbrR/qE8T+//s7sE7q12XpfYPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/zQ4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAPHAgAAAADC/K2D6N0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICjAAAA//8mu+jL") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x80) openat(0xffffffffffffff9c, 0x0, 0x165840, 0x2) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r4, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, 0x0, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x4e23, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e21, 0x9, @local, 0x4f1}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x4e21, 0x80, @mcast1={0xff, 0x7}, 0x6}}, {{0xa, 0x4e22, 0x0, @empty, 0xfffffff7}}}, 0x108) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): ] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.927257][ T51] Bluetooth: hci1: command tx timeout [ 80.932705][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.941551][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.964899][ T5777] veth0_vlan: entered promiscuous mode [ 81.006796][ T51] Bluetooth: hci0: command tx timeout [ 81.012244][ T51] Bluetooth: hci3: command tx timeout [ 81.018317][ T5086] Bluetooth: hci2: command tx timeout [ 81.045285][ T5778] veth0_macvtap: entered promiscuous mode [ 81.063863][ T5777] veth1_vlan: entered promiscuous mode [ 81.095060][ T5778] veth1_macvtap: entered promiscuous mode [ 81.150061][ T5779] veth0_macvtap: entered promiscuous mode [ 81.160897][ T2947] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.183490][ T2947] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.184205][ T5779] veth1_macvtap: entered promiscuous mode [ 81.202203][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.214013][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.225242][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.269784][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.280402][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.292352][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.302513][ T5777] veth0_macvtap: entered promiscuous mode [ 81.314955][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.323121][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.332562][ T5778] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.342841][ T5778] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.352795][ T5778] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.361885][ T5778] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.375189][ T5777] veth1_macvtap: entered promiscuous mode [ 81.389696][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.400756][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.411836][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.422426][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.435212][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.446351][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.458035][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.469030][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.479533][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.490896][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.504774][ T5779] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.513712][ T5779] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.524458][ T5779] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.533605][ T5779] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.578109][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.589823][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.600411][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.610914][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.620925][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.631381][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.643449][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.710785][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.721777][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.745921][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.758818][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.771054][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.784015][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.796945][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.839378][ T5777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.850037][ T5777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.860707][ T5777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.869984][ T5777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.976063][ T4509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.992895][ T4509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.089833][ T4509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.130504][ T4509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.256503][ T2947] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.285348][ T2947] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.008512][ T51] Bluetooth: hci1: command tx timeout [ 83.057560][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.073113][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.086160][ T51] Bluetooth: hci3: command tx timeout [ 83.090444][ T3489] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.091573][ T51] Bluetooth: hci2: command tx timeout [ 83.101859][ T5086] Bluetooth: hci0: command tx timeout [ 83.133861][ T3489] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.005942][ T1141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.128030][ T1141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.065486][ T5860] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6'. [ 85.086412][ T5789] Bluetooth: hci1: command tx timeout [ 85.165991][ T5086] Bluetooth: hci3: command tx timeout [ 85.171573][ T5086] Bluetooth: hci2: command tx timeout [ 85.175948][ T5789] Bluetooth: hci0: command tx timeout [ 85.359391][ T5865] syz.1.7[5865]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 85.800323][ T5865] loop1: detected capacity change from 0 to 4096 [ 85.847446][ T5865] ntfs3: loop1: Different NTFS sector size (4096) and media sector size (512). [ 86.043926][ T5868] loop0: detected capacity change from 0 to 32768 [ 86.105867][ T5868] XFS (loop0): DAX unsupported by block device. Turning off DAX. [ 86.119079][ T5868] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 86.158272][ T5865] ntfs3: loop1: Failed to initialize $Extend/$Reparse. [ 86.317471][ T5868] XFS (loop0): Ending clean mount [ 86.327198][ T5880] syzkaller0: entered promiscuous mode [ 86.334791][ T5868] XFS (loop0): Quotacheck needed: Please wait. [ 86.338763][ T5880] syzkaller0: entered allmulticast mode [ 86.358282][ T5779] ntfs3: loop1: ino=1a, ntfs_sync_fs failed, -22. [ 86.367582][ T5779] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 86.407516][ T5868] XFS (loop0): Quotacheck: Done. [ 86.722256][ T5778] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 86.859903][ T9] cfg80211: failed to load regulatory.db [ 86.889925][ T5889] Zero length message leads to an empty skb [ 86.987977][ T5892] syzkaller0: entered promiscuous mode [ 86.993504][ T5892] syzkaller0: entered allmulticast mode [ 87.161784][ T5895] Bluetooth: MGMT ver 1.22 [ 87.171379][ T5896] bridge0: entered promiscuous mode [ 87.185396][ T5896] vlan2: entered promiscuous mode [ 88.424437][ T5905] UDC core: g1: couldn't find an available UDC or it's busy [ 88.491661][ T5909] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.666093][ T5914] syz_tun: entered allmulticast mode [ 89.061114][ T5784] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 89.309758][ T5924] ======================================================= [ 89.309758][ T5924] WARNING: The mand mount option has been deprecated and [ 89.309758][ T5924] and is ignored by this kernel. Remove the mand [ 89.309758][ T5924] option from the mount to silence this warning. [ 89.309758][ T5924] ======================================================= [ 90.046384][ T5784] usb 1-1: Using ep0 maxpacket: 32 [ 90.066801][ T5784] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 90.075244][ T5784] usb 1-1: config 0 has no interface number 0 [ 90.088084][ T5931] syzkaller0: entered promiscuous mode [ 90.093628][ T5931] syzkaller0: entered allmulticast mode [ 90.102142][ T5784] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 90.118471][ T5784] usb 1-1: config 0 interface 196 has no altsetting 0 [ 90.138992][ T5784] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 90.154546][ T5784] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.167774][ T5784] usb 1-1: Product: syz [ 90.171968][ T5784] usb 1-1: Manufacturer: syz [ 90.180382][ T5784] usb 1-1: SerialNumber: syz [ 90.206009][ T27] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 90.216830][ T5784] usb 1-1: config 0 descriptor?? [ 90.232829][ T5916] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 90.662653][ T5935] loop3: detected capacity change from 0 to 32768 [ 90.677722][ T5935] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.30 (5935) [ 90.724400][ T5935] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 90.735330][ T5935] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 90.744160][ T5935] BTRFS info (device loop3): using free space tree [ 90.859452][ T27] usb 2-1: unable to get BOS descriptor or descriptor too short [ 90.879005][ T27] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 90.912908][ T27] usb 2-1: can't read configurations, error -71 [ 90.922546][ T5935] BTRFS info (device loop3): enabling ssd optimizations [ 90.930458][ T5935] BTRFS info (device loop3): auto enabling async discard [ 91.004282][ T5784] ipheth 1-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 91.079633][ T5784] ipheth: probe of 1-1:0.196 failed with error -71 [ 91.126110][ T5784] usb 1-1: USB disconnect, device number 2 [ 91.354447][ T5780] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 93.302336][ T5966] Mass Storage Function, version: 2009/09/11 [ 93.313186][ T5966] LUN: removable file: (no medium) [ 93.345773][ T28] audit: type=1800 audit(1787631711.347:2): pid=5966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.35" name="file" dev="configfs" ino=7031 res=0 errno=0 [ 93.379674][ T5842] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 93.595799][ T5842] usb 2-1: Using ep0 maxpacket: 32 [ 93.746715][ T5842] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 93.894385][ T5842] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 94.109651][ T5842] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 94.173071][ T5842] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 94.504924][ T5842] usb 2-1: config 0 interface 0 has no altsetting 0 [ 94.530389][ T5842] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 94.911919][ T5975] loop3: detected capacity change from 0 to 256 [ 94.951168][ T5842] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 94.969197][ T5977] netlink: 4 bytes leftover after parsing attributes in process `syz.0.39'. [ 94.995689][ C0] sched: RT throttling activated [ 94.996205][ T5842] usb 2-1: Product: syz [ 95.014025][ T5977] wg0: entered promiscuous mode [ 95.019727][ T5977] wg0: entered allmulticast mode [ 95.058443][ T5842] usb 2-1: Manufacturer: syz [ 95.074876][ T5842] usb 2-1: SerialNumber: syz [ 95.112494][ T5842] usb 2-1: config 0 descriptor?? [ 95.295966][ T5842] usb 2-1: can't set config #0, error -71 [ 95.403487][ T5842] usb 2-1: USB disconnect, device number 4 [ 96.148405][ T5985] syzkaller0: entered promiscuous mode [ 96.222529][ T5985] syzkaller0: entered allmulticast mode [ 98.450158][ T6014] netlink: 68 bytes leftover after parsing attributes in process `syz.1.51'. [ 100.114087][ T6028] syzkaller0: entered promiscuous mode [ 100.124276][ T6028] syzkaller0: entered allmulticast mode [ 102.355583][ T6040] loop0: detected capacity change from 0 to 1024 [ 103.560838][ T49] hfsplus: b-tree write err: -5, ino 25 [ 103.584977][ T49] hfsplus: b-tree write err: -5, ino 4 [ 103.590971][ T49] hfsplus: b-tree write err: -5, ino 2 [ 104.879557][ T6075] binder: 6074:6075 unknown command 0 [ 104.895820][ T6075] binder: 6074:6075 ioctl c0306201 2000000001c0 returned -22 [ 106.238606][ T5086] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 106.257050][ T5086] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 106.269266][ T5086] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 106.291308][ T5086] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 106.299255][ T5086] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 106.307034][ T5086] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 106.313696][ T6098] bridge_slave_0: left allmulticast mode [ 106.331161][ T6098] bridge_slave_0: left promiscuous mode [ 106.338193][ T6098] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.382949][ T6098] bridge_slave_1: left allmulticast mode [ 106.388920][ T6098] bridge_slave_1: left promiscuous mode [ 106.405017][ T6098] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.463368][ T6098] bond0: (slave bond_slave_0): Releasing backup interface [ 106.563796][ T6098] bond0: (slave bond_slave_1): Releasing backup interface [ 106.724462][ T6098] team0: Port device team_slave_0 removed [ 106.882318][ T6098] team0: Port device team_slave_1 removed [ 106.952592][ T6098] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.011794][ T6098] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.146761][ T6098] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.179138][ T6098] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.442323][ T6098] syz.3.78 (6098) used greatest stack depth: 20712 bytes left [ 107.534572][ T6101] team0: Mode changed to "loadbalance" [ 107.600975][ T6109] jffs2: notice: (6109) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 107.698183][ T49] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.879623][ T49] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.899587][ T6112] syzkaller0: entered promiscuous mode [ 107.905101][ T6112] syzkaller0: entered allmulticast mode [ 107.955013][ T49] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.024668][ T6117] syzkaller0: entered promiscuous mode [ 108.031263][ T6117] syzkaller0: entered allmulticast mode [ 108.066058][ T49] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.199159][ T6121] loop0: detected capacity change from 0 to 4095 [ 108.304962][ T6121] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 108.324989][ T6121] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 108.333413][ T6121] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 108.361178][ T6121] loop0: [ 108.367310][ T5086] Bluetooth: hci2: command tx timeout [ 108.442478][ T6095] chnl_net:caif_netlink_parms(): no params data found [ 108.610155][ T6128] binder_alloc: 6127: pid 6127 spamming oneway? 