last executing test programs: 1m27.533866915s ago: executing program 5 (id=557): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000200)=@IORING_OP_BIND=@ipv4={0x38, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x2, 0x300, 0xfffffffe, 0x257, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1m26.764203156s ago: executing program 5 (id=561): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000080)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @local}, {0xa, 0x0, 0x7ffffffe, @mcast1, 0xa8a9}, r2, 0x2}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x0, @loopback, 0x9}, {0xa, 0x4e23, 0x6, @mcast1, 0x7fffffff}, r1, 0x80d}}, 0x48) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000000)={0x12, 0x10, 0xfa00, {0x0, r1, r0}}, 0x18) 1m26.482546279s ago: executing program 5 (id=564): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000640)='./file0\x00', 0x810, &(0x7f0000000680)={[{@debug}, {@nolazytime}, {@dax_inode}, {@nodelalloc}, {@jqfmt_vfsv0}, {@usrjquota_path={'usrjquota', 0x3d, '.'}}, {@test_dummy_encryption}]}, 0x3, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") r0 = creat(&(0x7f0000000100)='./bus\x00', 0x1) io_setup(0x202, &(0x7f0000000200)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r2, 0x0, 0x0, 0x1001f0) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x100000, 0x16}]) 1m25.690360123s ago: executing program 5 (id=571): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000380)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x28044851}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 1m25.241372342s ago: executing program 5 (id=576): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x100) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 1m24.930064821s ago: executing program 5 (id=578): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0xe5, 0x7}, {0x6, 0x24, 0x1a, 0x0, 0x11}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xcd}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x10, 0xa2, 0x10, 0x9, 0x8, 0x6, 0x297, 0xd, 0x7, 0x10, 0x14, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1m9.628211335s ago: executing program 32 (id=578): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0xe5, 0x7}, {0x6, 0x24, 0x1a, 0x0, 0x11}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xcd}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x10, 0xa2, 0x10, 0x9, 0x8, 0x6, 0x297, 0xd, 0x7, 0x10, 0x14, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 14.460189402s ago: executing program 3 (id=937): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xc8Ng\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) write$binfmt_misc(r1, &(0x7f0000000040)='\b', 0x1) sendfile(r0, r1, &(0x7f0000000000), 0xfffb) fcntl$addseals(r1, 0x409, 0x8) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x392fc000) 14.002984315s ago: executing program 3 (id=941): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) bind$can_j1939(r0, &(0x7f00000002c0)={0x1d, r1, 0x0, {0x231126210a6586ff, 0xff, 0x4}, 0xff}, 0x18) 13.59440738s ago: executing program 3 (id=945): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r0, &(0x7f0000000100)='7', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e20, 0x9, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e20, 0x0, @loopback}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000000)=0x10) 12.991009281s ago: executing program 3 (id=949): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x4810, &(0x7f0000000140)={[{@journal_dev={'journal_dev', 0x3d, 0x8}}, {@grpquota}, {@abort}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x9}}, {@errors_remount}, {@init_itable}, {@noauto_da_alloc}]}, 0x0, 0x4ec, &(0x7f0000000c40)="$eJzs3ElvHMUeAPB/j5fEL8mzX957QBbIQEBYIOLYWQ8cCAIpFyQkEApHYztRiJOg2EhJZBGzKEgcQPkEAW5IfAJOcEGAOIC4EsERIUXIBxw4oEE10zOMPTPe4iWxfz9pnKru6q6q7q64lmkHsGEV048sYmtE/BgR3ZXozATFyj+3piaG/piaGMqiVHrht6ycbnpq4sNq0upxW/JIbyGi8E4Wu5rkO3bp8pnB0dGRC5Xo2zfGC/mes4OnRk6NnBs4evTgga4jhwcOLUs9U5mmd75xfveO4y9fe27oxLVXvv40lbeU75+emhiaeUTPInNoa9hSjOLMa1nnkUWe/U63rS6ctaefhbUrDAuWntp0uzrK7b872sqxiu549q1aImDdKZVKpU0NW2sNfrJUL8sqBwDrRKZJwwa0ve43/vRUGqlODDWOg9e3m8eiPAJK9b6Vfyp72ssj2GJPZWzUsUL5/y8iTkz+eT19ouk8BADA8vr8WETp5987Ur+j+qnsKcQ9den+na8N9UTEfyIi9R3/m/df/h9RTntvRNxXd0zqUW6eJ//irHhj/+f7rjyQuqxLrmcrqf/3ZL62NbP/V1u/6GnLY9vK9e/ITp4eHdmfX5Pe6NiU4v2Np65Nq33xzA8ftMq/WNf/S5+Uf7UvmJfj1/ZZE3TDg+ODt1vvqptvli/slcb6Z9GeVUMROyJi5xLOn67Z6cc+2d1qf63+bXH9RKpnQ/3fb33y9iUUaJbSRxGPVu7/ZMyqf9KZh/rGz77WN3bp8hOn69cn+48cHjjUtzlGR/b3VZ+KRt98d/X5PNgwjJj//q+sdP//1fT5r61c9mT167Vji8/j6o13W45plvr8d2YvlsOd+baLg+PjF/ojOrPJxu0D/xx7cbBrRvpU/969zdv/9oi/qovbuyIiPcT3R8QDEbEnL/uDEfFQROydo/5fPf3wq62GkHfC/R9e1P1vFXjq24jmu9rOfPlZQ8bvFRdY/3T/D5ZDvfmW4cHx+X6txFwlrQ/c9gUEAACAu8CeiNgaWWFfPse5NQqFffsittRmUMbGHz95/vVzw5V3BHqio1Cd6equmw/tz+eGUzwdNVAXT/sPlOeNS6VSqSvF0/h9dNvaVh02vC0t2n/yi+/9w/q3qHW0Vm+0AXelpa+jL/8XMoDVtQzfowHuUto/bFwLbv8r9RYcsGaatf8rEbfWoCjAKmvW/l9ag3IAq8/4HzYu7R82Lu0fNqQFvSS/hMD247O31OWVta9Mpq0DhZj7rwD0RFS3VL/gOPcJfypELE8J25a1pl0z7mmhaZrNsRx5RWHeNO2L+EMMqxso3BnFqAQ2RcQ8T2/tYbtSDVxe6YKVG8HHa/u/EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwO37OwAA//8GPdEz") mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000340)='./file0/../file0\x00', 0x14) 12.295420536s ago: executing program 3 (id=953): r0 = getpgid(0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r2, 0x0) pidfd_send_signal(r1, 0x21, 0x0, 0x4) 11.870338393s ago: executing program 3 (id=955): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000100)=0x1000, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) 11.867446238s ago: executing program 1 (id=967): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x30, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HOOK={0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) 11.280396512s ago: executing program 33 (id=955): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000100)=0x1000, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) 11.261765888s ago: executing program 1 (id=958): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 10.860311411s ago: executing program 1 (id=965): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x501, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x6001, 0x10014}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @loopback}]}}}]}, 0x3c}}, 0x84000) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000fedbdf2500e1ff00", @ANYRES32=r2, @ANYBLOB="1b2e010001a0010034001280090001006970697000000000240002800600100008", @ANYRES32=0x0], 0x54}}, 0x20004000) 10.233790145s ago: executing program 1 (id=966): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x4810, &(0x7f0000000140)={[{@journal_dev={'journal_dev', 0x3d, 0x8}}, {@grpquota}, {@abort}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x9}}, {@errors_remount}, {@init_itable}, {@noauto_da_alloc}]}, 0x0, 0x4ec, &(0x7f0000000c40)="$eJzs3ElvHMUeAPB/j5fEL8mzX957QBbIQEBYIOLYWQ8cCAIpFyQkEApHYztRiJOg2EhJZBGzKEgcQPkEAW5IfAJOcEGAOIC4EsERIUXIBxw4oEE10zOMPTPe4iWxfz9pnKru6q6q7q64lmkHsGEV048sYmtE/BgR3ZXozATFyj+3piaG/piaGMqiVHrht6ycbnpq4sNq0upxW/JIbyGi8E4Wu5rkO3bp8pnB0dGRC5Xo2zfGC/mes4OnRk6NnBs4evTgga4jhwcOLUs9U5mmd75xfveO4y9fe27oxLVXvv40lbeU75+emhiaeUTPInNoa9hSjOLMa1nnkUWe/U63rS6ctaefhbUrDAuWntp0uzrK7b872sqxiu549q1aImDdKZVKpU0NW2sNfrJUL8sqBwDrRKZJwwa0ve43/vRUGqlODDWOg9e3m8eiPAJK9b6Vfyp72ssj2GJPZWzUsUL5/y8iTkz+eT19ouk8BADA8vr8WETp5987Ur+j+qnsKcQ9den+na8N9UTEfyIi9R3/m/df/h9RTntvRNxXd0zqUW6eJ//irHhj/+f7rjyQuqxLrmcrqf/3ZL62NbP/V1u/6GnLY9vK9e/ITp4eHdmfX5Pe6NiU4v2Np65Nq33xzA8ftMq/WNf/S5+Uf7UvmJfj1/ZZE3TDg+ODt1vvqptvli/slcb6Z9GeVUMROyJi5xLOn67Z6cc+2d1qf63+bXH9RKpnQ/3fb33y9iUUaJbSRxGPVu7/ZMyqf9KZh/rGz77WN3bp8hOn69cn+48cHjjUtzlGR/b3VZ+KRt98d/X5PNgwjJj//q+sdP//1fT5r61c9mT167Vji8/j6o13W45plvr8d2YvlsOd+baLg+PjF/ojOrPJxu0D/xx7cbBrRvpU/969zdv/9oi/qovbuyIiPcT3R8QDEbEnL/uDEfFQROydo/5fPf3wq62GkHfC/R9e1P1vFXjq24jmu9rOfPlZQ8bvFRdY/3T/D5ZDvfmW4cHx+X6txFwlrQ/c9gUEAACAu8CeiNgaWWFfPse5NQqFffsittRmUMbGHz95/vVzw5V3BHqio1Cd6equmw/tz+eGUzwdNVAXT/sPlOeNS6VSqSvF0/h9dNvaVh02vC0t2n/yi+/9w/q3qHW0Vm+0AXelpa+jL/8XMoDVtQzfowHuUto/bFwLbv8r9RYcsGaatf8rEbfWoCjAKmvW/l9ag3IAq8/4HzYu7R82Lu0fNqQFvSS/hMD247O31OWVta9Mpq0DhZj7rwD0RFS3VL/gOPcJfypELE8J25a1pl0z7mmhaZrNsRx5RWHeNO2L+EMMqxso3BnFqAQ2RcQ8T2/tYbtSDVxe6YKVG8HHa/u/EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwO37OwAA//8GPdEz") mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000340)='./file0/../file0\x00', 0x14) 9.733530092s ago: executing program 1 (id=970): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="d80000", @ANYRES16], 0xd8}, 0x1, 0x0, 0x0, 0x800}, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001300000008000300", @ANYRES32=r3, @ANYBLOB="06001200000000000600b50085010200040013000a00060008021100000000000c0043"], 0x48}, 0x1, 0x0, 0x0, 0x45}, 0x0) 7.756461225s ago: executing program 1 (id=974): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0x80184132, &(0x7f0000000080)) 6.908442014s ago: executing program 34 (id=974): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0x80184132, &(0x7f0000000080)) 6.842420017s ago: executing program 4 (id=982): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) 6.016369948s ago: executing program 2 (id=983): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r0, &(0x7f0000000800)=@in={0x2, 0x2389, @loopback}, 0x10) listen(r0, 0x5) connect(r1, &(0x7f0000000800)=@in={0x2, 0x2389, @loopback}, 0x10) syz_mount_image$iso9660(&(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', 0x0, &(0x7f0000000540)={[{@session={'session', 0x3d, 0x18}}, {@mode={'mode', 0x3d, 0xf78}}, {@map_normal}, {@mode={'mode', 0x3d, 0x1}}, {@check_strict}, {@uid}, {@mode={'mode', 0x3d, 0x2}}, {@block={'block', 0x3d, 0x800}}, {}, {@uid}]}, 0x1, 0x388, &(0x7f0000000b40)="$eJzs3e9v2kYcx/GPs0RD7Mm0TVUUpek11VYaMWIblQjlETKGuDN4wkRqHk3VkkpVkSa1j5p/vpMNpskKmC38Gnq/UHuH/c35AMtfHfhsAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWV7Tth1LYdC9fG2m85q9qDNjfdZe6V4xY7uSlfxToaD94aL9n76sfpT8d6zD4bNDFZKioNvvHn1//uPuTvb34+3O6Nkyffx0+/7NYHDzYU3bX7e23w3iKOg02r4J4sjUazX79KIVm1YQ+vFV3Pc7xuv5jX7UMyXvhXHq9arxK1fRZbfdbIR+tvDsV9e2a+ZV5Xe/0Yuj7umrSuxdBGEYdNtpTLI6iTlLdsTfgr7p+42OMW/fDW6qeZ1Mgpx5gty8INd2XcdxXaf2sv7yzLZ3v1pg/4O+irDWta9iQyzw6A08zM4o/ytUoK4u9Vpm4sNTUz1F6kxZP5Ll/59P/ZnbHef/3fGiw/0vqw+U5v+j4bOjafl/Sl9W9/ioT7rVe73RQAPd6MPae7TaR1u+ugoUK1KgjhrpEjNaYlRXTTXZ+kMXaimWUUuBQvmKdaVYffnpHuWpJ18N9RWpJ6OSPL2QkaO66qrKyFdFV4p0qa7aaqqRtvJW79L3vTqjj+MgZ54gd0bQv8//34z2Z/I/Mgs8egMP8znL/wAAAAAAYGtZ6W/syfh/T4/TWisIfXvd3QIAAAAAAAuU/vJ/mBR7Se2xLMb/AAAAAABsGyudY2dJKurJsJbNhOJLAAAAAAAAtkT6+/9RUhST2hNZjP8BAAAAANg2+dfYz42wytnlf831sLweRYyu81tsBaFf8aLw3NEv6VUG0pkGE1vbS6cfnOjpMOppcVgW77dYSKKcyrmjEx2PXkjpWVI8K02IdOeOrCaRAABsu+OcfDw7/+8kudM60fNhxPOD9Gr+uwcTMqtNZgUAYFPk32NnjrvwZKaM/38Yn1JQ0Z/6SwNdq5zONkjPOJjYavHOaQjlnG8Dinfu8FLOGeUX79zoZf7Y6pI/BQAAVus4Jw/Pkf+tcs74v8gphQAAbJTxHeyXWFn3awQAAPeRpQEAAAAAAAAAAAAAAAAAAAAA2HyLm+S3/HmEi698K+lh7RRG7+NGvBwq/7FS+L98gp+tlW1r5mHDW8nBCcBS/R0AAP//Gol2pw==") 4.96428989s ago: executing program 2 (id=984): syz_mount_image$nilfs2(&(0x7f0000000040), &(0x7f0000000e00)='./file0\x00', 0x0, &(0x7f0000000080)={[{@errors_remount_ro}, {@discard}, {@discard}, {@errors_continue}]}, 0x0, 0xdac, &(0x7f0000005d00)="$eJzs3UtvXNUdAPBzxx47LxqHmMZN08QlpbiP2CRYpbsaKV2gSqgSnwClgYYa+ghdgIKUsOi2kRAfoIh9F31mgRSxSsWmVb8AYtVNipBoG1UCI9vnjMf/zOjOOLbH4/n9pDNn7v2fO+ecedyZua+TgJHVWLtdXJypUnr71lsX750Z/9/qnDOtErNrt+N5aiml1Gwtl9JUeLylyfX8s0+uXWrPP895lS6kKlWt+enZu61lD6eUrqfZdDtNpec+PnHzpQ+eWX7v+I3jF9+Yu7MzvQcAgNFy70fv/vJvj//w2rH///70UppszS+/z5fy9JH8u3+pWp/OWet/QNWWV23TxUQoN55TI5Qb61CuvZ5mKDfepf6J8LjNLuUma+ofa5vXqd8wzDb+x1eN+U3Tjcb8/Pp/8lUfjk1U869cWX7h6oAaCmy7T8/kTXySJI1cWjk66DUQwLq43/A+1+OWhQfTerTx3uq/+3Sj8/KwDXb7/a/+4ar/3RvWOGyf/fpuKv0qn6MjeTruRxgPy/X7+S+PF/dHNHtsZ7f9CMOyf6FbO8d2uR1b1a398X2xX30t5+V5OB3i7Z+f+JoOy2sMdHbP9n9JGtm0MugVELBnxePmVrISj8f1xfhkTfxATfxgTfxQTfxwTRxG2R9e/W26WW38z4//6fvdHla2sz2U8y/12Z64PbLf+uNxv/160Prj8cSwp83999Snv77993D8fyOF4//P5u/SqbFSYF3crt469j+cGNzoUu7h0JyHOpRfuz+9uVw1vfE4qW09c187ZjYvd7RbuVOby02Fcofyb5EDob3x98mhsFz5/VHWq+X5Gg/9bYZ+TIR2lFfmWM4PhP4c69avsCF7IpRr5nQ89Gs69OuRsNyXQ7+qmc39itvPS3tOhPlxP0kpF162+76X4msRz8t4NOdv5vydnL+f84861DuKyvux2/H/5f05k5rVC1eWLz+Rp8v79M5Yc3J1/vldbjfw4Ho9/2cmbT7/50hrfrPRvl44ujG/al8vTIX5F7rMfzJPl++zn44dXJs/f+nnyz/Z7s7DiLv62us/e355+fKv3HHHHXdadwa9ZgJ22sKrL/9i4eprr5+78vLzL15+8fIr55/4/veefOqpxYW1X/UL7b/tgf1l40t/0C0BAAAAAAAAAAAAelYd7Dw753XXty3nk5fz0+P58QyH8rqVd0O5jkE5/7PbdV3K+ZvHdqGNbL/dOJ1o0H0EOvu36//uuzS1B9ogDUdaWXEVf2BvGPT4f5/nekt+5Nw/j62mUuzu05vXl/H6hfAg9vr4c+rfX+P/tca/6nn9F0bMmtpavX+8d/AfbdWmk73WH/tfrgM73V/9f8r1l948lnqrf+V3of54odIe/TnUf6jH+u/r/6mt1f+XXH952ubO9lr/eourxuZ2xO3G5TqAcbtx8dfQ/3Jtv777v8WB2m7l+mGUDcs4k/0alvE/uymPW9aDefXc2k9Xrr8dxzvot/3lut/le+CR8PhVzfeb8T+HW934n+X9t2D8T9h3PrT/b1tS6yiqPdAWSeo1raysDHTok1Edd2WvGPTzP+jfkIOuf9DPf504/mf8vxTH/4zxOP5njMfxP2M8jq8V43H8z/h8xvE/Y/xEeNw4PuhMTfwrNfGTNfGvdopPbMRP1Swf/7/F+GxN/HRN/ExN/OGa+KM18bM18W/UxB+riT9eE5+rie93X8/5qPYfRlkcN9LnH0ZH2f/T7fM/XRMHhlcc1zl+vr9ZEweGVznOw+cbRlDV+YodcXt72Y77Zs7fyfn7Of9oxxrIbvhWzr+d8+/k/Ls5P5fz+Zwv5NzYkMPtN/86efpmtXGc39EQ7/V40ng+QLxOzPke2xP3z/V7POuJHuvZqfq7Hy67xRNlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPaYxtrt4uJMldLbt966+J/pH/x4dc6ZVonZtdvxPLWUUmqmlKo8PR4e7/rkev7ZJ9cudcqrdGHttkynZ++2lj28unyaTbfTVHru4xM3X/rgmeX3jt84fvGNuTs703sAAAAYDV8EAAD//6Y+47U=") syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000100)='./file1\x00', 0x101880a, &(0x7f0000005bc0)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c61636c2c6673796e635f6d6f64653d7374726963742c696e6c696e655f78617474722c6673796e635f6d6f64653d706f7369782c646973636172645f756e69743d7365676d656e742c6261636b67726f756e645f67633d6f6e2c6e6f696e6c696e655f78617474722c646973636172645f756e69743d626c6f636b2c6673796e635f6d6f64653d7374726963742c617467632c657874656e745f63616368652c6661756c745f696e6a656374696f6e3d30303030303030303030303030303031343033302c00271d57a599b8b169a579679e220c689eaaec4fa6229021e75c68a687d319b615573b0b0ceefba8e2e2419434463974ef8174b66469344931de0ccad650792761", @ANYRESOCT, @ANYRES32], 0x1, 0x551d, &(0x7f0000000680)="$eJzs3M1rI2UYAPAn/dhv1yIevO3AIrSwiU0/Fr1V3cUP7FJWPXjSNElDdpNMadK09uTBo3jwPxEFTx79Gzx49iYeFG+Ckpmpbv0AoWlj298PJs+8b94887xhWXhmSgK4sOaSX34qxc24GhHTEXEjIjsvFUdmLQ/PRcStiJh64igV839MXIqIaxFxc5Q8z1kq3vrszvD26o9v/vz1t5dnrn/+1XeT2zUwac9HRHc7P9/r5jFt5fFRMV8btrPYXRkWMX+j+7gYp3nca25mGfZqh+tqWVxu5evT7d3+KG51avVRbLW3svntXn7B/rB1mCf7wKPaTjZuNDez2O6nWWwd5HXtH+T/tx30B3meRpHvwyx9DAaHMZ9v7jfz/Ww/zmK9Nyjm87xpo7k/isMiFpeLetppZHVsHueb/n97q93b3U+GzZ1+O+0lq5Xqi5Xq3XJ1J200B82Vcq3buLuSzLc6o2XlQbPWXWulaavTrNTT7kIy36rXy9VqMn+vudmu9ZJqtbJcWSyvLhRnd5LXHrybdBrJ/Ci+0u7tDtqdfrKV7iT5JxaSpcrySwvJ7Wry9vpGsvHw/v31jXfev/feg5fX33i1WPS3spL5pcWlpXJ1sbxUXbhA+/+4KHqM+4djKU26AICzR/8PTMLJ9f87DyNOvv8P/f9YnKn+9/z1/3svREx0/3As+n8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAvr+9kvXs9O5vLx9WL+qWLqmWJcioipiPjtH0zHpSM5p4s8s/+yfvYvNXxTiizD6BqXi+NaRKwVx69Pn/S3AAAAAOfXlx/d+jTv1vOXuUkXxGnKb9pM3fhgTPlKETE798OYsk2NXp4dU7Ls3/dM7I8pW3YD68qYkuW33GbGle0/mT4SrjwRSnmYOtVyAACAU3G0EzjdLgQAAIDT9MmkC2AySnH4KPPwWXD2l/d/PhC8emQEAAAAnEGlSRcAAAAAnLis//f7fwAAAHC+5b//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv7NzN7eJxHAcQP8zMAv7pUWrvW8re4MytoQ97jGigDRBATmQFtIANZBbSoggYjwhEKEkEp4ZJXpPGowH88NGcLAtGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjTbbWcXV/8vjw3Z7M9T57RAAAAAKesq+WsfjJJ9a/N/e/NrZ9NvYiIMiJOzd0H8ekoc9DkVE/trw7bV8/6cBNRJ+w+Y9RcXyLiT3Pd/2j7WwAAAICPazVfTNNsPT1M+u4QXUqLNuW3v5nyioioJneZ0spd3q9MYfXvexj/M6XVC1jjTGFpyW2YK+1N6r/7ftVufFAUqShPvm3fyWxjBwAAOjQ4KrqdhQAAANClf313gH4U8biVud8KHKWi2d77fFQDAAAA3qGi7w4AAAAAravn/x2d/7d1/h8AAAD0I53/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJvW1XK2mi+mr7ccvvjqZnuefCMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhgf95RIATCIAz2ru9M5v6HlQYNjU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAePO7v/yfmBpnkrnXxtLzSLJ2amydGnvnxtEfxtevAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+6He//J+YGmeSudPG0vFIsnbV2Lpq7D1oHD0Yb/8GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIudu3mNowwDAP7MzM7WtooxSg4RUfCgF5tua2tv4kEJHvwThJBua+zWjzaILUXMxZvk3IvoUURQ4q3/Q88t9FJvPeRQwZMHZb6S6Qd2rXZmbX4/eOd9dpjM+7wzEPLMO1kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoLH91m6cFZu5Kk7rfdduX1ot+ut39YUrmzcWi1bESZdJ/z+80P6QLETEwf6SAQAAYG/Imvo+Im7mW8tFn86V9X/eHFPU/N8+VcV1Pf9ZU7LeXf83tX/Rfvn51nM7A81V4xQnPbU2GR++N5XBo5rjrHv6gUcMyitfPnvJyhuSvrvx7HZeXs/k66tX3x6W4b4usgUAHsahpq+D5u+hoh/1mRgAe8agVXg39X82129OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF3Y3oiDTZxExOJgNy5cv31p9X79lc0bi007fvnyZny5e87iFHlEnFqbjA93OpvZdv7CxTMrk8n4XPfBixHR1+hv1tM/8/4UB0f0cn0E/1GQ1jd7VvLpLsjrmT/Mj/f0CwkAgMdWXreirr+Zby0X+5L5iD+/u7P+f6UVx4Pq/z+q+v/WB8evtcdq1/+jzmY4+5bWz36ydP7CxdfWzq6cHp8ef/T6kdEbo6Mnjh07sVQ+K1nyxAQAAIB/Z1i3dv2fzt+7/n+gFceU6/+ffjP6oj1Wtsfq/3zK43YX/R5xQgAAAPytZ176/bfkPvuT4TA+X1lfPzeqtjufj1TbHlL9x/bVrV3/Z/N9ZwUAAAB0YXsjuWP9/2QrjinX/5/8/vkf2+fMImJ/vf5/aPXjycnupjPTuvhv5L7nCAAAQL/21629/p+X7/+nO688pBHx6stVXH8N4FT1f/bOVz+0x2q//3+0uynOpHShuh5lvxAxWOg7IwAAAB5nT9StKPZ/zbeWP/zpwHtD7/8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdO2vAAAA//+N8Dl9") r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) recvmmsg$unix(r0, &(0x7f0000001e00)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1}}], 0x1, 0x121, 0x0) 4.96413876s ago: executing program 4 (id=985): r0 = getpid() syz_pidfd_open(r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000001c0), 0x80000, 0x0) fchdir(r1) mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) 4.469304194s ago: executing program 4 (id=987): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x40033, 0xffffffffffffffff, 0x9f596000) read(r0, &(0x7f0000000380)=""/153, 0x99) 3.275852443s ago: executing program 4 (id=988): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40408c4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) openat$drirender128(0xffffff9c, 0x0, 0x2a00, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) 2.854501038s ago: executing program 0 (id=991): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x14d}}}, &(0x7f0000000480)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, 0x0, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB=')'], 0x18}, 0x440e0) 2.698261563s ago: executing program 2 (id=992): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r1, &(0x7f0000000300)=ANY=[], 0x10) r2 = getpid() r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=[0x4], 0x0, 0x0, 0x1, 0x1, r2}}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={r3, 0x58, &(0x7f00000002c0)}, 0x10) 2.198689203s ago: executing program 2 (id=995): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setuid(0xee01) r0 = semget$private(0x0, 0x4, 0x29b) semop(r0, &(0x7f0000000180)=[{0x0, 0x203}, {}], 0x2) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x108}, 0x476d, 0xffffffffffffffd8, 0x0, 0x0, 0x0, 0x0, 0xb}) semctl$GETZCNT(r0, 0x4, 0xf, 0x0) 2.198358994s ago: executing program 0 (id=996): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") syz_mount_image$vfat(&(0x7f0000005880), &(0x7f00000001c0)='./bus\x00', 0x0, 0x0, 0x5, 0x0, &(0x7f0000000240)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = open(&(0x7f0000006080)='.\x00', 0x8000, 0x112) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000380)=@v2={0x2, @aes128, 0x0, '\x00', @c}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) 1.942333077s ago: executing program 6 (id=997): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) write$nci(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="414601"], 0x4) 1.468048995s ago: executing program 0 (id=998): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r0, &(0x7f0000000100)='7', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e20, 0x9, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e20, 0x0, @loopback}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000000)=0x10) 1.419368148s ago: executing program 6 (id=1000): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0], &(0x7f0000000280), 0x1, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000040)={0x500, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000002c0)=[0x1], &(0x7f0000000a00)=[r3], &(0x7f00000001c0), 0x0, 0xff}) 1.053842738s ago: executing program 2 (id=1001): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x40033, 0xffffffffffffffff, 0x9f596000) read(r0, &(0x7f0000000380)=""/153, 0x99) 1.050186825s ago: executing program 4 (id=1002): r0 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f0000000100)='\x00', 0x1, 0x4001, &(0x7f00000000c0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x5, 0x8100, 0x4001}, 0x10) 825.127247ms ago: executing program 0 (id=1003): mkdir(&(0x7f0000000040)='./myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./myproc/scsi/device_info\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) write(r0, &(0x7f0000000300)='v', 0x1) 824.728294ms ago: executing program 6 (id=1004): timer_create(0x3, 0x0, &(0x7f0000044000)=0x0) timer_create(0x2, 0x0, &(0x7f0000044000)=0x0) timer_settime(r1, 0x1, &(0x7f0000040fe0)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) timer_settime(r0, 0x1, &(0x7f0000040fe0)={{}, {0x0, 0x9}}, 0x0) 589.914351ms ago: executing program 6 (id=1005): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[0x0], &(0x7f00000001c0), 0x0, 0x1, 0x0, 0x0, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000300)={0x1, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x2], &(0x7f0000000240)=[r3], 0x0, 0x0, 0xffffffffffffffff}) 501.576216ms ago: executing program 0 (id=1006): sendmsg$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7fffffff}}], 0x30}, 0x80) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 335.961615ms ago: executing program 6 (id=1007): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='never\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/kvm/parameters/nx_huge_pages_recovery_ratio\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='10\n', 0x3) 167.75775ms ago: executing program 6 (id=1008): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f00000003c0)='dummy_udc.0', 0xb) close(r0) 160.793359ms ago: executing program 0 (id=1018): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0x0, 0x0, 0x80000008}, 0x4}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) pipe(&(0x7f0000000200)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 1.003471ms ago: executing program 2 (id=1009): syz_mount_image$ext4(&(0x7f0000001a80)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x210040, &(0x7f0000000380), 0xfc, 