2 buffers allocated for a total size of 5120 [ 108.669344][ T6128] binder_alloc: 6127: pid 6127 spamming oneway? 3 buffers allocated for a total size of 5128 [ 108.838404][ T6095] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.840967][ T6140] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 108.855943][ T6095] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.873710][ T6095] bridge_slave_0: entered allmulticast mode [ 108.878272][ T5086] Bluetooth: hci0: unexpected subevent 0x0e length: 30 > 15 [ 108.887087][ T6095] bridge_slave_0: entered promiscuous mode [ 108.912373][ T6095] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.919831][ T6095] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.928897][ T6095] bridge_slave_1: entered allmulticast mode [ 108.936977][ T6095] bridge_slave_1: entered promiscuous mode [ 109.020763][ T6095] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.039751][ T6095] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.123111][ T6095] team0: Port device team_slave_0 added [ 109.133990][ T6095] team0: Port device team_slave_1 added [ 109.210652][ T6095] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.219267][ T6095] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.245539][ T6095] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.278178][ T6095] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.286263][ T6095] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.314418][ T6095] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.363550][ T6095] hsr_slave_0: entered promiscuous mode [ 109.371072][ T6095] hsr_slave_1: entered promiscuous mode [ 109.377965][ T6095] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 109.388051][ T6095] Cannot create hsr debugfs directory [ 110.448194][ T5086] Bluetooth: hci2: command tx timeout [ 111.659501][ T6182] trusted_key: syz.1.96 sent an empty control message without MSG_MORE. [ 112.306864][ T49] hsr_slave_0: left promiscuous mode [ 112.416687][ T49] hsr_slave_1: left promiscuous mode [ 112.526229][ T5086] Bluetooth: hci2: command tx timeout [ 112.533407][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.560582][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 112.614023][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.621698][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 112.631296][ T49] bridge_slave_1: left allmulticast mode [ 112.638175][ T49] bridge_slave_1: left promiscuous mode [ 112.646002][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.659158][ T49] bridge_slave_0: left allmulticast mode [ 112.665614][ T49] bridge_slave_0: left promiscuous mode [ 112.671980][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.704762][ T49] veth1_macvtap: left promiscuous mode [ 112.713994][ T49] veth0_macvtap: left promiscuous mode [ 112.720683][ T49] veth1_vlan: left promiscuous mode [ 112.726440][ T49] veth0_vlan: left promiscuous mode [ 113.299046][ T8] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 113.459849][ T49] team0 (unregistering): Port device team_slave_1 removed [ 113.501118][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 113.502561][ T49] team0 (unregistering): Port device team_slave_0 removed [ 113.517256][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 113.537097][ T8] usb 2-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 113.546388][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.577892][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 113.637215][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 113.823598][ T8] usb 2-1: USB disconnect, device number 5 [ 113.945131][ T49] bond0 (unregistering): Released all slaves [ 114.018529][ T6095] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 114.035076][ T6095] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 114.071055][ T6095] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 114.110480][ T6095] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 114.346659][ T6095] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.387007][ T6095] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.433966][ T3449] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.441201][ T3449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.495426][ T3449] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.502657][ T3449] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.638128][ T5086] Bluetooth: hci2: command tx timeout [ 114.850458][ T6224] netlink: 4 bytes leftover after parsing attributes in process `syz.1.101'. [ 115.705052][ T6095] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.886113][ T8] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 116.092237][ T8] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 116.148200][ T8] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 116.229385][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.987693][ T8] usb 2-1: config 0 descriptor?? [ 117.108129][ T8] pwc: Askey VC010 type 2 USB webcam detected. [ 117.258509][ T6095] veth0_vlan: entered promiscuous mode [ 117.278911][ T6095] veth1_vlan: entered promiscuous mode [ 117.298177][ T6265] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 117.389797][ T6095] veth0_macvtap: entered promiscuous mode [ 117.419388][ T6095] veth1_macvtap: entered promiscuous mode [ 117.466086][ T27] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 117.469539][ T6095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.520753][ T6095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.533753][ T8] pwc: recv_control_msg error -32 req 02 val 2b00 [ 117.550499][ T6095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.570881][ T8] pwc: recv_control_msg error -32 req 02 val 2700 [ 117.581543][ T6095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.595126][ T8] pwc: recv_control_msg error -32 req 02 val 2c00 [ 117.607946][ T6095] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.620219][ T8] pwc: recv_control_msg error -32 req 04 val 1000 [ 117.633110][ T8] pwc: recv_control_msg error -32 req 04 val 1300 [ 117.642388][ T6095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.658200][ T6095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.668592][ T8] pwc: recv_control_msg error -32 req 04 val 1400 [ 117.686459][ T8] pwc: recv_control_msg error -32 req 02 val 2000 [ 117.692956][ T27] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 117.709885][ T6095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.712342][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.720442][ T8] pwc: recv_control_msg error -32 req 02 val 2100 [ 117.735225][ T6095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.746201][ T8] pwc: recv_control_msg error -32 req 04 val 1500 [ 117.765745][ T27] usb 4-1: Product: syz [ 117.767686][ T6095] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.777185][ T27] usb 4-1: Manufacturer: syz [ 117.777204][ T27] usb 4-1: SerialNumber: syz [ 117.823421][ T6278] netlink: 'syz.0.110': attribute type 4 has an invalid length. [ 117.852356][ T6095] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.863310][ T6095] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.872979][ T6095] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.888794][ T6095] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.901551][ T6278] netlink: 'syz.0.110': attribute type 4 has an invalid length. [ 117.954505][ T8] pwc: recv_control_msg error -71 req 02 val 2400 [ 117.981013][ T8] pwc: recv_control_msg error -71 req 02 val 2600 [ 118.044909][ T8] pwc: recv_control_msg error -71 req 02 val 2900 [ 118.067302][ T8] pwc: recv_control_msg error -71 req 02 val 2800 [ 118.068594][ T27] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 118.104748][ T8] pwc: recv_control_msg error -71 req 04 val 1100 [ 118.122300][ T8] pwc: recv_control_msg error -71 req 04 val 1200 [ 118.133653][ T27] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 118.166526][ T8] pwc: Registered as video103. [ 118.187346][ T8] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 118.204261][ T3449] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.244447][ T3449] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.250453][ T8] usb 2-1: USB disconnect, device number 6 [ 118.328953][ T6283] syzkaller0: entered promiscuous mode [ 118.344718][ T6283] syzkaller0: entered allmulticast mode [ 118.372968][ T3449] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.414604][ T3449] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.665862][ T6292] comedi comedi3: comedi_test: 256 microvolt, 15 microsecond waveform attached [ 119.148120][ T6307] syzkaller0: entered promiscuous mode [ 119.179988][ T6307] syzkaller0: entered allmulticast mode [ 119.692874][ T6318] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 119.840011][ T6325] syz_tun: entered allmulticast mode [ 119.862584][ T6325] syz_tun: left allmulticast mode [ 119.966734][ T27] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000080. ret = -71 [ 120.004550][ T27] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 120.030119][ T27] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 120.066138][ T27] lan78xx: probe of 4-1:1.0 failed with error -71 [ 120.107547][ T27] usb 4-1: USB disconnect, device number 2 [ 120.229626][ T6335] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 120.244988][ T6335] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 122.286240][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 122.375816][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 123.258637][ T6379] process 'syz.0.127' launched './file0' with NULL argv: empty string added [ 123.767338][ T6372] loop4: detected capacity change from 0 to 32768 [ 124.339768][ T6393] syzkaller0: entered promiscuous mode [ 124.355562][ T6393] syzkaller0: entered allmulticast mode [ 124.363555][ T6392] syzkaller0: entered promiscuous mode [ 124.375868][ T6392] syzkaller0: entered allmulticast mode [ 125.918575][ T6420] loop3: detected capacity change from 0 to 131072 [ 125.978311][ T6420] F2FS-fs (loop3): Wrong CP boundary, start(512) end(1536) blocks(0) [ 125.989316][ T6420] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 126.003844][ T6420] F2FS-fs (loop3): invalid crc value [ 126.065346][ T6420] F2FS-fs (loop3): Found nat_bits in checkpoint [ 126.151953][ T6420] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 126.159325][ T6420] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 126.513744][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802619c000: rx timeout, send abort [ 126.836154][ T6438] loop1: detected capacity change from 0 to 512 [ 126.943700][ T6438] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 126.995144][ T6438] ext4 filesystem being mounted at /36/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 127.014801][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802619e400: rx timeout, send abort [ 127.023486][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802619c000: abort rx timeout. Force session deactivation [ 127.288969][ T6438] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 15: comm syz.1.137: lblock 2 mapped to illegal pblock 15 (length 1) [ 127.322292][ T6438] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 127.345025][ T6438] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.137: Failed to commit dquot type 0 [ 127.362286][ T6438] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #4: block 19: comm syz.1.137: lblock 2 mapped to illegal pblock 19 (length 1) [ 127.381660][ T6438] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 127.404068][ T6438] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.137: Failed to commit dquot type 1 [ 127.424229][ T6438] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Out of memory [ 127.442818][ T6438] EXT4-fs error (device loop1): ext4_dirty_inode:6144: inode #18: comm syz.1.137: mark_inode_dirty error [ 127.464792][ T6438] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 15: comm syz.1.137: lblock 2 mapped to illegal pblock 15 (length 1) [ 127.486924][ T6438] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 127.495332][ T6438] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.137: Failed to commit dquot type 0 [ 127.513736][ T6438] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #4: block 19: comm syz.1.137: lblock 2 mapped to illegal pblock 19 (length 1) [ 127.523109][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802619e400: abort rx timeout. Force session deactivation [ 127.565519][ T6438] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 127.578680][ T6438] EXT4-fs error (device loop1): ext4_write_dquot:6933: comm syz.1.137: Failed to commit dquot type 1 [ 127.837573][ T5779] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 127.945194][ T5824] kernel write not supported for file /sequencer2 (pid: 5824 comm: kworker/0:6) [ 128.545034][ T6468] loop1: detected capacity change from 0 to 1024 [ 128.608992][ T6468] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 128.635178][ T6468] ext4 filesystem being mounted at /38/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 128.671663][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: comm syz.1.143: lblock 0 mapped to illegal pblock 0 (length 6) [ 128.696922][ T6468] EXT4-fs error (device loop1): ext4_ext_remove_space:2957: inode #15: comm syz.1.143: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 128.749361][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 3: comm syz.1.143: lblock 3 mapped to illegal pblock 3 (length 3) [ 128.768144][ T6468] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 128.780493][ T6468] EXT4-fs (loop1): This should not happen!! Data will be lost [ 128.780493][ T6468] [ 128.827155][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #15: block 3: comm syz.1.143: lblock 3 mapped to illegal pblock 3 (length 1) [ 128.871774][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #15: block 3: comm syz.1.143: lblock 3 mapped to illegal pblock 3 (length 1) [ 128.916061][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #15: block 3: comm syz.1.143: lblock 3 mapped to illegal pblock 3 (length 1) [ 128.969372][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #15: block 3: comm syz.1.143: lblock 3 mapped to illegal pblock 3 (length 1) [ 128.969976][ T62] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 8: comm kworker/u4:5: lblock 8 mapped to illegal pblock 8 (length 8) [ 129.031252][ T6468] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #15: block 3: comm syz.1.143: lblock 3 mapped to illegal pblock 3 (length 1) [ 129.089059][ T62] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 129.144405][ T6474] loop4: detected capacity change from 0 to 2048 [ 129.147375][ T62] EXT4-fs (loop1): This should not happen!! Data will be lost [ 129.147375][ T62] [ 129.171963][ T6474] NILFS: invalid option "cp=0x0000000000000000": invalid checkpoint number 0 [ 129.200735][ T6477] EXT4-fs error (device loop1): ext4_free_blocks:6694: comm syz.1.143: Freeing blocks not in datazone - block = 8, count = 8 [ 129.479947][ T5779] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 129.968213][ T6491] netlink: 'syz.1.149': attribute type 1 has an invalid length. [ 130.004790][ T6491] bond1: entered promiscuous mode [ 130.010388][ T6491] 8021q: adding VLAN 0 to HW filter on device bond1 [ 130.142217][ T6491] 8021q: adding VLAN 0 to HW filter on device bond1 [ 130.149431][ T6491] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 130.165768][ T6491] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 130.192483][ T6491] bond1: (slave ip6gre1): making interface the new active one [ 130.250227][ T6491] ip6gre1: entered promiscuous mode [ 130.270431][ T6491] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 130.813411][ T6498] syzkaller0: entered promiscuous mode [ 130.826738][ T6498] syzkaller0: entered allmulticast mode [ 130.883101][ T6498] tipc: Started in network mode [ 130.916248][ T6498] tipc: Node identity 06656ab9546e, cluster identity 4711 [ 130.924079][ T6498] tipc: Enabled bearer , priority 0 [ 130.971002][ T6497] tipc: Resetting bearer [ 131.065257][ T6497] tipc: Disabling bearer [ 131.994983][ T6541] mmap: syz.1.159 (6541) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 132.637241][ T6554] syz.4.162 uses obsolete (PF_INET,SOCK_PACKET) [ 132.931801][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.957088][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.563516][ T6565] loop3: detected capacity change from 0 to 256 [ 133.587883][ T6565] exfat: Deprecated parameter 'utf8' [ 133.593361][ T6565] exfat: Deprecated parameter 'utf8' [ 133.621152][ T6565] exfat: Deprecated parameter 'namecase' [ 133.641517][ T6565] exFAT-fs (loop3): failed to load upcase table (idx : 0x00011f41, chksum : 0x01284b2f, utbl_chksum : 0xe619d30d) [ 133.675780][ T5843] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 133.885954][ T5843] usb 2-1: Using ep0 maxpacket: 32 [ 133.897286][ T5843] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 133.905399][ T5843] usb 2-1: config 0 has no interface number 0 [ 133.916047][ T5843] usb 2-1: config 0 interface 12 has no altsetting 0 [ 133.925164][ T5843] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 133.939120][ T5843] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.947222][ T5843] usb 2-1: Product: syz [ 133.951393][ T5843] usb 2-1: Manufacturer: syz [ 133.956141][ T5843] usb 2-1: SerialNumber: syz [ 133.969792][ T5843] usb 2-1: config 0 descriptor?? [ 134.323392][ T6581] loop0: detected capacity change from 0 to 1024 [ 134.333451][ T6580] syzkaller0: entered promiscuous mode [ 134.344321][ T6580] syzkaller0: entered allmulticast mode [ 134.453188][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.470948][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.514440][ T6585] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.545423][ T6585] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.582707][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.606018][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.637065][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.657290][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.756113][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.763709][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.821106][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.855909][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.889678][ T6585] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.913820][ T6585] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.989859][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 134.998617][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.056504][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.064052][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.082861][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.091629][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.116335][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.135833][ T6581] hfsplus: request for non-existent node 33423360 in B*Tree [ 135.210466][ T6602] loop3: detected capacity change from 0 to 512 [ 135.231730][ T6602] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 135.286388][ T6602] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 135.314468][ T6602] EXT4-fs (loop3): 1 truncate cleaned up [ 135.326648][ T6602] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 135.560772][ T6610] syzkaller0: entered promiscuous mode [ 135.567669][ T6610] syzkaller0: entered allmulticast mode [ 136.620049][ T5843] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 136.754710][ T5843] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 136.845462][ T5843] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 136.965387][ T5843] f81534: probe of 2-1:0.12 failed with error -71 [ 137.022568][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.055846][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 138.390015][ T5843] usb 2-1: USB disconnect, device number 7 [ 138.619179][ T6627] loop1: detected capacity change from 0 to 256 [ 138.634749][ T6623] syzkaller0: entered promiscuous mode [ 138.654192][ T6623] syzkaller0: entered allmulticast mode [ 138.823559][ T6632] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.843934][ T6632] netlink: 'syz.1.180': attribute type 4 has an invalid length. [ 138.867441][ T6632] netlink: 'syz.1.180': attribute type 5 has an invalid length. [ 138.894716][ T6632] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.180'. [ 139.037935][ T6640] tipc: Failed to remove unknown binding: 66,0,0/0:3972998112/3972998114 [ 139.059348][ T6640] tipc: Failed to remove unknown binding: 66,0,0/0:3972998112/3972998113 [ 139.087342][ T6640] tipc: Failed to remove unknown binding: 66,0,0/0:3972998112/3972998114 [ 139.112423][ T6640] tipc: Failed to remove unknown binding: 66,0,0/0:3972998112/3972998113 [ 139.388841][ T6646] bridge0: entered allmulticast mode [ 139.538560][ T6647] ubi16: attaching mtd0 [ 139.547923][ T6647] ubi16: scanning is finished [ 139.552703][ T6647] ubi16 error: ubi_read_volume_table: the layout volume was not found [ 139.730543][ T6647] ubi16 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 141.158934][ T6671] loop4: detected capacity change from 0 to 256 [ 141.327033][ T6671] exFAT-fs (loop4): error, invalid access to FAT (entry 0x00000005) bogus content (0xff0006ff) [ 141.338445][ T6671] exFAT-fs (loop4): failed to count the number of clusters in root [ 141.346648][ T6671] exFAT-fs (loop4): failed to recognize exfat type [ 142.223511][ T28] audit: type=1800 audit(1787631760.237:3): pid=6662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.185" name="pnp_string" dev="configfs" ino=10755 res=0 errno=0 [ 142.421940][ T6680] loop4: detected capacity change from 0 to 32768 [ 142.433719][ T6680] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.189 (6680) [ 142.507219][ T6680] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 142.517593][ T6680] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 142.527961][ T6680] BTRFS info (device loop4): use zlib compression, level 3 [ 142.535206][ T6680] BTRFS info (device loop4): turning on sync discard [ 142.542015][ T6680] BTRFS info (device loop4): using free space tree [ 142.550150][ T6668] loop1: detected capacity change from 0 to 32768 [ 142.660792][ T28] audit: type=1800 audit(1787631760.677:4): pid=6668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.187" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 142.706791][ T6680] BTRFS info (device loop4): enabling ssd optimizations [ 142.949341][ T28] audit: type=1800 audit(1787631760.927:5): pid=6702 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.187" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 143.013525][ T6708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.190'. [ 143.166644][ T28] audit: type=1800 audit(1787631761.157:6): pid=6711 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.189" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 143.214100][ T5823] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 143.518244][ T6095] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 145.080454][ T5823] usb 2-1: unable to get BOS descriptor or descriptor too short [ 145.099963][ T5823] usb 2-1: no configurations [ 145.109268][ T5823] usb 2-1: can't read configurations, error -22 [ 146.426871][ T6751] syzkaller0: entered promiscuous mode [ 146.432407][ T6751] syzkaller0: entered allmulticast mode [ 146.471116][ T6753] loop3: detected capacity change from 0 to 256 [ 147.707113][ T6777] jffs2: notice: (6777) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 147.943341][ T6783] overlayfs: failed to resolve './bus': -2 [ 150.065809][ T27] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 150.280012][ T27] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 150.290623][ T27] usb 5-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 150.303910][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.329369][ T6805] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 150.348960][ T27] opticon 5-1:1.0: opticon converter detected [ 150.504262][ T27] usb 5-1: opticon converter now attached to ttyUSB0 [ 152.754214][ T5823] usb 5-1: USB disconnect, device number 2 [ 152.791210][ T5823] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 152.814825][ T5823] opticon 5-1:1.0: device disconnected [ 154.564861][ T6850] loop0: detected capacity change from 0 to 32768 [ 154.595927][ T6850] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 scanned by syz.0.219 (6850) [ 154.624168][ T6850] BTRFS info (device loop0): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 154.636032][ T6850] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 154.646059][ T6850] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 154.656316][ T6850] BTRFS info (device loop0): use lzo compression, level 0 [ 154.663470][ T6850] BTRFS info (device loop0): force clearing of disk cache [ 154.671596][ T6850] BTRFS info (device loop0): using free space tree [ 154.722371][ T6857] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5779] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[6857] [ 154.776421][ T6850] BTRFS info (device loop0): enabling ssd optimizations [ 154.783431][ T6850] BTRFS info (device loop0): auto enabling async discard [ 154.792200][ T6850] BTRFS info (device loop0): rebuilding free space tree [ 156.467861][ T5778] BTRFS info (device loop0): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 158.323685][ T6899] loop0: detected capacity change from 0 to 32768 [ 158.353099][ T6899] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 scanned by syz.0.221 (6899) [ 158.398963][ T6919] syzkaller0: entered promiscuous mode [ 158.414693][ T6899] BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 158.427892][ T6919] syzkaller0: entered allmulticast mode [ 158.448032][ T6899] BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm [ 159.787526][ T6899] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 159.875986][ T6899] BTRFS info (device loop0): use zstd compression, level 3 [ 159.898496][ T6899] BTRFS info (device loop0): using free space tree [ 159.949586][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-worker": -EINTR [ 159.954107][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-delalloc": -EINTR [ 160.011488][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-fixup": -EINTR [ 160.034062][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio": -EINTR [ 160.054860][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-meta": -EINTR [ 160.074925][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-rmw": -EINTR [ 160.087588][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-write": -EINTR [ 160.097720][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-compressed-write": -EINTR [ 160.110014][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-freespace-write": -EINTR [ 160.124618][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-delayed-meta": -EINTR [ 160.138249][ T6899] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 160.171702][ T6899] BTRFS error (device loop0): open_ctree failed: -12 [ 161.555611][ T6963] futex_wake_op: syz.3.232 tries to shift op by 144; fix this program [ 161.565492][ T6963] futex_wake_op: syz.3.232 tries to shift op by 144; fix this program [ 162.667207][ T5086] Bluetooth: hci0: Malformed LE Event: 0x0d [ 165.423026][ T6973] netlink: 12 bytes leftover after parsing attributes in process `syz.0.235'. [ 168.766873][ T7001] loop3: detected capacity change from 0 to 8192 [ 168.829256][ T7001] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 168.853064][ T7001] REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal [ 168.862602][ T7001] REISERFS (device loop3): using ordered data mode [ 168.869595][ T7001] reiserfs: using flush barriers [ 168.907336][ T7001] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 169.567835][ T7001] REISERFS (device loop3): checking transaction log (loop3) [ 169.805114][ T7001] REISERFS (device loop3): Using tea hash to sort names [ 169.821363][ T7001] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 169.956993][ T7001] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 2) [ 170.029714][ T7001] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 2) [ 170.093808][ T7001] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 4) [ 170.136171][ T7001] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 4) [ 170.145562][ T7011] unsupported nlmsg_type 40 [ 170.246154][ T7001] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 4) [ 170.773829][ T5823] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 170.845231][ T5823] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 172.537888][ T7036] loop4: detected capacity change from 0 to 32768 [ 172.594006][ T7036] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 172.604708][ T7036] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 172.661822][ T7038] Bluetooth: MGMT ver 1.22 [ 172.812883][ T7036] XFS (loop4): Ending clean mount [ 172.830834][ T7036] XFS (loop4): Quotacheck needed: Please wait. [ 172.904999][ T7036] XFS (loop4): Quotacheck: Done. [ 173.091911][ T7057] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 173.311023][ T7062] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 173.345851][ T7062] CIFS: Attempting to mount //127.0.0.1/share [ 173.707758][ T6095] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 173.718597][ T7061] syzkaller0: entered promiscuous mode [ 173.720664][ T7062] CIFS: VFS: Error connecting to socket. Aborting operation. [ 173.724193][ T7061] syzkaller0: entered allmulticast mode [ 173.731965][ T7062] CIFS: VFS: cifs_mount failed w/return code = -111 [ 174.285430][ T7073] loop4: detected capacity change from 0 to 1024 [ 174.353105][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.381521][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.427491][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.435283][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.480343][ T7076] loop0: detected capacity change from 0 to 512 [ 174.500034][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.531714][ T7076] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 174.548179][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.585648][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.602818][ T7076] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2855: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 174.629845][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.731431][ T7076] EXT4-fs (loop0): 1 truncate cleaned up [ 174.752921][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 174.799822][ T7076] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 174.855223][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.160808][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.217639][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.432421][ T7086] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.503158][ T7086] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.681682][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.705911][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.737600][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 175.800279][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.842120][ T7073] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.888642][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 175.904868][ T7074] hfsplus: request for non-existent node 33423360 in B*Tree [ 176.101748][ T7101] loop4: detected capacity change from 0 to 64 [ 176.393277][ T7103] loop3: detected capacity change from 0 to 512 [ 176.456332][ T7103] EXT4-fs (loop3): 1 truncate cleaned up [ 176.496903][ T7103] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 177.016169][ T7111] EXT4-fs error (device loop3): ext4_validate_block_bitmap:439: comm syz.3.270: bg 0: block 465: padding at end of block bitmap is not set [ 177.571078][ T7111] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 177.584485][ T7111] EXT4-fs (loop3): This should not happen!! Data will be lost [ 177.584485][ T7111] [ 177.594275][ T7111] EXT4-fs (loop3): Total free blocks count 0 [ 177.600304][ T7111] EXT4-fs (loop3): Free/Dirty block details [ 177.606277][ T7111] EXT4-fs (loop3): free_blocks=0 [ 177.611281][ T7111] EXT4-fs (loop3): dirty_blocks=66 [ 177.616510][ T7111] EXT4-fs (loop3): Block reservation details [ 177.622544][ T7111] EXT4-fs (loop3): i_reserved_data_blocks=66 [ 177.795153][ T12] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 64 with error 28 [ 178.078471][ T7123] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 [ 178.136141][ T5843] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 179.256954][ T5843] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 179.930280][ T5843] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 179.945844][ T5843] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 179.954927][ T5843] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 179.976089][ T5843] usb 1-1: Product: syz [ 179.983266][ T5843] usb 1-1: config 0 descriptor?? [ 179.992051][ T5843] hub 1-1:0.0: USB hub found [ 180.198942][ T5843] hub 1-1:0.0: 1 port detected [ 181.591949][ T5843] hub 1-1:0.0: activate --> -90 [ 181.998086][ T27] usb 1-1: USB disconnect, device number 3 [ 184.490170][ T27] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 184.769343][ T27] usb 5-1: config 0 has no interfaces? [ 184.775154][ T27] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 184.791043][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.804719][ T27] usb 5-1: config 0 descriptor?? [ 184.834975][ T7192] binder: 7191:7192 ioctl c0306201 200000000080 returned -14 [ 184.850921][ T7192] binder: 7191:7192 ioctl c0306201 2000000003c0 returned -14 [ 185.067853][ T27] usb 5-1: USB disconnect, device number 3 [ 186.494016][ T7206] loop3: detected capacity change from 0 to 512 [ 186.518682][ T7206] EXT4-fs: Ignoring removed oldalloc option [ 187.417643][ T7213] syzkaller0: entered promiscuous mode [ 187.928110][ T7213] syzkaller0: entered allmulticast mode [ 188.091579][ T7206] ext3: Unknown parameter 'defcontext' [ 188.203968][ T7225] loop1: detected capacity change from 0 to 512 [ 188.365729][ T7225] EXT4-fs error (device loop1): ext4_get_branch:178: inode #13: block 1024: comm syz.1.302: invalid block [ 188.409003][ T7225] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.302: invalid indirect mapped block 1024 (level 0) [ 188.549688][ T7225] EXT4-fs error (device loop1): ext4_validate_block_bitmap:439: comm syz.1.302: bg 0: block 35: padding at end of block bitmap is not set [ 188.841835][ T7225] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 189.002090][ T7225] EXT4-fs (loop1): 1 truncate cleaned up [ 189.025232][ T7231] loop3: detected capacity change from 0 to 128 [ 189.060938][ T7225] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 189.234551][ T7235] syz.3.303: attempt to access beyond end of device [ 189.234551][ T7235] loop3: rw=2049, sector=145, nr_sectors = 360 limit=128 [ 189.317523][ T7238] loop4: detected capacity change from 0 to 128 [ 189.382129][ T7238] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 189.389283][ T5779] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.419405][ T7231] syz.3.303: attempt to access beyond end of device [ 189.419405][ T7231] loop3: rw=524288, sector=145, nr_sectors = 224 limit=128 [ 189.446191][ T7238] ext4 filesystem being mounted at /49/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 189.453786][ T7231] syz.3.303: attempt to access beyond end of device [ 189.453786][ T7231] loop3: rw=0, sector=145, nr_sectors = 8 limit=128 [ 189.481740][ T7235] syz.3.303: attempt to access beyond end of device [ 189.481740][ T7235] loop3: rw=0, sector=150, nr_sectors = 1 limit=128 [ 190.806178][ T7231] syz.3.303: attempt to access beyond end of device [ 190.806178][ T7231] loop3: rw=0, sector=145, nr_sectors = 1 limit=128 [ 190.838421][ T7231] Buffer I/O error on dev loop3, logical block 145, async page read [ 190.855950][ T7231] syz.3.303: attempt to access beyond end of device [ 190.855950][ T7231] loop3: rw=0, sector=146, nr_sectors = 1 limit=128 [ 190.901284][ T7231] Buffer I/O error on dev loop3, logical block 146, async page read [ 190.944408][ T7231] syz.3.303: attempt to access beyond end of device [ 190.944408][ T7231] loop3: rw=0, sector=147, nr_sectors = 1 limit=128 [ 191.068625][ T7231] Buffer I/O error on dev loop3, logical block 147, async page read [ 191.088756][ T7231] syz.3.303: attempt to access beyond end of device [ 191.088756][ T7231] loop3: rw=0, sector=148, nr_sectors = 1 limit=128 [ 191.149292][ T7231] Buffer I/O error on dev loop3, logical block 148, async page read [ 191.184874][ T7231] syz.3.303: attempt to access beyond end of device [ 191.184874][ T7231] loop3: rw=0, sector=149, nr_sectors = 1 limit=128 [ 191.198921][ T7231] Buffer I/O error on dev loop3, logical block 149, async page read [ 191.209109][ T7231] syz.3.303: attempt to access beyond end of device [ 191.209109][ T7231] loop3: rw=0, sector=150, nr_sectors = 1 limit=128 [ 191.225156][ T7231] Buffer I/O error on dev loop3, logical block 150, async page read [ 191.233634][ T7231] Buffer I/O error on dev loop3, logical block 151, async page read [ 191.567738][ T7231] Buffer I/O error on dev loop3, logical block 152, async page read [ 192.359863][ T7256] warning: `syz.1.309' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 192.501592][ T6095] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 192.633879][ T7254] syzkaller0: entered promiscuous mode [ 192.642953][ T7254] syzkaller0: entered allmulticast mode [ 193.169921][ T7261] kvm: requested 52800 ns i8254 timer period limited to 200000 ns [ 193.184854][ T7261] kvm: requested 144152 ns i8254 timer period limited to 200000 ns [ 193.206695][ T7261] kvm: requested 99733 ns i8254 timer period limited to 200000 ns [ 193.222633][ T7261] kvm: requested 43580 ns i8254 timer period limited to 200000 ns [ 193.233676][ T7261] kvm: requested 23466 ns i8254 timer period limited to 200000 ns [ 193.244563][ T7261] kvm: requested 19276 ns i8254 timer period limited to 200000 ns [ 193.256770][ T7261] kvm: requested 184381 ns i8254 timer period limited to 200000 ns [ 193.264961][ T7261] kvm: requested 166781 ns i8254 timer period limited to 200000 ns [ 193.273655][ T7261] kvm: requested 124038 ns i8254 timer period limited to 200000 ns [ 193.282215][ T7261] kvm: requested 25980 ns i8254 timer period limited to 200000 ns [ 193.539820][ T7272] syzkaller0: entered promiscuous mode [ 193.558034][ T7272] syzkaller0: entered allmulticast mode [ 194.371579][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.388892][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.864073][ T7295] syzkaller0: entered promiscuous mode [ 194.888482][ T7295] syzkaller0: entered allmulticast mode [ 196.222239][ T7305] syzkaller0: entered promiscuous mode [ 196.266195][ T7305] syzkaller0: entered allmulticast mode [ 197.755890][ T7307] loop4: detected capacity change from 0 to 4096 [ 197.790321][ T7307] ntfs: (device loop4): parse_options(): Invalid mft_zone_multiplier. Using default value, i.e. 1. [ 197.932628][ T7307] ntfs: volume version 3.1. [ 198.084965][ T7307] ntfs: (device loop4): ntfs_read_block(): Failed to read from inode 0x6, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 198.138073][ T7307] ntfs: (device loop4): ntfs_read_block(): Failed to read from inode 0x6, attribute type 0x80, vcn 0x0, offset 0x800 because its location on disk could not be determined even after retrying (error code -5). [ 198.182410][ T7307] ntfs: (device loop4): ntfs_cluster_alloc(): Failed to map page. [ 198.217351][ T7307] ntfs: (device loop4): ntfs_cluster_alloc(): Failed to allocate clusters, aborting (error -5). [ 198.262918][ T7307] ntfs: (device loop4): ntfs_attr_extend_allocation(): Cannot extend allocation of inode 0x44, attribute type 0x80, because the allocation of clusters failed with error code -5. [ 198.699082][ T7321] CIFS: Attempting to mount //127.0.0.1/share [ 198.725270][ T7321] CIFS: VFS: Error connecting to socket. Aborting operation. [ 198.733219][ T7321] CIFS: VFS: cifs_mount failed w/return code = -111 [ 201.651891][ T7333] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 204.373718][ T7359] syz.3.339 (7359): drop_caches: 2 [ 207.595933][ T7408] syzkaller0: entered promiscuous mode [ 207.601512][ T7408] syzkaller0: entered allmulticast mode [ 207.984701][ T7415] xt_HMARK: spi-set and port-set can't be combined [ 210.662206][ T7448] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 210.804697][ T7448] CIFS: Attempting to mount //127.0.0.1/share [ 211.476711][ T7448] CIFS: VFS: Error connecting to socket. Aborting operation. [ 211.484208][ T7448] CIFS: VFS: cifs_mount failed w/return code = -4 [ 211.737527][ T7463] xt_HMARK: spi-set and port-set can't be combined [ 215.170296][ T7481] loop4: detected capacity change from 0 to 512 [ 215.325891][ T7481] EXT4-fs (loop4): 1 truncate cleaned up [ 215.355118][ T7481] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 217.121352][ T7492] EXT4-fs error (device loop4): ext4_validate_block_bitmap:439: comm syz.4.366: bg 0: block 465: padding at end of block bitmap is not set [ 217.174794][ T7492] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 217.187189][ T7492] EXT4-fs (loop4): This should not happen!! Data will be lost [ 217.187189][ T7492] [ 217.196883][ T7492] EXT4-fs (loop4): Total free blocks count 0 [ 217.202876][ T7492] EXT4-fs (loop4): Free/Dirty block details [ 217.208824][ T7492] EXT4-fs (loop4): free_blocks=0 [ 217.213775][ T7492] EXT4-fs (loop4): dirty_blocks=66 [ 217.219085][ T7492] EXT4-fs (loop4): Block reservation details [ 217.225076][ T7492] EXT4-fs (loop4): i_reserved_data_blocks=66 [ 217.857745][ T2947] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 64 with error 28 [ 218.035266][ T7495] futex_wake_op: syz.0.379 tries to shift op by 144; fix this program [ 218.044356][ T7495] futex_wake_op: syz.0.379 tries to shift op by 144; fix this program [ 219.217420][ T7506] syzkaller0: entered promiscuous mode [ 219.223128][ T7506] syzkaller0: entered allmulticast mode [ 219.316475][ T7508] ip_tables: iptables: counters copy to user failed while replacing table [ 222.515596][ T7538] xt_HMARK: spi-set and port-set can't be combined [ 223.535297][ T7539] Process accounting resumed [ 223.930438][ T7550] syz_tun (unregistering): left allmulticast mode [ 223.985345][ T7553] loop1: detected capacity change from 0 to 256 [ 227.970428][ T7578] loop1: detected capacity change from 0 to 1024 [ 230.547986][ T7598] syzkaller0: entered promiscuous mode [ 230.555720][ T7598] syzkaller0: entered allmulticast mode [ 230.896825][ T7609] hub 8-0:1.0: USB hub found [ 230.905557][ T7609] hub 8-0:1.0: 1 port detected [ 231.457238][ T23] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 231.651904][ T7613] loop3: detected capacity change from 0 to 64 [ 231.713046][ T7613] bio_check_eod: 2 callbacks suppressed [ 231.713061][ T7613] syz.3.406: attempt to access beyond end of device [ 231.713061][ T7613] loop3: rw=0, sector=1024, nr_sectors = 2 limit=64 [ 231.738604][ T7613] Buffer I/O error on dev loop3, logical block 512, async page read [ 231.749813][ T7613] syz.3.406: attempt to access beyond end of device [ 231.749813][ T7613] loop3: rw=0, sector=113152, nr_sectors = 2 limit=64 [ 231.772014][ T7613] Buffer I/O error on dev loop3, logical block 56576, async page read [ 231.808890][ T23] usb 1-1: config 0 has no interfaces? [ 231.828866][ T23] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 231.970725][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.011566][ T23] usb 1-1: config 0 descriptor?? [ 232.422134][ T23] usb 1-1: USB disconnect, device number 4 [ 235.787730][ T7631] tipc: Failed to remove unknown binding: 66,0,0/0:4109344749/4109344751 [ 235.807227][ T7631] tipc: Failed to remove unknown binding: 66,0,0/0:4109344749/4109344750 [ 235.853630][ T7631] tipc: Failed to remove unknown binding: 66,0,0/0:4109344749/4109344751 [ 235.889015][ T7631] tipc: Failed to remove unknown binding: 66,0,0/0:4109344749/4109344750 [ 236.413488][ T7642] syzkaller0: entered promiscuous mode [ 236.422129][ T7642] syzkaller0: entered allmulticast mode [ 236.484516][ T7643] netlink: 4 bytes leftover after parsing attributes in process `syz.0.413'. [ 237.343266][ T7652] netlink: 4 bytes leftover after parsing attributes in process `syz.3.417'. [ 237.715901][ T5842] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 238.126152][ T5842] usb 4-1: Using ep0 maxpacket: 16 [ 238.137005][ T5842] usb 4-1: config 1 has an invalid descriptor of length 240, skipping remainder of the config [ 238.155733][ T5842] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 238.170518][ T5842] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 238.203562][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.445793][ T5842] usb 4-1: Product: syz [ 239.475957][ T5842] usb 4-1: Manufacturer: syz [ 239.480611][ T5842] usb 4-1: SerialNumber: syz [ 239.787952][ T5842] usb 4-1: 0:2 : does not exist [ 239.814084][ T5842] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 239.904866][ T7669] loop1: detected capacity change from 0 to 128 [ 240.043367][ T7669] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 240.058249][ T7669] hpfs: filesystem error: improperly stopped [ 240.064337][ T7669] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 240.072194][ T7669] hpfs: You really don't want any checks? You are crazy... [ 240.079469][ T7669] hpfs: Code page directory magic doesn't match (magic = 7b3184b5) [ 240.087474][ T7669] hpfs: code page support is disabled [ 240.100899][ T7669] hpfs: hpfs_map_4sectors(): unaligned read [ 240.108242][ T7669] hpfs: hpfs_map_4sectors(): unaligned read [ 240.114197][ T7669] hpfs: filesystem error: unable to find root dir [ 240.345384][ T5842] usb 4-1: USB disconnect, device number 3 [ 240.544641][ T5771] udevd[5771]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 241.055083][ T7683] can0: slcan on ttyS3. [ 241.997053][ T7681] can0 (unregistered): slcan off ttyS3. [ 244.124807][ T7680] loop0: detected capacity change from 0 to 2048 [ 244.162059][ T7680] NILFS: invalid option "cp=0x0000000000000000": invalid checkpoint number 0 [ 247.397306][ T7762] loop3: detected capacity change from 0 to 512 [ 247.993516][ T7762] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 248.212145][ T7762] ext4 filesystem being mounted at /121/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 248.471146][ T7762] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #3: block 15: comm syz.3.444: lblock 2 mapped to illegal pblock 15 (length 1) [ 248.502399][ T7762] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 248.504235][ T7780] loop4: detected capacity change from 0 to 128 [ 248.515260][ T7762] EXT4-fs error (device loop3): ext4_write_dquot:6933: comm syz.3.444: Failed to commit dquot type 0 [ 248.550994][ T7762] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #4: block 19: comm syz.3.444: lblock 2 mapped to illegal pblock 19 (length 1) [ 248.854112][ T7762] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 248.917471][ T7762] EXT4-fs error (device loop3): ext4_write_dquot:6933: comm syz.3.444: Failed to commit dquot type 1 [ 249.102478][ T7762] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5940: Out of memory [ 249.147010][ T7762] EXT4-fs error (device loop3): ext4_dirty_inode:6144: inode #18: comm syz.3.444: mark_inode_dirty error [ 249.173950][ T7762] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #3: block 15: comm syz.3.444: lblock 2 mapped to illegal pblock 15 (length 1) [ 249.258576][ T7762] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 249.270605][ T7762] EXT4-fs error (device loop3): ext4_write_dquot:6933: comm syz.3.444: Failed to commit dquot type 0 [ 249.290441][ T7762] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #4: block 19: comm syz.3.444: lblock 2 mapped to illegal pblock 19 (length 1) [ 249.312857][ T7762] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 249.349271][ T7762] EXT4-fs error (device loop3): ext4_write_dquot:6933: comm syz.3.444: Failed to commit dquot type 1 [ 249.426151][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 249.998646][ T7803] loop4: detected capacity change from 0 to 16 [ 250.202772][ T7803] erofs: (device loop4): mounted with root inode @ nid 36. [ 250.237841][ T7805] loop3: detected capacity change from 0 to 1024 [ 250.344195][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.354146][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.368272][ T7808] syz.4.454: attempt to access beyond end of device [ 250.368272][ T7808] loop4: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 250.411478][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.413151][ T7808] syz.4.454: attempt to access beyond end of device [ 250.413151][ T7808] loop4: rw=0, sector=8, nr_sectors = 16 limit=16 [ 250.440758][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.459484][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.481119][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.527612][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.553517][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.594152][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.601976][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.627822][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.635759][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.652958][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.661914][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.722477][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.732151][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.773331][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.790725][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.825811][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.937852][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.959656][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 250.969348][ T7805] hfsplus: request for non-existent node 33423360 in B*Tree [ 255.821477][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.828085][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 262.081908][ T7909] tipc: Enabling of bearer rejected, failed to enable media [ 263.560960][ T7934] loop3: detected capacity change from 0 to 32768 [ 263.606748][ T7934] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop3 scanned by syz.3.488 (7934) [ 263.627987][ T7934] BTRFS info (device loop3): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 263.638350][ T7934] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 263.647181][ T7934] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 263.656489][ T7934] BTRFS info (device loop3): use lzo compression, level 0 [ 263.663611][ T7934] BTRFS info (device loop3): force clearing of disk cache [ 263.670774][ T7934] BTRFS info (device loop3): using free space tree [ 263.767908][ T7934] BTRFS info (device loop3): enabling ssd optimizations [ 263.774947][ T7934] BTRFS info (device loop3): auto enabling async discard [ 263.785401][ T7934] BTRFS info (device loop3): rebuilding free space tree [ 264.428989][ T7957] syz.3.488 (7957) used greatest stack depth: 20624 bytes left [ 264.661442][ T5780] BTRFS info (device loop3): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 264.978206][ T5979] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 11 /dev/loop3 scanned by udevd (5979) [ 266.822409][ T7979] netlink: 64 bytes leftover after parsing attributes in process `syz.1.495'. [ 267.851982][ T7983] can0: slcan on ttyS3. [ 269.856360][ T7981] can0 (unregistered): slcan off ttyS3. [ 270.562679][ T5823] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 271.417400][ T5823] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 271.441158][ T5823] usb 4-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 271.476764][ T5823] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.117245][ T7985] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 272.126372][ T5823] opticon 4-1:1.0: opticon converter detected [ 272.223692][ T5823] usb 4-1: opticon converter now attached to ttyUSB0 [ 272.705730][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 272.735757][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 272.765768][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 272.805791][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 272.825791][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 272.835733][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 272.855716][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 275.947108][ T8015] netlink: 12 bytes leftover after parsing attributes in process `syz.4.508'. [ 277.689594][ T5823] usb 4-1: USB disconnect, device number 4 [ 277.710616][ T5823] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 277.739610][ T5823] opticon 4-1:1.0: device disconnected [ 277.966147][ T8028] can0: slcan on ttyS3. [ 278.916199][ T8023] can0 (unregistered): slcan off ttyS3. [ 279.585057][ T8045] CIFS: Attempting to mount //127.0.0.1/share [ 280.440524][ T8045] CIFS: VFS: Error connecting to socket. Aborting operation. [ 281.181917][ T8045] CIFS: VFS: cifs_mount failed w/return code = -4 [ 281.617622][ T5823] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 281.676250][ T5823] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 281.802674][ T8054] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5778] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[8054] [ 284.305810][ T5823] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 285.033176][ T5823] usb 4-1: config 0 has no interfaces? [ 285.039654][ T5823] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 285.101609][ T5823] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.386788][ T5823] usb 4-1: config 0 descriptor?? [ 285.602002][ T8103] tipc: Enabled bearer , priority 0 [ 285.620237][ T8103] syzkaller0: entered promiscuous mode [ 285.633841][ T5842] usb 4-1: USB disconnect, device number 5 [ 285.634232][ T8103] syzkaller0: entered allmulticast mode [ 285.756537][ T8103] tipc: Resetting bearer [ 285.780424][ T8102] tipc: Resetting bearer [ 285.823655][ T8102] tipc: Disabling bearer [ 293.507726][ T8159] syzkaller0: entered promiscuous mode [ 293.513265][ T8159] syzkaller0: entered allmulticast mode [ 293.717875][ T8163] tipc: Started in network mode [ 293.724089][ T8163] tipc: Node identity 0a33de5374e3, cluster identity 4711 [ 293.733625][ T8163] tipc: Enabled bearer , priority 0 [ 293.743667][ T8163] syzkaller0: entered promiscuous mode [ 293.754709][ T8163] syzkaller0: entered allmulticast mode [ 293.838766][ T8163] tipc: Resetting bearer [ 295.106089][ T5823] tipc: Node number set to 2127617619 [ 295.132527][ T8162] tipc: Resetting bearer [ 295.171129][ T8162] tipc: Disabling bearer [ 295.395421][ T8171] loop3: detected capacity change from 0 to 1024 [ 298.039955][ T8190] IPv6: NLM_F_CREATE should be specified when creating new route [ 300.439625][ T8210] capability: warning: `syz.4.560' uses 32-bit capabilities (legacy support in use) [ 303.717709][ T8255] loop4: detected capacity change from 0 to 64 [ 307.132143][ T8298] netlink: 4 bytes leftover after parsing attributes in process `syz.3.579'. [ 309.945367][ T8306] Set syz1 is full, maxelem 6117 reached [ 310.824081][ T28] audit: type=1326 audit(1787631928.837:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8330 comm="syz.0.588" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff866d9e0d9 code=0x7fc00000 [ 310.972085][ T28] audit: type=1326 audit(1787631928.937:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8330 comm="syz.0.588" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff866d3f459 code=0x7fc00000 [ 315.221887][ T8362] netlink: 4 bytes leftover after parsing attributes in process `syz.4.591'. [ 317.320582][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.327082][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.955974][ T8329] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.980318][ T8329] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.027978][ T8329] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.066093][ T8329] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.218247][ T8364] team_slave_0: entered promiscuous mode [ 319.224257][ T8364] team_slave_1: entered promiscuous mode [ 319.248805][ T8364] vlan2: entered promiscuous mode [ 319.260208][ T8364] team0: entered promiscuous mode [ 326.352109][ T8406] syzkaller0: entered promiscuous mode [ 326.357786][ T8406] syzkaller0: entered allmulticast mode [ 326.407924][ T8429] syzkaller0: entered promiscuous mode [ 326.413446][ T8429] syzkaller0: entered allmulticast mode [ 337.780415][ T28] audit: type=1800 audit(1787631953.397:9): pid=8511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.623" name="attr_qid_max" dev="configfs" ino=18734 res=0 errno=0 [ 338.286377][ T5823] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 338.476051][ T5823] usb 4-1: Using ep0 maxpacket: 16 [ 338.483783][ T5823] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 338.509072][ T5823] usb 4-1: config 0 has no interface number 0 [ 338.518623][ T5823] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 338.535728][ T5823] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.543792][ T5823] usb 4-1: Product: syz [ 338.555770][ T5823] usb 4-1: Manufacturer: syz [ 338.560391][ T5823] usb 4-1: SerialNumber: syz [ 338.577652][ T5823] usb 4-1: config 0 descriptor?? [ 338.597104][ T5823] hub 4-1:0.132: bad descriptor, ignoring hub [ 338.615894][ T5823] hub: probe of 4-1:0.132 failed with error -5 [ 338.625517][ T5823] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input7 [ 338.713682][ T8534] syzkaller0: entered promiscuous mode [ 338.719641][ T8534] syzkaller0: entered allmulticast mode [ 338.742637][ T8534] tipc: Enabled bearer , priority 0 [ 338.784864][ T8534] tipc: Resetting bearer [ 338.804182][ T8533] tipc: Resetting bearer [ 338.829313][ T8533] tipc: Disabling bearer [ 339.127492][ T5784] usb 4-1: USB disconnect, device number 6 [ 339.902397][ T8550] bridge_slave_0: left allmulticast mode [ 339.910735][ T8550] bridge_slave_0: left promiscuous mode [ 339.937680][ T8550] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.000844][ T8550] bridge_slave_1: left allmulticast mode [ 340.018481][ T8550] bridge_slave_1: left promiscuous mode [ 340.042574][ T8550] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.072610][ T8550] bond0: (slave bond_slave_0): Releasing backup interface [ 340.089504][ T8550] bond0: (slave bond_slave_1): Releasing backup interface [ 341.095331][ T8550] team0: Port device team_slave_0 removed [ 341.120113][ T8550] team0: Port device team_slave_1 removed [ 341.127038][ T8550] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 341.134472][ T8550] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 341.143784][ T8550] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 341.165724][ T8550] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 341.332421][ T8553] netlink: 'syz.0.630': attribute type 10 has an invalid length. [ 341.389198][ T8553] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 341.424233][ T8563] syzkaller0: entered promiscuous mode [ 341.429868][ T8563] syzkaller0: entered allmulticast mode [ 348.105790][ T28] audit: type=1800 audit(1787631966.087:10): pid=8621 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.649" name="pnp_string" dev="configfs" ino=19046 res=0 errno=0 [ 356.030541][ T8641] wg0: left promiscuous mode [ 356.035289][ T8641] wg0: left allmulticast mode [ 358.856642][ T8641] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.865584][ T8641] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.875535][ T8641] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.884754][ T8641] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.006634][ T8656] tipc: Started in network mode [ 359.011562][ T8656] tipc: Node identity 76642d7067f, cluster identity 4711 [ 359.036146][ T8656] tipc: Enabled bearer , priority 0 [ 359.056686][ T8660] syzkaller0: entered promiscuous mode [ 359.062196][ T8660] syzkaller0: entered allmulticast mode [ 359.121505][ T8666] tipc: Resetting bearer [ 359.181425][ T8666] tipc: Disabling bearer [ 362.697233][ T8724] sd 0:0:1:0: PR command failed: 1026 [ 362.702965][ T8724] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 362.710035][ T8724] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 363.943882][ T8731] jffs2: notice: (8731) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 365.140969][ T5842] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 365.295796][ T5842] usb 4-1: device descriptor read/64, error -71 [ 366.678979][ T5842] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 367.086342][ T5842] usb 4-1: device descriptor read/64, error -71 [ 367.261861][ T8760] autofs4:pid:8760:autofs_fill_super: called with bogus options [ 367.269405][ T5842] usb usb4-port1: attempt power cycle [ 367.444709][ T8761] loop4: detected capacity change from 0 to 2048 [ 367.928775][ T8761] Alternate GPT is invalid, using primary GPT. [ 367.936661][ T8761] loop4: p2 p3 p7 [ 368.240270][ T8526] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 368.287614][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 368.529235][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 368.563541][ T9] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 368.639759][ T9] usb 2-1: config 0 has no interface number 0 [ 368.720684][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 368.799663][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.885134][ T8526] udevd[8526]: inotify_add_watch(7, /dev/loop4p2, 10) failed: No such file or directory [ 368.899048][ T8738] udevd[8738]: inotify_add_watch(7, /dev/loop4p7, 10) failed: No such file or directory [ 368.912268][ T8373] udevd[8373]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 368.922453][ T9] usb 2-1: Product: syz [ 368.930747][ T9] usb 2-1: Manufacturer: syz [ 368.940754][ T9] usb 2-1: SerialNumber: syz [ 368.968067][ T9] usb 2-1: config 0 descriptor?? [ 368.980856][ T9] hub 2-1:0.132: bad descriptor, ignoring hub [ 368.991251][ T9] hub: probe of 2-1:0.132 failed with error -5 [ 369.003899][ T9] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.132/input/input8 [ 369.031952][ T8777] fuse: Bad value for 'fd' [ 369.466276][ T5784] usb 2-1: USB disconnect, device number 10 [ 369.519790][ T8786] hfsplus: unable to find HFS+ superblock [ 370.574389][ T28] audit: type=1326 audit(1787631988.587:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8782 comm="syz.3.683" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7fc00000 [ 370.769140][ T8793] jffs2: notice: (8793) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 373.720438][ T28] audit: type=1326 audit(1787631991.737:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8816 comm="syz.3.692" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f81c4b9e0d9 code=0x0 [ 375.076462][ T8834] overlayfs: failed to clone upperpath [ 378.717307][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.723620][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.834496][ T8869] netlink: 'syz.3.708': attribute type 10 has an invalid length. [ 383.561227][ T8891] autofs4:pid:8891:autofs_fill_super: called with bogus options [ 384.679350][ T8891] loop3: detected capacity change from 0 to 2048 [ 384.896001][ T8891] Alternate GPT is invalid, using primary GPT. [ 384.902724][ T8891] loop3: p2 p3 p7 [ 385.444066][ T8526] udevd[8526]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 385.455389][ T8539] udevd[8539]: inotify_add_watch(7, /dev/loop3p7, 10) failed: No such file or directory [ 385.465354][ T8738] udevd[8738]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 385.730285][ T8373] udevd[8373]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 385.746736][ T8738] udevd[8738]: inotify_add_watch(7, /dev/loop3p7, 10) failed: No such file or directory [ 385.749554][ T8526] udevd[8526]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 388.282912][ T8938] autofs4:pid:8938:autofs_fill_super: called with bogus options [ 388.536031][ T5842] usb 2-1: new low-speed USB device number 11 using dummy_hcd [ 389.251471][ T8946] loop4: detected capacity change from 0 to 512 [ 389.278505][ T5842] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 389.287282][ T5842] usb 2-1: config 0 has no interface number 0 [ 389.297041][ T5842] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 389.316380][ T8946] EXT4-fs error (device loop4): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 389.333672][ T8946] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.727: corrupted inode contents [ 389.356590][ T8946] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #11: comm syz.4.727: mark_inode_dirty error [ 389.372220][ T8946] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.727: invalid indirect mapped block 1 (level 1) [ 389.387143][ T8946] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.727: corrupted inode contents [ 389.403792][ T5842] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 389.413788][ T8946] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 389.422942][ T5842] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 389.432291][ T8946] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.727: corrupted inode contents [ 389.445058][ T5842] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.455652][ T8946] EXT4-fs error (device loop4): ext4_truncate:4302: inode #11: comm syz.4.727: mark_inode_dirty error [ 389.470443][ T8946] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 389.481455][ T8946] EXT4-fs (loop4): 1 truncate cleaned up [ 389.490915][ T8946] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 389.515836][ T5842] usb 2-1: config 0 descriptor?? [ 390.497266][ T5842] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 390.617916][ T5842] usb 2-1: USB disconnect, device number 11 [ 391.036549][ T6095] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 393.540121][ T8971] netlink: 32 bytes leftover after parsing attributes in process `syz.3.732'. [ 393.935152][ T8975] loop3: detected capacity change from 0 to 512 [ 394.462062][ T8975] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.736: invalid indirect mapped block 28777 (level 2) [ 394.536429][ T8975] EXT4-fs (loop3): 1 truncate cleaned up [ 394.543428][ T8975] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 394.943413][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 395.997407][ T8992] CIFS: Attempting to mount //127.0.0.1/share [ 396.955932][ T8992] CIFS: VFS: Error connecting to socket. Aborting operation. [ 396.965989][ T8992] CIFS: VFS: cifs_mount failed w/return code = -4 [ 399.064838][ T9029] loop1: detected capacity change from 0 to 64 [ 401.695849][ T5823] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 402.685852][ T5823] usb 4-1: Using ep0 maxpacket: 8 [ 403.759764][ T9068] loop4: detected capacity change from 0 to 64 [ 405.117424][ T5823] usb 4-1: device descriptor read/all, error -71 [ 406.296880][ T9082] ceph: No mds server is up or the cluster is laggy [ 406.352725][ T5843] libceph: connect (1)[c::]:6789 error -101 [ 406.454210][ T5843] libceph: mon0 (1)[c::]:6789 connect error [ 406.865261][ T9087] loop4: detected capacity change from 0 to 64 [ 407.418193][ T23] usb 4-1: new low-speed USB device number 12 using dummy_hcd [ 407.744317][ T23] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 407.762963][ T23] usb 4-1: config 0 has no interface number 0 [ 407.774889][ T23] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 407.804647][ T23] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 407.831356][ T23] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 407.884146][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.955427][ T23] usb 4-1: config 0 descriptor?? [ 407.969037][ T23] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 408.728389][ T9096] iowarrior 4-1:0.1: Error -90 while submitting URB [ 408.760958][ T5843] usb 4-1: USB disconnect, device number 12 [ 410.296699][ T9123] Bluetooth: ISO socket layer initialized [ 413.092614][ T9142] loop3: detected capacity change from 0 to 64 [ 414.600321][ T9151] ubi0: attaching mtd0 [ 414.631262][ T9151] ubi0: scanning is finished [ 414.650464][ T9151] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 414.691543][ T9151] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 415.950879][ T9162] loop4: detected capacity change from 0 to 16 [ 416.943566][ T9162] erofs: (device loop4): mounted with root inode @ nid 36. [ 417.325885][ T8526] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 417.592216][ T9173] loop4: detected capacity change from 0 to 256 [ 418.649321][ T9] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 419.556101][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 419.571759][ T9186] loop1: detected capacity change from 0 to 128 [ 419.573417][ T9] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 420.794500][ T9] usb 4-1: config 179 has no interface number 0 [ 420.811551][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 420.824870][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 420.841007][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 420.853800][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 420.986675][ T9] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 421.205765][ T9] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 422.490568][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.534455][ T9] usb 4-1: can't set config #179, error -71 [ 422.663400][ T9] usb 4-1: USB disconnect, device number 13 [ 426.979219][ T9210] lo speed is unknown, defaulting to 1000 [ 426.985270][ T9210] lo speed is unknown, defaulting to 1000 [ 426.993112][ T9210] lo speed is unknown, defaulting to 1000 [ 427.003232][ T9210] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 427.016771][ T9210] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 427.042544][ T9210] lo speed is unknown, defaulting to 1000 [ 427.050082][ T9210] lo speed is unknown, defaulting to 1000 [ 427.056878][ T9210] lo speed is unknown, defaulting to 1000 [ 427.063343][ T9210] lo speed is unknown, defaulting to 1000 [ 427.524289][ T9220] loop4: detected capacity change from 0 to 32768 [ 428.441228][ T9220] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 429.871499][ T9220] XFS (loop4): Ending clean mount [ 429.967705][ T9220] XFS (loop4): Quotacheck needed: Please wait. [ 430.054716][ T9220] XFS (loop4): Quotacheck: Done. [ 430.227941][ T9243] block nbd3: NBD_DISCONNECT [ 430.811556][ T6095] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 433.534206][ T9266] loop3: detected capacity change from 0 to 64 [ 433.610031][ T9268] netlink: 32 bytes leftover after parsing attributes in process `syz.1.798'. [ 433.987515][ T9273] loop4: detected capacity change from 0 to 512 [ 435.152675][ T9273] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.808: invalid indirect mapped block 28777 (level 2) [ 435.243367][ T9273] EXT4-fs (loop4): 1 truncate cleaned up [ 435.252350][ T9273] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 436.347460][ T6095] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 438.979704][ T9299] lo speed is unknown, defaulting to 1000 [ 440.645416][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.655883][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.045874][ T28] audit: type=1800 audit(1787632061.977:13): pid=9340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.818" name="cdrom" dev="configfs" ino=21285 res=0 errno=0 [ 445.342187][ T28] audit: type=1800 audit(1787632063.357:14): pid=9345 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.826" name="cdrom" dev="configfs" ino=20452 res=0 errno=0 [ 445.572552][ T9347] loop3: detected capacity change from 0 to 64 [ 445.810938][ T9349] loop1: detected capacity change from 0 to 128 [ 447.158170][ T9363] netlink: 32 bytes leftover after parsing attributes in process `syz.4.828'. [ 455.597909][ T9403] netlink: 32 bytes leftover after parsing attributes in process `syz.1.838'. [ 460.203924][ T9423] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.850'. [ 460.237283][ T9422] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.850'. [ 461.718706][ T9435] lo speed is unknown, defaulting to 1000 [ 461.836299][ T9429] netlink: 24 bytes leftover after parsing attributes in process `syz.4.851'. [ 461.890288][ T9429] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 461.897121][ T9429] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 461.920528][ T9429] vhci_hcd vhci_hcd.0: Device attached [ 462.118390][ T9440] vhci_hcd: connection closed [ 462.129948][ T3489] vhci_hcd: stop threads [ 462.161350][ T3489] vhci_hcd: release socket [ 462.185844][ T23] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 462.209189][ T3489] vhci_hcd: disconnect device [ 462.550671][ T28] audit: type=1326 audit(1787632080.537:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 463.168481][ T28] audit: type=1326 audit(1787632080.547:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 463.297815][ T28] audit: type=1326 