0x5c8, &(0x7f0000002780)="$eJzs3c1rHOUfAPDvbDb5pS8/k0Ip6kECPdhSu3nzpYJgPYoWC3qvS7INIZtuyW5KEws2B3vxVgQRC+JV8O6xeBf/ioIWipSgBxEis5lNt+lu3rom2+7nA5M+z8zsPs93Zp5nnpnZ7QbQs0bSP7mIlyIG0+RQ07J8ZAtH1tdbfXhjKp2SWFv7+I8kkmxeY/0k+/dIlnkxIn7+IuJM7slyq0vLc8VyubSQ5Udr81dHq0vLZ2fnizOlmdKVicnJc29MTrz91psdi/X0xb+++eju++e+PLn69Y/3j91O4nwczZY1x/EUbjZnRor/ZKn+OL9pxfEOFNZNkoOuAHvSl7Xz/kj7gKHoi3z8ctCVAvbF5xGxBvSoRPuHHtUYBzSu7Tt0HfzMePDe+gVQPfaB5vjz6/dGYrB+bXR4Ncnuh6xLr3eHO1B+WsZPv9+5nU6x9X2IQ9vkAXbl5kpEjOXzT/b/Sdb//W/P7z1Wv3m8tZFN+V47/8BBupuOf15rNf7LbYx/YvP4Jxs1bm67e7F9+8/d70AxbaXjv3dajn83uq7hviz3//qYrz+5fKRcGouIFyLiVERcni2XxgfX76G3cm713lq78pvHf+mUlt8YC2b1uJ/f1AVPF2vFiBh42thTD1YiXs63ij/Z2P9Ji/Fvuj0u7rCME6U7r7Rbtn38reV3WPZ21r6PeLXl/n/0RCvZ+vnkaLr/x9b/tizjz1snfm1X/l7j75R0/x/eOv7hpPl5bXX3ZXw3+Hep3bJ28Q9urNH6+B9IPqmnG43gerFWWxiPGEg+fHL+xKPXNvKN9dP4T52MWGnaBlm5Wx7/6cXXpzuM/9bxW21X7Yb9P72r/b85kW6JNouyxL0PPvu2Xfk76/9er6dOZXOy/q+17FjZojqPJZ52+wEAAAAAAEA3yUXE0UhyhY10LlcorH+H93gczpUr1dqZy5XFK9NR/67scPTnGk+6hxqfh5gtl8azz8M28hOb8pMRcSwivuo7VM8Xpirl6YMOHgAAAAAAAAAAAAAAAAAAALrEkTbf/0/91tdYq1P/2z7QderNe++/8wQ8w7Y9vXfil56ArmR4D73rsfafHFw9gP239/N/X0frAew/43/oXTtp/x35tXGg6zj/Q+/S/qF37aT9n9+HegAAAAAAAAAAAAAAAAAAAAAAAAAAAMBz4uKFC+m0tvrwxlSan762tDhXuXZ2ulSdK8wvThWmKgtXCzOVyky5VJiqHIqIoa3er1ypXB2fiMXro7VStTZaXVq+NF9ZvFK7NDtfnCldKvXvW2QAAAAAAAAAAAAAAAAAAADw7KguLc8Vy+XSwnOR+CH/X7zzu7ExZzgiuiLSDgcYN9ODIZ0zsNuX57sliu0Sp7ujGvufWMna+u5edbD9EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0+zcAAP//msQtRw==") chdir(&(0x7f0000000240)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r0, 0x100, 0x0) getdents(r0, 0x0, 0x0) 0s ago: executing program 4 (id=1010): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r0, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x256, 0x10022, 0x0) kernel console output (not intermixed with test programs): ): Wrong secs_per_zone / total_sections (4095, 24) [ 128.494053][ T6331] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 128.525324][ T6331] F2FS-fs (loop5): build fault injection rate: 771 [ 128.575308][ T6331] F2FS-fs (loop5): invalid crc value [ 128.581342][ T29] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 128.603339][ T24] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 128.616703][ T6331] F2FS-fs (loop5): invalid crc value [ 128.634828][ T6331] F2FS-fs (loop5): Failed to get valid F2FS checkpoint [ 128.791430][ T29] usb 2-1: Using ep0 maxpacket: 16 [ 128.802382][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 128.823916][ T24] usb 1-1: New USB device found, idVendor=056a, idProduct=00de, bcdDevice= 0.00 [ 128.834896][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.878703][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.887111][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.912432][ T29] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 128.930533][ T24] usb 1-1: config 0 descriptor?? [ 128.961018][ T29] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 128.985564][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.059648][ T29] usb 2-1: config 0 descriptor?? [ 129.429572][ T24] wacom 0003:056A:00DE.0005: ignoring exceeding usage max [ 129.463981][ T24] wacom 0003:056A:00DE.0005: ignoring exceeding usage max [ 129.490591][ T24] wacom 0003:056A:00DE.0005: unknown main item tag 0x5 [ 129.529395][ T24] wacom 0003:056A:00DE.0005: collection stack underflow [ 129.566632][ T24] wacom 0003:056A:00DE.0005: item 0 1 0 12 parsing failed [ 129.599728][ T29] usbhid 2-1:0.0: can't add hid device: -71 [ 129.627752][ T29] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 129.636560][ T24] wacom 0003:056A:00DE.0005: parse failed [ 129.663173][ T24] wacom 0003:056A:00DE.0005: probe with driver wacom failed with error -22 [ 129.684489][ T29] usb 2-1: USB disconnect, device number 2 [ 129.779263][ T24] usb 1-1: USB disconnect, device number 6 [ 130.342580][ T6405] netlink: 20 bytes leftover after parsing attributes in process `syz.1.212'. [ 131.108891][ T6418] loop2: detected capacity change from 0 to 1024 [ 131.621334][ T5908] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 131.795670][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 131.826547][ T5908] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 131.868307][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 131.889543][ T5908] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 131.937639][ T5908] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.971852][ T6431] vxcan1: tx drop: invalid sa for name 0x0000000000000003 [ 132.013503][ T5908] usb 6-1: config 0 descriptor?? [ 132.051605][ T5645] Bluetooth: hci1: command 0x0406 tx timeout [ 132.147116][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.159216][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.159585][ T6438] netlink: 'syz.1.226': attribute type 4 has an invalid length. [ 132.524278][ T5908] nzxt-smart2 0003:1E71:2009.0006: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 132.731336][ T24] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 132.916290][ T24] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 132.957271][ T24] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 133.007716][ T24] usb 2-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 133.031077][ T31] audit: type=1326 audit(3933048864.245:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377399e019 code=0x7ffc0000 [ 133.066782][ T5774] usb 6-1: USB disconnect, device number 3 [ 133.085949][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.129480][ T6450] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 133.151024][ T6450] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 133.159530][ T31] audit: type=1326 audit(3933048864.265:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377399e019 code=0x7ffc0000 [ 133.205204][ T31] audit: type=1326 audit(3933048864.275:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377399e019 code=0x7ffc0000 [ 133.250840][ T24] spcp8x5 2-1:1.0: SPCP8x5 converter detected [ 133.291675][ T24] usb 2-1: SPCP8x5 converter now attached to ttyUSB0 [ 133.306898][ T31] audit: type=1326 audit(3933048864.285:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f377399e019 code=0x7ffc0000 [ 133.382825][ T31] audit: type=1326 audit(3933048864.295:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f377399e019 code=0x7ffc0000 [ 133.464888][ T31] audit: type=1326 audit(3933048864.345:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f377395e84e code=0x7ffc0000 [ 133.518754][ T31] audit: type=1326 audit(3933048864.355:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f377395e84e code=0x7ffc0000 [ 133.560022][ T31] audit: type=1326 audit(3933048864.355:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f377395e84e code=0x7ffc0000 [ 133.649811][ T5908] usb 2-1: USB disconnect, device number 3 [ 133.694167][ T31] audit: type=1326 audit(3933048864.355:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f377395e84e code=0x7ffc0000 [ 133.712673][ T5908] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 133.753374][ T6477] loop3: detected capacity change from 0 to 512 [ 133.773396][ T5908] spcp8x5 2-1:1.0: device disconnected [ 133.824899][ T31] audit: type=1326 audit(3933048864.365:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6460 comm="syz.0.233" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f377395e84e code=0x7ffc0000 [ 133.954853][ T6477] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 133.986339][ T6484] netlink: 4 bytes leftover after parsing attributes in process `syz.2.241'. [ 134.007175][ T6477] ext4 filesystem being mounted at /35/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 134.344978][ T6491] loop5: detected capacity change from 0 to 512 [ 134.395859][ T6491] EXT4-fs (loop5): orphan cleanup on readonly fs [ 134.419868][ T6491] EXT4-fs warning (device loop5): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 134.450099][ T6491] EXT4-fs (loop5): Cannot turn on quotas: error -22 [ 134.459372][ T6491] EXT4-fs error (device loop5): ext4_ext_check_inode:521: inode #13: comm syz.5.244: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 134.484102][ T6491] loop5: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 134.485011][ T6491] EXT4-fs error (device loop5): ext4_orphan_get:1402: comm syz.5.244: couldn't read orphan inode 13 (err -117) [ 134.494275][ C1] EXT4-fs (loop5): error count since last fsck: 1 [ 134.494381][ C1] EXT4-fs (loop5): last error at time 3933048865: ext4_ext_check_inode:521: inode 13 [ 134.522353][ T6491] loop5: lost filesystem error report for type 5 error -117 [ 134.585484][ T6491] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 134.644548][ T5630] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 134.819652][ T6491] EXT4-fs (loop5): re-mounted 00000000-0000-0000-0000-000000000000. [ 134.881012][ T6491] EXT4-fs (loop5): warning: mounting fs with errors, running e2fsck is recommended [ 134.960874][ T6491] EXT4-fs warning (device loop5): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 135.228727][ T5635] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 135.229738][ T6504] loop2: detected capacity change from 0 to 2048 [ 135.295752][ T6504] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 135.338208][ T6509] netlink: 20 bytes leftover after parsing attributes in process `syz.1.249'. [ 135.903258][ T6520] netlink: 12 bytes leftover after parsing attributes in process `syz.1.254'. [ 136.238041][ T6525] loop5: detected capacity change from 0 to 64 [ 136.800172][ T6513] loop3: detected capacity change from 0 to 131072 [ 136.812240][ T6513] F2FS-fs (loop3): Invalid log sectorsize (67108873) [ 136.818981][ T6513] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 136.829941][ T6513] F2FS-fs (loop3): invalid crc value [ 136.984937][ T6513] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 137.001419][ T6513] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 137.008628][ T6513] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 137.394927][ T6536] loop2: detected capacity change from 0 to 8 [ 137.608471][ T6539] loop0: detected capacity change from 0 to 512 [ 137.659144][ T6539] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 137.751781][ T187] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 137.806460][ T6539] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 137.903751][ T187] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.908931][ T6539] ext4 filesystem being mounted at /37/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 137.950029][ T187] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 138.016768][ T187] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.091775][ T187] usb 6-1: config 0 descriptor?? [ 138.151386][ T5774] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 138.316132][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.331575][ T5774] usb 5-1: Using ep0 maxpacket: 16 [ 138.360744][ T5774] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 138.387776][ T187] usbhid 6-1:0.0: can't add hid device: -71 [ 138.389269][ T5774] usb 5-1: config 0 has no interface number 0 [ 138.414661][ T187] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 138.428988][ T5774] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 138.464885][ T187] usb 6-1: USB disconnect, device number 4 [ 138.495527][ T5774] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 138.550444][ T5774] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 138.605880][ T5774] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.645322][ T5774] usb 5-1: Product: syz [ 138.675269][ T5774] usb 5-1: Manufacturer: syz [ 138.686285][ T5774] usb 5-1: SerialNumber: syz [ 138.718446][ T5774] usb 5-1: config 0 descriptor?? [ 138.754112][ T6544] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 138.782656][ T6544] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 138.951386][ T187] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 139.067297][ T6544] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 139.108378][ T6544] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 139.142603][ T187] usb 6-1: Using ep0 maxpacket: 32 [ 139.164556][ T187] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 139.213612][ T187] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 139.243722][ T187] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.296472][ T187] usb 6-1: config 0 descriptor?? [ 139.339006][ T187] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 139.370462][ T5774] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 139.419805][ T187] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 139.850016][ T5908] usb 6-1: USB disconnect, device number 5 [ 139.878331][ T5908] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 139.994139][ T5774] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 140.037471][ T5774] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 140.081837][ T5774] asix 5-1:0.34: probe with driver asix failed with error -71 [ 140.129008][ T5774] usb 5-1: USB disconnect, device number 3 [ 140.577479][ T6572] loop2: detected capacity change from 0 to 512 [ 140.604997][ T6572] EXT4-fs: Ignoring removed nobh option [ 140.680692][ T6572] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 140.826248][ T6572] ext4 filesystem being mounted at /52/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 141.062339][ T6582] netlink: 52 bytes leftover after parsing attributes in process `syz.3.277'. [ 141.137305][ T6582] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.145387][ T6582] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.164771][ T6586] loop1: detected capacity change from 0 to 256 [ 141.254617][ T6586] vfat filesystem being mounted at /52/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2107-12-31 (0x10391447e) [ 141.336189][ T5633] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 141.489929][ T6592] dummy_hcd dummy_hcd.0: remove, state 1 [ 141.517295][ T6592] usb usb1: USB disconnect, device number 1 [ 141.541918][ T2008] usb usb1-port1: attempt power cycle [ 141.582373][ T6600] netlink: 1355 bytes leftover after parsing attributes in process `syz.3.283'. [ 141.916359][ T6592] dummy_hcd dummy_hcd.0: stopped [ 141.931504][ T6592] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 142.041930][ T6598] dummy_hcd dummy_hcd.0: USB Host+Gadget Emulator, driver 02 May 2005 [ 142.105375][ T6598] dummy_hcd dummy_hcd.0: Dummy host controller [ 142.183758][ T6598] dummy_hcd dummy_hcd.0: new USB bus registered, assigned bus number 1 [ 142.221898][ T6598] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 142.257000][ T6598] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 142.287130][ T6598] usb usb1: Product: Dummy host controller [ 142.326097][ T6598] usb usb1: Manufacturer: Linux syzkaller dummy_hcd [ 142.355176][ T6598] usb usb1: SerialNumber: dummy_hcd.0 [ 142.469511][ T6598] hub 1-0:1.0: USB hub found [ 142.490742][ T6598] hub 1-0:1.0: 1 port detected [ 142.857264][ T187] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 143.023161][ T187] usb 1-1: Using ep0 maxpacket: 32 [ 143.043786][ T187] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 143.078809][ T187] usb 1-1: config 0 has no interface number 0 [ 143.111921][ T187] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 143.146144][ T187] usb 1-1: config 0 interface 196 has no altsetting 0 [ 143.182415][ T187] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 143.196442][ T187] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.214348][ T187] usb 1-1: Product: syz [ 143.219094][ T187] usb 1-1: Manufacturer: syz [ 143.225451][ T187] usb 1-1: SerialNumber: syz [ 143.270827][ T187] usb 1-1: config 0 descriptor?? [ 143.294664][ T6590] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 143.849827][ T2008] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 144.012619][ T2008] usb 2-1: Using ep0 maxpacket: 32 [ 144.043448][ T2008] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 144.090073][ T2008] usb 2-1: config 2 has no interface number 0 [ 144.138497][ T2008] usb 2-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 144.170621][ T187] ipheth 1-1:0.196: ipheth_enable_ncm: usb_control_msg: -71 [ 144.199251][ T2008] usb 2-1: config 2 interface 88 has no altsetting 0 [ 144.221407][ T187] ipheth 1-1:0.196: Apple iPhone USB Ethernet device attached [ 144.246282][ T187] usb 1-1: USB disconnect, device number 2 [ 144.247034][ T2008] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 144.306080][ T2008] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 144.322911][ T2008] usb 2-1: Product: syz [ 144.330285][ T2008] usb 2-1: Manufacturer: syz [ 144.352529][ T2008] usb 2-1: SerialNumber: syz [ 144.368704][ T6638] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 144.494810][ T187] ipheth 1-1:0.196: Apple iPhone USB Ethernet now disconnected [ 144.635457][ T6638] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 145.168513][ T6658] loop0: detected capacity change from 0 to 1024 [ 145.297968][ T6662] gadgetfs: bound to dummy_udc driver [ 145.313456][ T6658] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.351097][ T6658] ext4 filesystem being mounted at /43/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 145.397349][ T6658] EXT4-fs error (device loop0): ext4_validate_block_bitmap:431: comm syz.0.308: bg 0: block 3: invalid block bitmap [ 145.424100][ T6658] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 51 with error 28 [ 145.443558][ T6658] EXT4-fs (loop0): This should not happen!! Data will be lost [ 145.443558][ T6658] [ 145.475974][ T6658] EXT4-fs (loop0): Total free blocks count 0 [ 145.501510][ T6658] EXT4-fs (loop0): Free/Dirty block details [ 145.535996][ T6658] EXT4-fs (loop0): free_blocks=0 [ 145.557833][ T6658] EXT4-fs (loop0): dirty_blocks=64 [ 145.571828][ T6658] EXT4-fs (loop0): Block reservation details [ 145.608653][ T6658] EXT4-fs (loop0): i_reserved_data_blocks=4 [ 145.688981][ T2008] asix 2-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 145.732596][ T2008] asix 2-1:2.88: probe with driver asix failed with error -71 [ 145.826100][ T2008] usb 2-1: USB disconnect, device number 4 [ 145.965350][ T5628] EXT4-fs warning (device loop0): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 146.023649][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 146.136830][ T6675] loop2: detected capacity change from 0 to 4096 [ 146.306242][ T6675] ntfs3(loop2): Failed to load $Extend (-22). [ 146.335465][ T6675] ntfs3(loop2): Failed to initialize $Extend. [ 146.495133][ T31] kauditd_printk_skb: 64 callbacks suppressed [ 146.495157][ T31] audit: type=1800 audit(3933048877.715:78): pid=6675 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.313" name="file1" dev="loop2" ino=30 res=0 errno=0 [ 146.823074][ T6695] nbd1: detected capacity change from 0 to 63 [ 146.859834][ T6696] block nbd1: NBD_DISCONNECT [ 146.927914][ T6696] block nbd1: Disconnected due to user request. [ 146.996442][ T6696] block nbd1: shutting down sockets [ 147.577256][ T6708] Illegal XDP return value 32768 on prog (id 27) dev syz_tun, expect packet loss! [ 147.677617][ T6681] loop4: detected capacity change from 0 to 32768 [ 147.737241][ T6681] xfs: Unknown parameter 'smackfstransmute' [ 148.905999][ T6711] loop0: detected capacity change from 0 to 131072 [ 148.917079][ T6711] F2FS-fs (loop0): Zoned block device path is missing [ 148.924386][ T6711] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 148.934259][ T6711] F2FS-fs (loop0): invalid crc value [ 149.041172][ T6711] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 149.053337][ T6711] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 149.060402][ T6711] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 149.441763][ T6733] loop3: detected capacity change from 0 to 4096 [ 149.449489][ T6737] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 149.608599][ T6733] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 149.690404][ T6733] ntfs3(loop3): Failed to load $Extend (-22). [ 149.741034][ T6733] ntfs3(loop3): Failed to initialize $Extend. [ 149.957562][ T6733] loop3: detected capacity change from 4096 to 128 [ 150.324824][ T31] audit: type=1807 audit(3933048881.545:79): UNKNOWN=0 res=0 [ 150.343626][ T6755] ima: policy update failed [ 150.363780][ T31] audit: type=1802 audit(3933048881.555:80): pid=6755 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.5.339" res=0 errno=0 [ 150.441647][ T31] audit: type=1802 audit(3933048881.585:81): pid=6755 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.5.339" res=0 errno=0 [ 151.091408][ T24] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 151.291712][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 151.293410][ T6767] loop0: detected capacity change from 0 to 40427 [ 151.304415][ T6767] F2FS-fs: heap/no_heap options were deprecated [ 151.421702][ T6767] F2FS-fs (loop0): build fault injection rate: 19 [ 151.428189][ T6767] F2FS-fs (loop0): build fault injection type: 0x3bfe8c [ 151.449828][ T24] usb 2-1: config 0 has no interfaces? [ 151.490917][ T6767] F2FS-fs (loop0): invalid crc value [ 151.510669][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 151.520272][ T6767] F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of __f2fs_build_free_nids+0x1fe/0x10a0 [ 151.602143][ T6767] F2FS-fs (loop0): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_get_node_info+0xe15/0x1710 [ 151.617936][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.620400][ T6767] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 151.637936][ T6767] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 151.823973][ T24] usb 2-1: config 0 descriptor?? [ 152.018148][ T6767] F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of f2fs_get_dnode_of_data+0x114c/0x3020 [ 152.078904][ T6795] F2FS-fs (loop0): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_get_node_info+0xe15/0x1710 [ 152.096739][ T6795] F2FS-fs (loop0): inject page get in f2fs_filemap_get_folio of generic_perform_write+0x292/0xa40 [ 152.271926][ T6798] loop5: detected capacity change from 0 to 512 [ 152.281533][ T6767] F2FS-fs (loop0): inject no more block in inc_valid_node_count of f2fs_new_node_folio+0x237/0x1160 [ 152.332505][ T6798] EXT4-fs: Ignoring removed nobh option [ 152.418459][ T5628] syz-executor: attempt to access beyond end of device [ 152.418459][ T5628] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 152.443737][ T10] usb 2-1: USB disconnect, device number 5 [ 152.467104][ T6798] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 152.520157][ T5628] CPU: 0 UID: 0 PID: 5628 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 152.520215][ T5628] Tainted: [L]=SOFTLOCKUP [ 152.520228][ T5628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 152.520250][ T5628] Call Trace: [ 152.520262][ T5628] [ 152.520276][ T5628] dump_stack_lvl+0x100/0x190 [ 152.520325][ T5628] f2fs_stop_checkpoint+0x5e6/0xb30 [ 152.520388][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.520435][ T5628] ? errseq_set+0xe3/0x150 [ 152.520494][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.520547][ T5628] f2fs_write_end_bio+0xf53/0x1340 [ 152.520591][ T5628] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 152.520637][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.520692][ T5628] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 152.520732][ T5628] bio_endio+0x778/0x8e0 [ 152.520780][ T5628] submit_bio_noacct+0x64c/0x1ff0 [ 152.520851][ T5628] f2fs_submit_write_bio+0x133/0x330 [ 152.520920][ T5628] __submit_merged_bio+0x330/0x7b0 [ 152.520957][ T5628] ? rcu_is_watching+0x12/0xc0 [ 152.521018][ T5628] __submit_merged_write_cond+0x3fe/0x510 [ 152.521068][ T5628] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 152.521121][ T5628] ? __pfx___might_resched+0x10/0x10 [ 152.521161][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.521211][ T5628] ? folio_clear_dirty_for_io+0x178/0x960 [ 152.521280][ T5628] f2fs_write_cache_pages+0x20e9/0x2630 [ 152.521351][ T5628] ? __bfs+0xef/0x2a0 [ 152.521410][ T5628] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 152.521457][ T5628] ? is_bpf_text_address+0x8a/0x1a0 [ 152.521500][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.521546][ T5628] ? __kasan_check_byte+0x13/0x50 [ 152.521586][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.521632][ T5628] ? unwind_next_frame+0x3be/0x2090 [ 152.521693][ T5628] ? rcu_is_watching+0x12/0xc0 [ 152.521746][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.521793][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.521838][ T5628] ? __kasan_check_byte+0x13/0x50 [ 152.521883][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.521944][ T5628] ? is_bpf_text_address+0x94/0x1a0 [ 152.521983][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.522028][ T5628] ? kernel_text_address+0x8d/0x100 [ 152.522132][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.522177][ T5628] ? check_prev_add+0x354/0xe60 [ 152.522218][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.522264][ T5628] ? rcu_is_watching+0x12/0xc0 [ 152.522324][ T5628] f2fs_write_data_pages+0x799/0x16d0 [ 152.522387][ T5628] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 152.522445][ T5628] ? do_writepages+0x4b5/0x600 [ 152.522506][ T5628] ? do_writepages+0x4b5/0x600 [ 152.522564][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.522617][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.522665][ T5628] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 152.522725][ T5628] do_writepages+0x278/0x600 [ 152.522796][ T5628] ? __pfx_do_writepages+0x10/0x10 [ 152.522861][ T5628] ? do_raw_spin_unlock+0x145/0x1e0 [ 152.522921][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.522965][ T5628] ? _raw_spin_unlock+0x28/0x50 [ 152.523014][ T5628] filemap_writeback+0x22d/0x2e0 [ 152.523053][ T5628] ? __pfx_filemap_writeback+0x10/0x10 [ 152.523145][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.523195][ T5628] ? find_held_lock+0x2b/0x80 [ 152.523251][ T5628] ? f2fs_sync_dirty_inodes+0x3a7/0x970 [ 152.523302][ T5628] ? f2fs_sync_dirty_inodes+0x3a7/0x970 [ 152.523350][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.523408][ T5628] f2fs_sync_dirty_inodes+0x46a/0x970 [ 152.523477][ T5628] block_operations+0x2a6/0xfc0 [ 152.523538][ T5628] ? __pfx_block_operations+0x10/0x10 [ 152.523641][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.523689][ T5628] ? ktime_get+0x22c/0x320 [ 152.523731][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.523776][ T5628] ? rcu_is_watching+0x12/0xc0 [ 152.523836][ T5628] f2fs_write_checkpoint+0x58b/0x53d0 [ 152.523894][ T5628] ? _raw_spin_unlock_irq+0x23/0x50 [ 152.523939][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.523984][ T5628] ? _raw_spin_unlock_irq+0x2e/0x50 [ 152.524025][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.524070][ T5628] ? __wait_for_common+0x1f3/0x4c0 [ 152.524119][ T5628] ? __pfx_schedule_timeout+0x10/0x10 [ 152.524165][ T5628] ? __pfx___wait_for_common+0x10/0x10 [ 152.524217][ T5628] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 152.524280][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.524326][ T5628] ? rcu_is_watching+0x12/0xc0 [ 152.524379][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.524425][ T5628] ? kthread_stop+0x280/0x630 [ 152.524488][ T5628] kill_f2fs_super+0x3f1/0x4a0 [ 152.524538][ T5628] ? __pfx_kill_f2fs_super+0x10/0x10 [ 152.524607][ T5628] ? lockdep_hardirqs_on+0x78/0x100 [ 152.524656][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.524703][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.524763][ T5628] deactivate_locked_super+0xc1/0x1b0 [ 152.524811][ T5628] deactivate_super+0xe7/0x110 [ 152.524859][ T5628] cleanup_mnt+0x21f/0x450 [ 152.524919][ T5628] task_work_run+0x150/0x240 [ 152.524956][ T5628] ? __pfx_task_work_run+0x10/0x10 [ 152.524997][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.525051][ T5628] exit_to_user_mode_loop+0x1d8/0x6f0 [ 152.525097][ T5628] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.525143][ T5628] ? rcu_is_watching+0x12/0xc0 [ 152.525202][ T5628] do_syscall_64+0x666/0x870 [ 152.525260][ T5628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.525299][ T5628] RIP: 0033:0x7f377399f257 [ 152.525328][ T5628] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 152.525364][ T5628] RSP: 002b:00007ffca32c5798 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 152.525399][ T5628] RAX: 0000000000000000 RBX: 00007f3773a3445c RCX: 00007f377399f257 [ 152.525424][ T5628] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffca32c5850 [ 152.525447][ T5628] RBP: 00007ffca32c5850 R08: 00007ffca32c6850 R09: 00000000ffffffff [ 152.525471][ T5628] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffca32c68e0 [ 152.525510][ T5628] R13: 00007f3773a3445c R14: 00000000000252de R15: 00007ffca32c6920 [ 152.525558][ T5628] [ 152.595270][ T6798] ext4 filesystem being mounted at /50/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 152.771822][ T5628] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 152.777037][ T24] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 152.947187][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 153.201534][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 153.236535][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 153.265583][ T24] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 153.297994][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.337167][ T5635] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.337269][ T24] usb 4-1: Product: syz [ 153.385702][ T24] usb 4-1: Manufacturer: syz [ 153.400552][ T24] usb 4-1: SerialNumber: syz [ 153.506825][ T24] usb 4-1: selecting invalid altsetting 1 [ 153.550557][ T31] audit: type=1800 audit(3933048884.765:82): pid=6815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.353" name="use" dev="configfs" ino=12039 res=0 errno=0 [ 153.576562][ T24] usb 4-1: unit 6 not found! [ 154.041300][ T29] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 154.242034][ T29] usb 1-1: Using ep0 maxpacket: 8 [ 154.267943][ T29] usb 1-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 154.289008][ T24] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 154.298162][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 154.318904][ T29] usb 1-1: Product: syz [ 154.333942][ T24] usb 4-1: USB disconnect, device number 3 [ 154.346485][ T29] usb 1-1: Manufacturer: syz [ 154.373288][ T29] usb 1-1: SerialNumber: syz [ 154.446176][ T29] usb 1-1: config 0 descriptor?? [ 154.485352][ T29] gspca_main: sq905-2.14.0 probing 2770:9120 [ 154.566971][ T5614] udevd[5614]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 155.243033][ T6841] loop3: detected capacity change from 0 to 2048 [ 155.275941][ T6841] UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 155.303696][ T6841] UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 155.348070][ T6841] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 155.501703][ T29] gspca_sq905: bulk read fail (-22) len 0/4 [ 155.525130][ T29] sq905 1-1:0.0: probe with driver sq905 failed with error -5 [ 155.556378][ T6848] loop1: detected capacity change from 0 to 64 [ 155.770901][ T10] usb 1-1: USB disconnect, device number 3 [ 155.771370][ T6848] hfs: request for non-existent node 237 in B*Tree [ 155.830428][ T6848] hfs: request for non-existent node 237 in B*Tree [ 155.940217][ T6857] hfs: request for non-existent node 237 in B*Tree [ 155.963547][ T6857] hfs: request for non-existent node 237 in B*Tree [ 156.000705][ T6857] hfs: request for non-existent node 237 in B*Tree [ 156.025674][ T6857] hfs: request for non-existent node 237 in B*Tree [ 156.050028][ T6857] hfs: request for non-existent node 237 in B*Tree [ 156.088340][ T6857] hfs: request for non-existent node 237 in B*Tree [ 156.355237][ T6862] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 156.849094][ T6875] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-22) [ 157.641151][ T6890] netlink: 12 bytes leftover after parsing attributes in process `syz.5.381'. [ 158.140968][ T6893] loop0: detected capacity change from 0 to 32768 [ 158.164768][ T6893] (syz.0.383,6893,0):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 158.182509][ T6893] (syz.0.383,6893,0):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 158.241442][ T6893] JBD2: Ignoring recovery information on journal [ 158.292982][ T6893] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 158.495811][ T6893] process 'syz.0.383' launched './file0' with NULL argv: empty string added [ 158.812990][ T5628] ocfs2: Unmounting device (7,0) on (node local) [ 159.147210][ T6913] loop1: detected capacity change from 0 to 512 [ 159.169068][ T6913] EXT4-fs: Ignoring removed nobh option [ 159.234738][ T6914] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 159.275017][ T6913] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 159.289526][ T6914] overlayfs: failed to set xattr on upper [ 159.368345][ T6914] overlayfs: ...falling back to redirect_dir=nofollow. [ 159.414171][ T6914] overlayfs: ...falling back to index=off. [ 159.429645][ T6913] ext4 filesystem being mounted at /73/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 159.767366][ T6925] loop3: detected capacity change from 0 to 128 [ 159.794483][ T6925] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 159.954461][ T5629] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.876434][ T6947] loop4: detected capacity change from 0 to 2048 [ 160.962853][ T6947] UDF-fs: error (device loop4): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 161.030392][ T6947] UDF-fs: error (device loop4): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 161.131041][ T6947] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 161.283637][ T6929] loop2: detected capacity change from 0 to 131072 [ 161.296874][ T6929] F2FS-fs (loop2): invalid crc value [ 161.406885][ T6929] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 161.430927][ T6929] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 161.690105][ T31] audit: type=1800 audit(3933048892.905:83): pid=6929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.397" name="bus" dev="loop2" ino=10 res=0 errno=0 [ 162.039171][ T6962] loop1: detected capacity change from 0 to 4096 [ 162.054190][ T6964] nbd4: detected capacity change from 0 to 63 [ 162.111388][ T6965] block nbd4: NBD_DISCONNECT [ 162.138142][ T6965] block nbd4: Disconnected due to user request. [ 162.151773][ T6965] block nbd4: shutting down sockets [ 162.175821][ T6969] loop3: detected capacity change from 0 to 512 [ 162.193308][ T6962] NILFS (loop1): invalid segment: Sequence number mismatch [ 162.204142][ T1767] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 162.217808][ T1767] Buffer I/O error on dev nbd4, logical block 0, async page read [ 162.228798][ T1767] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 162.238581][ T1767] Buffer I/O error on dev nbd4, logical block 1, async page read [ 162.247741][ T1767] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 162.255953][ T6962] NILFS (loop1): trying rollback from an earlier position [ 162.257418][ T1767] Buffer I/O error on dev nbd4, logical block 2, async page read [ 162.272881][ T1767] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 162.283728][ T1767] Buffer I/O error on dev nbd4, logical block 3, async page read [ 162.289455][ T6969] EXT4-fs: Ignoring removed nobh option [ 162.303325][ T1956] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 162.314790][ T1956] Buffer I/O error on dev nbd4, logical block 0, async page read [ 162.322827][ T1956] Buffer I/O error on dev nbd4, logical block 1, async page read [ 162.332053][ T1956] Buffer I/O error on dev nbd4, logical block 2, async page read [ 162.342346][ T1956] Buffer I/O error on dev nbd4, logical block 3, async page read [ 162.352462][ T1956] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 162.365708][ T1956] Buffer I/O error on dev nbd4, logical block 0, async page read [ 162.373758][ T1956] Buffer I/O error on dev nbd4, logical block 1, async page read [ 162.383512][ T1956] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 162.393723][ T1956] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 162.403559][ T1956] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 162.414843][ T6973] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 162.424683][ T5651] ldm_validate_partition_table(): Disk read failed. [ 162.434878][ T5651] Dev nbd4: unable to read RDB block 0 [ 162.444050][ T5651] nbd4: unable to read partition table [ 162.468718][ T5651] ldm_validate_partition_table(): Disk read failed. [ 162.478076][ T5651] Dev nbd4: unable to read RDB block 0 [ 162.485856][ T5651] nbd4: unable to read partition table [ 162.604047][ T6969] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 162.627635][ T6962] NILFS (loop1): recovery complete [ 162.634581][ T5908] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 162.636176][ T6969] ext4 filesystem being mounted at /66/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 162.695125][ T6977] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 162.862061][ T5908] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.910352][ T5908] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.954015][ T5908] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 162.976409][ T5630] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 162.987010][ T5908] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 162.987055][ T5908] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.995623][ T5908] usb 1-1: config 0 descriptor?? [ 163.141942][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 163.301274][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 163.315244][ T10] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 163.336479][ T10] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 163.369177][ T10] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 163.399540][ T10] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 163.441271][ T10] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 163.487355][ T10] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 163.531472][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.580904][ T5908] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 163.806236][ T10] usb 6-1: usb_control_msg returned -32 [ 163.827198][ T10] usbtmc 6-1:16.0: can't read capabilities [ 165.263208][ T7004] loop2: detected capacity change from 0 to 32768 [ 165.347101][ T7004] XFS (loop2): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 165.513789][ T7004] XFS (loop2): Ending clean mount [ 165.640646][ T7022] loop0: detected capacity change from 0 to 2048 [ 165.655179][ T10] usb 1-1: USB disconnect, device number 4 [ 165.694220][ T7022] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 165.716908][ T7022] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 165.777033][ T7022] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 165.876606][ T5633] XFS (loop2): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 166.024794][ T5908] usb 6-1: USB disconnect, device number 6 [ 166.296514][ T7035] loop0: detected capacity change from 0 to 512 [ 166.349830][ T7035] EXT4-fs: Ignoring removed nobh option [ 166.390772][ T7035] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 166.418760][ T7035] ext4 filesystem being mounted at /60/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 166.883997][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.924760][ T7049] loop5: detected capacity change from 0 to 256 [ 166.992794][ T7049] vfat filesystem being mounted at /62/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2107-12-31 (0x10391447e) [ 167.079241][ T7049] FAT-fs (loop5): error, allocated dir entry found after end-of-directory marker (i_pos 1) [ 167.121283][ T5908] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 167.179508][ T7049] FAT-fs (loop5): Filesystem has been set read-only [ 167.294141][ T5908] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 167.339353][ T5908] usb 4-1: config 0 has no interface number 0 [ 167.363745][ T5908] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 167.392142][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.402536][ T5908] usb 4-1: Product: syz [ 167.406753][ T5908] usb 4-1: Manufacturer: syz [ 167.427273][ T5908] usb 4-1: SerialNumber: syz [ 167.478956][ T5908] usb 4-1: config 0 descriptor?? [ 167.506389][ T7057] netlink: 8 bytes leftover after parsing attributes in process `syz.2.437'. [ 167.558155][ T31] audit: type=1326 audit(3933048898.775:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7058 comm="syz.0.450" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f377399e019 code=0x0 [ 167.559916][ T7057] netlink: 4 bytes leftover after parsing attributes in process `syz.2.437'. [ 167.720647][ T7057] netlink: 8 bytes leftover after parsing attributes in process `syz.2.437'. [ 167.731423][ T185] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.758043][ T185] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.758941][ T5908] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 167.778471][ T7057] netlink: 4 bytes leftover after parsing attributes in process `syz.2.437'. [ 167.788254][ T185] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.820641][ T185] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 167.887356][ T5908] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 167.921852][ T5908] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 167.954202][ T5908] usb 4-1: media controller created [ 168.087286][ T5908] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 168.291063][ T5908] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 168.446602][ T5908] usb 4-1: USB disconnect, device number 4 [ 168.681378][ T7085] nbd0: detected capacity change from 0 to 63 [ 168.693744][ T7086] block nbd0: NBD_DISCONNECT [ 168.698762][ T7086] block nbd0: Disconnected due to user request. [ 168.705634][ T7086] block nbd0: shutting down sockets [ 168.715339][ C1] blk_print_req_error: 117 callbacks suppressed [ 168.715364][ C1] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.731370][ C1] buffer_io_error: 138 callbacks suppressed [ 168.731392][ C1] Buffer I/O error on dev nbd0, logical block 0, async page read [ 168.745804][ C1] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.755380][ C1] Buffer I/O error on dev nbd0, logical block 1, async page read [ 168.764213][ C0] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.773853][ C0] Buffer I/O error on dev nbd0, logical block 2, async page read [ 168.781671][ C0] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.791284][ C0] Buffer I/O error on dev nbd0, logical block 3, async page read [ 168.799281][ T6973] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.809061][ T6973] Buffer I/O error on dev nbd0, logical block 0, async page read [ 168.817322][ T6973] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.827015][ T6973] Buffer I/O error on dev nbd0, logical block 1, async page read [ 168.836274][ T6973] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 2 prio class 2 [ 168.846008][ T6973] Buffer I/O error on dev nbd0, logical block 2, async page read [ 168.854832][ T6973] Buffer I/O error on dev nbd0, logical block 3, async page read [ 168.863242][ T6973] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 168.873103][ T6973] Buffer I/O error on dev nbd0, logical block 0, async page read [ 168.882405][ T6973] Buffer I/O error on dev nbd0, logical block 1, async page read [ 168.894245][ T1767] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 168.904813][ T1767] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 168.919517][ T5614] ldm_validate_partition_table(): Disk read failed. [ 168.928954][ T5614] Dev nbd0: unable to read RDB block 0 [ 168.936302][ T5614] nbd0: unable to read partition table [ 168.949278][ T5614] ldm_validate_partition_table(): Disk read failed. [ 168.957708][ T5614] Dev nbd0: unable to read RDB block 0 [ 168.967982][ T5614] nbd0: unable to read partition table [ 169.143083][ T7093] warning: `syz.0.451' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 169.178288][ T7094] loop5: detected capacity change from 0 to 16 [ 169.227285][ T7097] loop4: detected capacity change from 0 to 512 [ 169.228143][ T7094] erofs (device loop5): mounted with root inode @ nid 36. [ 169.265013][ T7097] EXT4-fs: Ignoring removed nobh option [ 169.315808][ T7095] nbd3: detected capacity change from 0 to 63 [ 169.348664][ T7099] block nbd3: NBD_DISCONNECT [ 169.371036][ T7097] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 169.388674][ T7099] block nbd3: Disconnected due to user request. [ 169.397090][ T7097] ext4 filesystem being mounted at /82/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 169.413558][ T7099] block nbd3: shutting down sockets [ 169.839672][ T5632] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.101910][ T7115] loop0: detected capacity change from 0 to 512 [ 170.134480][ T7115] EXT4-fs: Ignoring removed nobh option [ 170.220134][ T7115] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.277240][ T7115] ext4 filesystem being mounted at /66/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 170.657415][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.719871][ T7127] netlink: 'syz.4.463': attribute type 2 has an invalid length. [ 170.777920][ T7127] netlink: 'syz.4.463': attribute type 2 has an invalid length. [ 170.849547][ T7127] netlink: 1347 bytes leftover after parsing attributes in process `syz.4.463'. [ 170.941118][ T5638] Bluetooth: hci4: link tx timeout [ 170.945029][ T7131] loop1: detected capacity change from 0 to 512 [ 170.960526][ T5638] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 170.971586][ T5638] Bluetooth: hci4: link tx timeout [ 170.976711][ T5638] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 171.275844][ T7139] loop5: detected capacity change from 0 to 2048 [ 171.326902][ T7139] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 171.392603][ T7139] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 171.465054][ T7139] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 171.827962][ T7147] loop3: detected capacity change from 0 to 16 [ 171.866368][ T24] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 171.909289][ T7147] erofs (device loop3): mounted with root inode @ nid 36. [ 171.941625][ T24] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 171.989270][ T7153] nbd5: detected capacity change from 0 to 63 [ 172.020177][ T7155] block nbd5: NBD_DISCONNECT [ 172.052621][ T7155] block nbd5: Disconnected due to user request. [ 172.084722][ T7155] block nbd5: shutting down sockets [ 172.112793][ T5611] ldm_validate_partition_table(): Disk read failed. [ 172.144710][ T5611] Dev nbd5: unable to read RDB block 0 [ 172.168851][ T5611] nbd5: unable to read partition table [ 172.193661][ T5611] ldm_validate_partition_table(): Disk read failed. [ 172.209166][ T5611] Dev nbd5: unable to read RDB block 0 [ 172.224077][ T5611] nbd5: unable to read partition table [ 172.343883][ T7160] netlink: 12 bytes leftover after parsing attributes in process `syz.2.475'. [ 172.590518][ T7166] loop0: detected capacity change from 0 to 512 [ 172.606215][ T7166] EXT4-fs: Ignoring removed nobh option [ 172.695085][ T7166] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 172.707867][ T7166] ext4 filesystem being mounted at /68/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 173.012003][ T5638] Bluetooth: hci4: command 0x0406 tx timeout [ 173.172336][ T5974] wlan1: Trigger new scan to find an IBSS to join [ 175.499019][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 176.001537][ T7176] loop4: detected capacity change from 0 to 4096 [ 176.981710][ T24] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 177.149089][ T24] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 177.168255][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 177.201274][ T24] usb 5-1: config 0 has no interfaces? [ 177.216876][ T24] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 177.246620][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.294859][ T24] usb 5-1: config 0 descriptor?? [ 177.471014][ T7206] loop0: detected capacity change from 0 to 16 [ 177.491553][ T5638] Bluetooth: hci4: command 0x0406 tx timeout [ 177.507171][ T7206] erofs (device loop0): mounted with root inode @ nid 36. [ 177.638167][ T24] usb 5-1: USB disconnect, device number 4 [ 178.134078][ T5973] wlan1: Trigger new scan to find an IBSS to join [ 178.302188][ T10] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 178.611569][ T10] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 178.769210][ T7243] 9p: Unknown uid 00000000004294967295 [ 179.054590][ T58] wlan1: Creating new IBSS network, BSSID 8e:b8:fb:e0:21:31 [ 179.099060][ T7254] loop4: detected capacity change from 0 to 16 [ 179.129893][ T7254] erofs (device loop4): mounted with root inode @ nid 36. [ 179.431309][ T29] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 179.505685][ T7267] team0: No ports can be present during mode change [ 179.551772][ T7267] netlink: 4 bytes leftover after parsing attributes in process `syz.0.521'. [ 179.617458][ T7267] team0 (unregistering): Port device team_slave_0 removed [ 179.633363][ T29] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 179.676229][ T29] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 179.685114][ T7267] team0 (unregistering): Port device team_slave_1 removed [ 179.713631][ T29] usb 2-1: Product: syz [ 179.734975][ T29] usb 2-1: SerialNumber: syz [ 179.777916][ T29] usb 2-1: config 0 descriptor?? [ 180.019485][ T29] hso 2-1:0.0: Failed to find INT IN ep [ 180.154250][ T7279] ip6tnl1: entered promiscuous mode [ 180.277393][ T29] usb 2-1: USB disconnect, device number 6 [ 180.573129][ T31] audit: type=1800 audit(3933048911.795:85): pid=7288 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.531" name="compatible_id" dev="configfs" ino=13749 res=0 errno=0 [ 180.933037][ T5645] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 180.943585][ T5645] Bluetooth: hci0: Injecting HCI hardware error event [ 180.957334][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 180.957452][ T5638] Bluetooth: hci0: hardware error 0x00 [ 181.100580][ T7305] loop2: detected capacity change from 0 to 16 [ 181.136305][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.191852][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.202350][ T7305] erofs (device loop2): mounted with root inode @ nid 36. [ 181.244008][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 181.272356][ T7310] netlink: 12 bytes leftover after parsing attributes in process `syz.0.541'. [ 181.302617][ T10] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 181.355288][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.463256][ T10] usb 4-1: config 0 descriptor?? [ 181.957394][ T10] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 182.281989][ T2008] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 182.462126][ T2008] usb 3-1: Using ep0 maxpacket: 8 [ 182.478955][ T2008] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 182.506454][ T2008] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 182.528754][ T2008] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 182.569523][ T2008] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 182.610757][ T2008] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 182.664653][ T2008] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 182.720346][ T2008] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.975458][ T2008] usb 3-1: usb_control_msg returned -32 [ 182.991563][ T2008] usbtmc 3-1:16.0: can't read capabilities [ 183.092758][ T5638] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 183.106154][ T7339] loop5: detected capacity change from 0 to 256 [ 183.153440][ T7339] vfat filesystem being mounted at /84/file0 supports timestamps until 2107-12-31 (0x10391447e) [ 183.411329][ T5908] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 183.537635][ T7349] netlink: 12 bytes leftover after parsing attributes in process `syz.4.556'. [ 183.605374][ T5908] usb 2-1: unable to get BOS descriptor or descriptor too short [ 183.631030][ T5908] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 183.655938][ T5908] usb 2-1: can't read configurations, error -71 [ 184.252663][ T10] usb 4-1: USB disconnect, device number 5 [ 184.510548][ T7360] binder: 7358:7360 ioctl c0306201 2000000003c0 returned -14 [ 184.537273][ T7359] loop1: detected capacity change from 0 to 16 [ 184.569056][ T7359] erofs (device loop1): mounted with root inode @ nid 36. [ 184.710602][ T7365] loop5: detected capacity change from 0 to 128 [ 184.740760][ T7365] EXT4-fs (loop5): Test dummy encryption mode enabled [ 184.772667][ T7365] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a046c018, mo2=0042] [ 184.789032][ T7365] System zones: 1-3, 19-19, 35-36 [ 184.795382][ T7363] evm: overlay not supported [ 184.821639][ T7365] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 184.884950][ T7365] ext4 filesystem being mounted at /87/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 184.912492][ T7370] loop0: detected capacity change from 0 to 16 [ 184.914896][ T7365] fscrypt: AES-256-XTS using implementation "xts-aes-vaes-avx2" [ 184.998886][ T7370] erofs (device loop0): mounted with root inode @ nid 36. [ 185.070283][ T2008] usb 3-1: USB disconnect, device number 5 [ 185.357084][ T5635] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 185.773055][ T2008] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 185.965413][ T2008] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 186.013593][ T2008] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 186.060053][ T2008] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 186.109855][ T2008] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 186.129343][ T2008] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.159695][ T2008] usb 5-1: config 0 descriptor?? [ 186.269469][ T7397] loop1: detected capacity change from 0 to 16 [ 186.309990][ T7397] erofs (device loop1): mounted with root inode @ nid 36. [ 186.473065][ T7401] loop2: detected capacity change from 0 to 256 [ 186.549227][ T7401] vfat filesystem being mounted at /98/file0 supports timestamps until 2107-12-31 (0x10391447e) [ 186.681878][ T2008] plantronics 0003:047F:FFFF.000A: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 188.171439][ T7426] netlink: 12 bytes leftover after parsing attributes in process `syz.3.585'. [ 188.286934][ T31] audit: type=1800 audit(3933048919.505:86): pid=7431 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.589" name="c_mute_present" dev="configfs" ino=13977 res=0 errno=0 [ 188.881991][ T7444] loop2: detected capacity change from 0 to 16 [ 188.903702][ T7444] erofs (device loop2): mounted with root inode @ nid 36. [ 188.915263][ T5908] usb 5-1: USB disconnect, device number 5 [ 188.952836][ T5774] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 189.149883][ T5774] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 189.172149][ T7448] loop1: detected capacity change from 0 to 8 [ 189.199266][ T5774] usb 4-1: config 0 has no interface number 0 [ 189.229677][ T5774] usb 4-1: config 0 interface 41 has no altsetting 0 [ 189.277249][ T5774] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 189.322192][ T5774] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.356480][ T7448] SQUASHFS error: Failed to read block 0x60: -5 [ 189.375078][ T5774] usb 4-1: Product: syz [ 189.391371][ T5774] usb 4-1: Manufacturer: syz [ 189.412930][ T5774] usb 4-1: SerialNumber: syz [ 189.438664][ T5774] usb 4-1: config 0 descriptor?? [ 189.652391][ T7453] loop2: detected capacity change from 0 to 256 [ 189.717662][ T7453] vfat filesystem being mounted at /104/bus supports timestamps until 2107-12-31 (0x103912eb2) [ 190.045389][ T29] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 190.245873][ T29] usb 3-1: config 0 interface 0 has no altsetting 0 [ 190.270452][ T29] usb 3-1: New USB device found, idVendor=056a, idProduct=00de, bcdDevice= 0.00 [ 190.314033][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.352302][ T29] usb 3-1: config 0 descriptor?? [ 190.391534][ T5774] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 190.642778][ T5774] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 190.685890][ T5774] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 190.732275][ T5774] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 190.784877][ T5774] usb 4-1: USB disconnect, device number 6 [ 190.911406][ T29] wacom 0003:056A:00DE.000B: ignoring exceeding usage max [ 190.983835][ T29] wacom 0003:056A:00DE.000B: ignoring exceeding usage max [ 191.064221][ T29] wacom 0003:056A:00DE.000B: unknown main item tag 0x5 [ 191.113428][ T29] wacom 0003:056A:00DE.000B: collection stack underflow [ 191.172820][ T29] wacom 0003:056A:00DE.000B: item 0 1 0 12 parsing failed [ 191.231525][ T29] wacom 0003:056A:00DE.000B: parse failed [ 191.264973][ T29] wacom 0003:056A:00DE.000B: probe with driver wacom failed with error -22 [ 191.280878][ T7474] loop4: detected capacity change from 0 to 8 [ 191.344883][ T29] usb 3-1: USB disconnect, device number 6 [ 191.940175][ T7472] loop0: detected capacity change from 0 to 131072 [ 191.948559][ T7472] F2FS-fs (loop0): Invalid log sectorsize (67108873) [ 191.962032][ T7472] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 191.980621][ T7472] F2FS-fs (loop0): invalid crc value [ 192.098360][ T7472] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 192.114483][ T7472] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 192.122071][ T7472] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 192.245348][ T5908] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 192.441323][ T5908] usb 2-1: Using ep0 maxpacket: 8 [ 192.463004][ T5908] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 192.491526][ T5908] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 192.523135][ T5908] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 192.556623][ T7490] loop3: detected capacity change from 0 to 16 [ 192.560676][ T5908] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 192.608888][ T5908] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 192.613881][ T7490] erofs (device loop3): mounted with root inode @ nid 36. [ 192.672884][ T5908] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 192.718950][ T5908] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.990057][ T5908] usb 2-1: usb_control_msg returned -32 [ 193.015572][ T5908] usbtmc 2-1:16.0: can't read capabilities [ 193.574251][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.591473][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.106095][ T5908] usb 2-1: USB disconnect, device number 9 [ 195.024760][ T7512] loop1: detected capacity change from 0 to 4096 [ 195.054996][ T7512] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512). [ 195.151038][ T7512] ntfs3(loop1): Failed to load $Extend (-22). [ 195.167005][ T7512] ntfs3(loop1): Failed to initialize $Extend. [ 195.283540][ T31] audit: type=1800 audit(3933048926.505:87): pid=7512 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.626" name="bus" dev="loop1" ino=33 res=0 errno=0 [ 195.960853][ T7527] loop0: detected capacity change from 0 to 4096 [ 196.133690][ T7527] ntfs3(loop0): Failed to load $Extend (-22). [ 196.169010][ T7527] ntfs3(loop0): Failed to initialize $Extend. [ 196.268833][ T31] audit: type=1800 audit(3933048927.485:88): pid=7527 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.633" name="file1" dev="loop0" ino=30 res=0 errno=0 [ 196.471324][ T5908] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 196.484777][ T7527] ntfs3(loop0): ino=5, "/" mi_enum_attr [ 196.525327][ T7527] ntfs3(loop0): ino=5, "/" mi_enum_attr [ 196.541760][ T29] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 196.554155][ T7527] ntfs3(loop0): ino=5, "/" mi_enum_attr [ 196.579541][ T7527] ntfs3(loop0): ino=5, "/" mi_enum_attr [ 196.660153][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.692298][ T5908] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 196.741765][ T29] usb 3-1: Using ep0 maxpacket: 32 [ 196.743942][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.760549][ T29] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 196.797058][ T5908] usb 4-1: config 0 descriptor?? [ 196.802885][ T29] usb 3-1: config 0 has no interface number 0 [ 196.809507][ T5981] ntfs3(loop0): ino=5, mi_enum_attr [ 196.826141][ T5981] ntfs3(loop0): Mark volume as dirty due to NTFS errors [ 196.830933][ T29] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 196.880919][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.920281][ T29] usb 3-1: Product: syz [ 196.944620][ T29] usb 3-1: Manufacturer: syz [ 196.950962][ T7543] syz.4.638 uses obsolete (PF_INET,SOCK_PACKET) [ 196.976384][ T29] usb 3-1: SerialNumber: syz [ 197.007983][ T29] usb 3-1: config 0 descriptor?? [ 197.056753][ T29] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 197.112142][ T5908] usbhid 4-1:0.0: can't add hid device: -71 [ 197.134443][ T5908] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 197.190396][ T5908] usb 4-1: USB disconnect, device number 7 [ 197.280582][ T29] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 197.352276][ T29] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 197.517191][ T7551] netlink: 'syz.0.641': attribute type 1 has an invalid length. [ 197.560708][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 6 [ 197.769440][ T7551] 8021q: adding VLAN 0 to HW filter on device bond1 [ 197.791346][ T29] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 197.793239][ T10] usb 3-1: USB disconnect, device number 7 [ 197.798937][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 197.887936][ T10] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 197.975944][ T10] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 197.991779][ T29] usb 4-1: Using ep0 maxpacket: 32 [ 198.012922][ T7554] bond1: (slave gretap1): making interface the new active one [ 198.015645][ T10] quatech2 3-1:0.51: device disconnected [ 198.046591][ T29] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 198.080202][ T7554] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 198.094267][ T29] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 198.134761][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.186169][ T29] usb 4-1: config 0 descriptor?? [ 198.219178][ T29] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 198.273781][ T29] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 198.769577][ T29] usb 4-1: USB disconnect, device number 8 [ 198.799115][ T29] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 198.868515][ T7563] loop1: detected capacity change from 0 to 8192 [ 198.893361][ T7563] vfat filesystem being mounted at /119/bus supports timestamps until 2107-12-31 (0x10391447e) [ 198.952769][ T31] audit: type=1326 audit(3933048930.165:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7562 comm="syz.1.645" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4ecb19e019 code=0x0 [ 199.148008][ T7574] loop2: detected capacity change from 0 to 128 [ 199.169723][ T7574] EXT4-fs (loop2): Test dummy encryption mode enabled [ 199.216213][ T7574] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a046c018, mo2=0042] [ 199.250583][ T7574] System zones: 1-3, 19-19, 35-36 [ 199.268034][ T7574] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 199.284997][ T7574] ext4 filesystem being mounted at /115/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 199.569780][ T5633] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 199.884025][ T7587] loop2: detected capacity change from 0 to 8 [ 199.966629][ T7587] SQUASHFS error: Failed to read block 0x60: -5 [ 199.991511][ T5908] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 200.171286][ T5908] usb 5-1: Using ep0 maxpacket: 32 [ 200.189803][ T5908] usb 5-1: config 0 has an invalid interface number: 196 but max is 0 [ 200.201634][ T29] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 200.238866][ T5908] usb 5-1: config 0 has no interface number 0 [ 200.253344][ T5908] usb 5-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 200.288204][ T5908] usb 5-1: config 0 interface 196 has no altsetting 0 [ 200.308325][ T5908] usb 5-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 200.332616][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.350871][ T5908] usb 5-1: Product: syz [ 200.360985][ T5908] usb 5-1: Manufacturer: syz [ 200.376188][ T5908] usb 5-1: SerialNumber: syz [ 200.394204][ T29] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 200.406757][ T5908] usb 5-1: config 0 descriptor?? [ 200.429145][ T29] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 200.430304][ T7584] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 200.458747][ T29] usb 1-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 200.486092][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.529373][ T7589] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 200.548155][ T7589] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 200.595254][ T29] spcp8x5 1-1:1.0: SPCP8x5 converter detected [ 200.635681][ T29] usb 1-1: SPCP8x5 converter now attached to ttyUSB0 [ 201.080378][ T7603] netlink: 8 bytes leftover after parsing attributes in process `syz.3.659'. [ 201.120640][ T24] usb 1-1: USB disconnect, device number 5 [ 201.176520][ T24] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 201.205406][ T24] spcp8x5 1-1:1.0: device disconnected [ 201.331887][ T29] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 201.360297][ T5908] ipheth 5-1:0.196: ipheth_enable_ncm: usb_control_msg: -71 [ 201.464500][ T5908] ipheth 5-1:0.196: Apple iPhone USB Ethernet device attached [ 201.512355][ T29] usb 3-1: Using ep0 maxpacket: 16 [ 201.520533][ T5908] usb 5-1: USB disconnect, device number 6 [ 201.538679][ T29] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.570889][ T29] usb 3-1: config 0 interface 0 has no altsetting 0 [ 201.600653][ T29] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 201.650292][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.703593][ T29] usb 3-1: config 0 descriptor?? [ 201.727779][ T5908] ipheth 5-1:0.196: Apple iPhone USB Ethernet now disconnected [ 202.052481][ T5645] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 202.080512][ T5645] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 202.091395][ T5645] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 202.110743][ T5645] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 202.124391][ T5645] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 202.462237][ T29] nzxt-smart2 0003:1E71:2009.000C: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 202.991322][ T10] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 203.088389][ T29] usb 3-1: USB disconnect, device number 8 [ 203.173981][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 203.203149][ T10] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 203.235002][ T10] usb 4-1: config 0 has no interface number 0 [ 203.268895][ T10] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 203.322734][ T10] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 203.376219][ T10] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 203.417941][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.451089][ T10] usb 4-1: Product: syz [ 203.468350][ T10] usb 4-1: Manufacturer: syz [ 203.488731][ T10] usb 4-1: SerialNumber: syz [ 203.524449][ T5981] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 203.549534][ T10] usb 4-1: config 0 descriptor?? [ 203.556635][ T5981] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.578660][ T7635