audit(1787632080.547:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f81c4b5e90e code=0x7ffc0000 [ 463.498661][ T28] audit: type=1326 audit(1787632080.547:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 463.835351][ T28] audit: type=1326 audit(1787632080.547:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 464.075587][ T28] audit: type=1326 audit(1787632080.547:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 464.114245][ T28] audit: type=1326 audit(1787632080.547:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 464.255938][ T28] audit: type=1326 audit(1787632080.547:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 464.315132][ T28] audit: type=1326 audit(1787632080.557:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 464.382235][ T28] audit: type=1326 audit(1787632080.557:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9445 comm="syz.3.853" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81c4b9e0d9 code=0x7ffc0000 [ 464.445324][ T9468] loop4: detected capacity change from 0 to 128 [ 465.595886][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 465.825751][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 465.851311][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 465.873028][ T9] usb 5-1: config 0 has no interfaces? [ 465.892220][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 465.904790][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.943170][ T9] usb 5-1: config 0 descriptor?? [ 466.024541][ T9482] loop1: detected capacity change from 0 to 1024 [ 466.191232][ T9482] hfsplus: detected inconsistent attributes file, running fsck.hfsplus is recommended. [ 466.910861][ T9478] Set syz1 is full, maxelem 6117 reached [ 466.945265][ T5823] usb 5-1: USB disconnect, device number 4 [ 467.325887][ T23] vhci_hcd: vhci_device speed not set [ 468.017197][ T9495] loop1: detected capacity change from 0 to 512 [ 468.096722][ T9496] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 468.104694][ T9496] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 468.400979][ T9495] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.868: invalid indirect mapped block 28777 (level 2) [ 468.676053][ T9495] EXT4-fs (loop1): 1 truncate cleaned up [ 468.830511][ T9495] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 469.007388][ T9501] loop4: detected capacity change from 0 to 512 [ 469.206778][ T9501] EXT4-fs error (device loop4): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 469.221325][ T9501] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.869: corrupted inode contents [ 469.245994][ T9501] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #11: comm syz.4.869: mark_inode_dirty error [ 469.257639][ T9501] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.869: invalid indirect mapped block 1 (level 1) [ 469.272842][ T9501] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.869: corrupted inode contents [ 469.285247][ T9501] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 469.294326][ T9501] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.869: corrupted inode contents [ 469.306405][ T9501] EXT4-fs error (device loop4): ext4_truncate:4302: inode #11: comm syz.4.869: mark_inode_dirty error [ 469.317884][ T9501] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 469.327245][ T9501] EXT4-fs (loop4): 1 truncate cleaned up [ 469.333616][ T9501] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 469.394508][ T5779] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 469.654091][ T9509] EXT4-fs error (device loop4): ext4_find_dest_de:2115: inode #2: block 13: comm syz.4.869: bad entry in directory: directory entry too close to block end - offset=76, inode=16, rec_len=940, size=1024 fake=0 [ 470.232018][ T6095] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 470.394640][ T5843] IPVS: starting estimator thread 0... [ 470.577629][ T9518] IPVS: using max 18 ests per chain, 43200 per kthread [ 473.816617][ T9541] se_device not configured yet, cannot port link [ 474.324182][ T28] kauditd_printk_skb: 8 callbacks suppressed [ 474.324641][ T28] audit: type=1800 audit(1787632092.307:33): pid=9551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.883" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 479.039472][ T9571] Bluetooth: hci0: invalid length 0, exp 2 for type 20 [ 490.342663][ T9630] (null): rxe_set_mtu: Set mtu to 256 [ 490.377929][ T9630] lo speed is unknown, defaulting to 1000 [ 490.411049][ T9630] lo speed is unknown, defaulting to 1000 [ 490.427936][ T9630] lo speed is unknown, defaulting to 1000 [ 490.815169][ T9630] infiniband syz1: set active [ 490.820388][ T9630] infiniband syz1: added lo [ 490.852269][ T5823] lo speed is unknown, defaulting to 1000 [ 490.961463][ T9630] RDS/IB: syz1: added [ 490.966920][ T9630] smc: adding ib device syz1 with port count 1 [ 490.973323][ T9630] smc: ib device syz1 port 1 has pnetid [ 490.982175][ T9630] lo speed is unknown, defaulting to 1000 [ 491.144765][ T9630] lo speed is unknown, defaulting to 1000 [ 491.312010][ T9630] lo speed is unknown, defaulting to 1000 [ 491.340038][ T5842] lo speed is unknown, defaulting to 1000 [ 491.488755][ T9630] lo speed is unknown, defaulting to 1000 [ 492.013909][ T9639] loop4: detected capacity change from 0 to 32768 [ 492.124758][ T9639] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 492.891484][ T9639] XFS (loop4): Ending clean mount [ 492.904530][ T9639] XFS (loop4): Quotacheck needed: Please wait. [ 492.968395][ T9657] loop1: detected capacity change from 0 to 128 [ 493.000994][ T9639] XFS (loop4): Quotacheck: Done. [ 493.826352][ T6095] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 496.228470][ T5842] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 496.556146][ T5842] usb 2-1: Using ep0 maxpacket: 32 [ 496.671631][ T5842] usb 2-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 496.691094][ T5842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.705746][ T5842] usb 2-1: Product: syz [ 496.710317][ T5842] usb 2-1: Manufacturer: syz [ 496.730131][ T5842] usb 2-1: SerialNumber: syz [ 496.756195][ T5842] usb 2-1: config 0 descriptor?? [ 496.769517][ T5842] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 496.789837][ T5842] dvb-usb: bulk message failed: -22 (4/0) [ 496.805957][ T5842] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 496.848446][ T5842] dvb-usb: bulk message failed: -22 (5/0) [ 496.908608][ T5842] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 497.504279][ T5842] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 497.514618][ T5842] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 497.525071][ T5842] usb 2-1: media controller created [ 497.788152][ T9684] dvb-usb: bulk message failed: -22 (7/0) [ 497.794294][ T9684] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 497.805065][ T9684] ttusb2: i2c transfer failed. [ 498.069157][ T5842] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 498.095362][ T5842] usb 2-1: selecting invalid altsetting 3 [ 498.116308][ T5842] ttusb2: set interface to alts=3 failed [ 499.245990][ T5842] DVB: Unable to find symbol tda10086_attach() [ 499.252175][ T5842] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 499.312018][ T5842] dvb-usb: bulk message failed: -22 (4/0) [ 499.372537][ T5842] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 499.556431][ T5842] dvb-usb: bulk message failed: -22 (5/0) [ 499.671799][ T5842] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 499.885947][ T5842] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 499.990071][ T5842] usb 2-1: USB disconnect, device number 12 [ 501.439602][ T5842] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 501.570838][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.577301][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.087467][ T9709] 9pnet_fd: Insufficient options for proto=fd [ 504.905037][ T9732] netlink: 24 bytes leftover after parsing attributes in process `syz.0.929'. [ 506.188061][ T9737] nvme_fabrics: missing parameter 'transport=%s' [ 506.209753][ T9737] nvme_fabrics: missing parameter 'nqn=%s' [ 506.261679][ T9747] loop1: detected capacity change from 0 to 512 [ 506.271499][ T9747] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 507.064591][ T9752] FAT-fs (loop1): error, fat_free_clusters: deleting FAT entry beyond EOF [ 508.002073][ T9759] comedi comedi0: comedi_config --init_data is deprecated [ 509.672968][ T9737] nvme nvme0: failed to connect socket: -512 [ 512.584060][ T9789] sctp: [Deprecated]: syz.0.942 (pid 9789) Use of int in maxseg socket option. [ 512.584060][ T9789] Use struct sctp_assoc_value instead [ 516.369776][ T28] audit: type=1800 audit(1787632134.137:34): pid=9808 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.946" name="file0" dev="fuse" ino=18446744073709551613 res=0 errno=0 [ 521.753078][ T28] audit: type=1800 audit(1787632139.767:35): pid=9849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.955" name="file0" dev="overlay" ino=1149 res=0 errno=0 [ 522.696048][ T5842] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 522.926325][ T5842] usb 2-1: Using ep0 maxpacket: 8 [ 522.943341][ T5842] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 523.446623][ T5842] usb 2-1: config 0 has no interfaces? [ 523.452178][ T5842] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 523.462011][ T5842] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.520304][ T5842] usb 2-1: config 0 descriptor?? [ 526.728197][ T9851] Set syz1 is full, maxelem 6117 reached [ 527.348400][ T5843] usb 2-1: USB disconnect, device number 13 [ 528.180826][ T9877] loop4: detected capacity change from 0 to 32768 [ 528.221691][ T9877] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 528.331847][ T9877] XFS (loop4): Ending clean mount [ 528.346681][ T9877] XFS (loop4): Quotacheck needed: Please wait. [ 528.495161][ T9877] XFS (loop4): Quotacheck: Done. [ 529.245490][ T6095] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 529.375836][ T5843] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 531.399434][ T5843] usb 2-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 531.414673][ T5843] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 537.718418][ T5843] dln2 2-1:1.0: USB write failed: -71 [ 537.724227][ T5843] dln2 2-1:1.0: failed to initialize hardware [ 537.768265][ C0] dln2 2-1:1.0: failed to resubmit RX URB: -1 [ 537.777410][ T5843] dln2: probe of 2-1:1.0 failed with error -71 [ 537.788428][ T5843] usb 2-1: USB disconnect, device number 14 [ 540.033461][ T9939] netlink: 8 bytes leftover after parsing attributes in process `syz.1.973'. [ 540.083368][ T9939] vlan2: entered allmulticast mode [ 540.088680][ T9939] dummy0: entered allmulticast mode [ 540.096759][ T9939] bridge0: port 3(vlan2) entered blocking state [ 540.103844][ T9939] bridge0: port 3(vlan2) entered disabled state [ 540.121687][ T9939] vlan2: entered promiscuous mode [ 540.126911][ T9939] dummy0: entered promiscuous mode [ 542.503219][ T9947] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 542.513831][ T9947] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 542.536409][ T9947] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 542.545513][ T9947] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 542.554255][ T9947] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 542.561712][ T9947] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 542.608753][ T5086] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 542.617927][ T5086] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 542.625290][ T5086] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 542.641523][ T5086] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 542.650468][ T5086] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 542.658244][ T5086] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 542.763442][ T9946] lo speed is unknown, defaulting to 1000 [ 542.810445][ T9946] lo speed is unknown, defaulting to 1000 [ 545.736007][ T9947] Bluetooth: hci4: command tx timeout [ 547.247966][ T9971] loop4: detected capacity change from 0 to 32768 [ 547.384901][ T9971] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 547.402414][ T9946] chnl_net:caif_netlink_parms(): no params data found [ 547.644895][ T9971] XFS (loop4): Ending clean mount [ 547.656973][ T9971] XFS (loop4): Quotacheck needed: Please wait. [ 547.805823][ T5086] Bluetooth: hci4: command tx timeout [ 547.962175][ T9971] XFS (loop4): Quotacheck: Done. [ 550.042719][ T5086] Bluetooth: hci4: command tx timeout [ 550.087077][ T6095] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 551.076897][ T9946] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.145981][ T9946] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.153651][ T9946] bridge_slave_0: entered allmulticast mode [ 551.199293][ T9946] bridge_slave_0: entered promiscuous mode [ 551.240957][ T9946] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.259529][ T9946] bridge0: port 2(bridge_slave_1) entered disabled state [ 551.305319][ T9946] bridge_slave_1: entered allmulticast mode [ 551.336491][ T9946] bridge_slave_1: entered promiscuous mode [ 551.639964][T10001] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 552.126096][ T5086] Bluetooth: hci4: command tx timeout [ 552.380341][ T9946] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 552.413017][ T9946] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 552.719904][ T9946] team0: Port device team_slave_0 added [ 553.977730][ T9946] team0: Port device team_slave_1 added [ 554.693669][ T9946] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 554.712247][ T9946] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 554.748952][ T9946] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 554.860857][ T9946] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 554.894795][ T9946] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 554.936780][ T28] audit: type=1800 audit(1787632172.867:36): pid=10027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.990" name="ifname" dev="configfs" ino=23786 res=0 errno=0 [ 555.222301][ T9946] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 558.859407][ T9946] hsr_slave_0: entered promiscuous mode [ 558.910079][ T9946] hsr_slave_1: entered promiscuous mode [ 558.953334][ T9946] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 559.024507][ T9946] Cannot create hsr debugfs directory [ 561.219540][T10064] loop4: detected capacity change from 0 to 512 [ 561.238768][ T2947] hsr_slave_0: left promiscuous mode [ 561.265994][ T2947] hsr_slave_1: left promiscuous mode [ 561.285795][T10064] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.992: invalid indirect mapped block 28777 (level 2) [ 561.304752][T10064] EXT4-fs (loop4): 1 truncate cleaned up [ 561.317461][T10064] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 561.664144][T10070] loop3: detected capacity change from 0 to 32768 [ 561.747869][T10070] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 561.761876][ T6095] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 561.895003][T10070] XFS (loop3): Ending clean mount [ 561.911304][T10070] XFS (loop3): Quotacheck needed: Please wait. [ 563.267636][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.273971][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.314686][T10070] XFS (loop3): Quotacheck: Done. [ 564.941140][ T2947] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 564.951020][ T2947] bond0 (unregistering): Released all slaves [ 565.201880][ T5780] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 565.234961][ T9946] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 565.277571][ T9946] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 565.333217][ T9946] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 565.412652][ T9946] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 565.473529][T10101] configfs-gadget.g1 gadget.0: HOST MAC 66:58:a7:b1:b1:9c [ 565.481678][T10101] configfs-gadget.g1 gadget.0: MAC aa:82:2d:46:ef:f2 [ 567.045808][ T5842] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 567.247027][ T5842] usb 1-1: config 1 interface 6 altsetting 0 has a duplicate endpoint with address 0x81, skipping [ 567.891068][ T5842] usb 1-1: config 1 interface 6 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 567.908256][ T5842] usb 1-1: config 1 interface 8 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 567.918865][ T5842] usb 1-1: config 1 interface 8 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 567.936153][ T5842] usb 1-1: Dual-Role OTG device on HNP port [ 567.946458][ T5842] usb 1-1: New USB device found, idVendor=1234, idProduct=a4a1, bcdDevice= 6.06 [ 567.955519][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.985772][ T5842] usb 1-1: SerialNumber: 1234567890 [ 568.025528][ T9946] 8021q: adding VLAN 0 to HW filter on device bond0 [ 568.288400][ T5842] cdc_ether 1-1:1.1 usb1: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 66:58:a7:b1:b1:9c [ 568.368871][T10124] loop3: detected capacity change from 0 to 64 [ 568.960015][T10124] hfs: unable to locate alternate MDB [ 568.965920][T10124] hfs: continuing without an alternate MDB [ 569.036464][T10122] nfs4: Unknown parameter '1' [ 569.060870][ T28] audit: type=1800 audit(1787632187.047:37): pid=10122 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1003" name="file1" dev="loop3" ino=21 res=0 errno=0 [ 569.157374][ T5842] cdc_acm 1-1:1.4: ttyACM0: USB ACM device [ 569.274547][ T9946] 8021q: adding VLAN 0 to HW filter on device team0 [ 569.332236][ T5842] usb-storage 1-1:1.6: USB Mass Storage device detected [ 569.399131][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 569.406340][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 569.450033][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 569.457267][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 569.598228][ T5842] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 570.360455][T10138] loop3: detected capacity change from 0 to 512 [ 570.566335][T10138] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1007: invalid indirect mapped block 28777 (level 2) [ 570.624165][T10138] EXT4-fs (loop3): 1 truncate cleaned up [ 570.635518][T10138] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 570.929523][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 571.095146][T10155] use of bytesused == 0 is deprecated and will be removed in the future, [ 571.104141][T10155] use the actual size instead. [ 571.291934][T10155] loop4: detected capacity change from 0 to 4096 [ 575.063620][T10182] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1011'. [ 576.159220][ T9946] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 576.771503][T10210] loop3: detected capacity change from 0 to 256 [ 578.465592][ T9946] veth0_vlan: entered promiscuous mode [ 578.545141][ T9946] veth1_vlan: entered promiscuous mode [ 578.581186][T10230] loop3: detected capacity change from 0 to 512 [ 578.731640][ T9946] veth0_macvtap: entered promiscuous mode [ 578.834600][ T9946] veth1_macvtap: entered promiscuous mode [ 578.874146][T10230] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1017: invalid indirect mapped block 28777 (level 2) [ 578.924827][T10230] EXT4-fs (loop3): 1 truncate cleaned up [ 579.681335][T10240] sctp: [Deprecated]: syz.1.1019 (pid 10240) Use of int in maxseg socket option. [ 579.681335][T10240] Use struct sctp_assoc_value instead [ 579.693193][ T9946] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 580.146328][ T9946] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.153596][T10230] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 580.156406][ T9946] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 580.369827][ T9946] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.392040][ T9946] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 580.406469][T10240] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1019'. [ 580.487902][ T9946] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 580.499816][ T9946] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.509689][ T9946] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 580.519084][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 580.520222][ T9946] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.540851][ T9946] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 580.591035][ T9946] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.635068][ T9946] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.662111][ T9946] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.685767][ T9946] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.477870][ T1141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.510501][ T1141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.536154][ T5784] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 582.586833][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.594712][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.768607][ T5784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 582.795045][ T5784] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 582.836029][ T5784] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 582.879631][ T5784] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 582.895810][ T5784] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.914370][ T5784] usb 5-1: Product: syz [ 582.924235][ T5784] usb 5-1: Manufacturer: syz [ 582.934376][ T5784] usb 5-1: SerialNumber: syz [ 582.971147][ T5784] usb 5-1: config 0 descriptor?? [ 583.015165][ T5784] port100 5-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 583.164253][T10264] loop5: detected capacity change from 0 to 32768 [ 583.257176][T10264] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 583.295143][T10273] [ 583.297523][T10273] ====================================================== [ 583.304552][T10273] WARNING: possible circular locking dependency detected [ 583.311600][T10273] syzkaller #0 Not tainted [ 583.316026][T10273] ------------------------------------------------------ [ 583.323051][T10273] syz.1.1020/10273 is trying to acquire lock: [ 583.329128][T10273] ffffffff8ddf6c50 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 583.341788][T10273] [ 583.341788][T10273] but task is already holding lock: [ 583.349164][T10273] ffff88802ba0f778 (&p->frag_sem){++++}-{3:3}, at: configfs_write_iter+0x215/0x400 [ 583.358510][T10273] [ 583.358510][T10273] which lock already depends on the new lock. [ 583.358510][T10273] [ 583.368917][T10273] [ 583.368917][T10273] the existing dependency chain (in reverse order) is: [ 583.377926][T10273] [ 583.377926][T10273] -> #3 (&p->frag_sem){++++}-{3:3}: [ 583.385328][T10273] down_write_killable+0xa7/0x230 [ 583.390881][T10273] configfs_rmdir+0x3e4/0x980 [ 583.396082][T10273] vfs_rmdir+0x352/0x4b0 [ 583.400840][T10273] do_rmdir+0x29f/0x590 [ 583.405505][T10273] __x64_sys_unlinkat+0xc4/0xe0 [ 583.410872][T10273] do_syscall_64+0x55/0xb0 [ 583.415808][T10273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 583.422214][T10273] [ 583.422214][T10273] -> #2 (&sb->s_type->i_mutex_key#23){++++}-{3:3}: [ 583.430907][T10273] down_write+0x97/0x200 [ 583.435662][T10273] configfs_depend_item_unlocked+0x157/0x430 [ 583.442157][T10273] usbg_make_tpg+0x1f7/0x580 [ 583.447264][T10273] target_fabric_make_tpg+0xa4/0x6d0 [ 583.453076][T10273] configfs_mkdir+0x515/0x9e0 [ 583.458266][T10273] vfs_mkdir+0x2a5/0x470 [ 583.463017][T10273] do_mkdirat+0x1dc/0x450 [ 583.467861][T10273] __x64_sys_mkdir+0x6e/0x80 [ 583.472964][T10273] do_syscall_64+0x55/0xb0 [ 583.477894][T10273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 583.484331][T10273] [ 583.484331][T10273] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 583.491970][T10273] __mutex_lock+0x135/0xc80 [ 583.496996][T10273] tcm_set_name+0x2a/0x90 [ 583.501868][T10273] function_make+0x199/0x350 [ 583.506980][T10273] configfs_mkdir+0x515/0x9e0 [ 583.512177][T10273] vfs_mkdir+0x2a5/0x470 [ 583.516934][T10273] do_mkdirat+0x1dc/0x450 [ 583.521777][T10273] __x64_sys_mkdir+0x6e/0x80 [ 583.526880][T10273] do_syscall_64+0x55/0xb0 [ 583.531807][T10273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 583.538217][T10273] [ 583.538217][T10273] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 583.546461][T10273] __lock_acquire+0x37ef/0x7d80 [ 583.551824][T10273] lock_acquire+0x19e/0x420 [ 583.556844][T10273] __mutex_lock+0x135/0xc80 [ 583.561862][T10273] uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 583.569923][T10273] configfs_write_iter+0x312/0x400 [ 583.575570][T10273] vfs_write+0x474/0x9a0 [ 583.580352][T10273] ksys_write+0x151/0x260 [ 583.585238][T10273] do_syscall_64+0x55/0xb0 [ 583.590177][T10273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 583.596618][T10273] [ 583.596618][T10273] other info that might help us debug this: [ 583.596618][T10273] [ 583.606855][T10273] Chain exists of: [ 583.606855][T10273] gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#23 --> &p->frag_sem [ 583.606855][T10273] [ 583.621379][T10273] Possible unsafe locking scenario: [ 583.621379][T10273] [ 583.628816][T10273] CPU0 CPU1 [ 583.634168][T10273] ---- ---- [ 583.639516][T10273] rlock(&p->frag_sem); [ 583.643764][T10273] lock(&sb->s_type->i_mutex_key#23); [ 583.651750][T10273] lock(&p->frag_sem); [ 583.658419][T10273] lock(gadget_subsys.su_mutex); [ 583.663438][T10273] [ 583.663438][T10273] *** DEADLOCK *** [ 583.663438][T10273] [ 583.671567][T10273] 4 locks held by syz.1.1020/10273: [ 583.676751][T10273] #0: ffff88802b60a0c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 583.685977][T10273] #1: ffff888141ede418 (sb_writers#16){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 583.694949][T10273] #2: ffff88802f31da88 (&buffer->mutex){+.+.}-{3:3}, at: configfs_write_iter+0x81/0x400 [ 583.704790][T10273] #3: ffff88802ba0f778 (&p->frag_sem){++++}-{3:3}, at: configfs_write_iter+0x215/0x400 [ 583.714532][T10273] [ 583.714532][T10273] stack backtrace: [ 583.720426][T10273] CPU: 1 PID: 10273 Comm: syz.1.1020 Not tainted syzkaller #0 [ 583.727872][T10273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 583.737918][T10273] Call Trace: [ 583.741194][T10273] [ 583.744117][T10273] dump_stack_lvl+0x18c/0x250 [ 583.748794][T10273] ? load_image+0x420/0x420 [ 583.753294][T10273] ? show_regs_print_info+0x20/0x20 [ 583.758495][T10273] ? print_circular_bug+0x12b/0x1a0 [ 583.763692][T10273] check_noncircular+0x2fc/0x400 [ 583.768656][T10273] ? print_deadlock_bug+0x5d0/0x5d0 [ 583.773856][T10273] ? lockdep_lock+0xf5/0x230 [ 583.778443][T10273] ? _find_first_zero_bit+0xd6/0x100 [ 583.783726][T10273] __lock_acquire+0x37ef/0x7d80 [ 583.788577][T10273] ? verify_lock_unused+0x140/0x140 [ 583.793775][T10273] ? verify_lock_unused+0x140/0x140 [ 583.798970][T10273] ? mark_lock+0x94/0x320 [ 583.803297][T10273] ? __lock_acquire+0x1336/0x7d80 [ 583.808325][T10273] lock_acquire+0x19e/0x420 [ 583.812820][T10273] ? uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 583.820555][T10273] ? __might_sleep+0xe0/0xe0 [ 583.825141][T10273] ? read_lock_is_recursive+0x20/0x20 [ 583.830505][T10273] ? verify_lock_unused+0x140/0x140 [ 583.835703][T10273] __mutex_lock+0x135/0xc80 [ 583.840205][T10273] ? uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 583.847928][T10273] ? __might_fault+0xaa/0x120 [ 583.852598][T10273] ? __lock_acquire+0x7d80/0x7d80 [ 583.857618][T10273] ? uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 583.865332][T10273] ? mutex_lock_nested+0x20/0x20 [ 583.870265][T10273] ? kstrtoull+0x130/0x1d0 [ 583.874678][T10273] uvcg_frame_dw_max_video_frame_buffer_size_store+0x115/0x370 [ 583.882222][T10273] ? uvcg_frame_dw_max_video_frame_buffer_size_show+0x180/0x180 [ 583.889855][T10273] ? down_read+0x1ac/0x2e0 [ 583.894279][T10273] configfs_write_iter+0x312/0x400 [ 583.899390][T10273] ? uvcg_frame_dw_max_video_frame_buffer_size_show+0x180/0x180 [ 583.907021][T10273] vfs_write+0x474/0x9a0 [ 583.911261][T10273] ? file_end_write+0x250/0x250 [ 583.916108][T10273] ? __fget_files+0x3fc/0x460 [ 583.920783][T10273] ? __fdget_pos+0x2a3/0x330 [ 583.925371][T10273] ? ksys_write+0x74/0x260 [ 583.929786][T10273] ksys_write+0x151/0x260 [ 583.934111][T10273] ? __ia32_sys_read+0x90/0x90 [ 583.938869][T10273] ? lockdep_hardirqs_on+0x98/0x150 [ 583.944063][T10273] do_syscall_64+0x55/0xb0 [ 583.948473][T10273] ? clear_bhb_loop+0x40/0x90 [ 583.953149][T10273] ? clear_bhb_loop+0x40/0x90 [ 583.957821][T10273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 583.963723][T10273] RIP: 0033:0x7faa33b9e0d9 [ 583.968137][T10273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 583.987757][T10273] RSP: 002b:00007faa34b0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 583.996179][T10273] RAX: ffffffffffffffda RBX: 00007faa33e25fa0 RCX: 00007faa33b9e0d9 [ 584.004158][T10273] RDX: 0000000000000004 RSI: 00002000000006c0 RDI: 0000000000000007 [ 584.012123][T10273] RBP: 00007faa33c35024 R08: 0000000000000000 R09: 0000000000000000 [ 584.020099][T10273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 584.028074][T10273] R13: 00007faa33e26038 R14: 00007faa33e25fa0 R15: 00007ffe251d15b8 [ 584.036059][T10273] [ 584.148921][ T5843] usb 5-1: USB disconnect, device number 5 [ 584.150354][T10264] XFS (loop5): Ending clean mount [ 584.219551][T10264] XFS (loop5): Quotacheck needed: Please wait. [ 584.232876][T10264] XFS (loop5): Quotacheck: Done. [ 584.909098][ T9946] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb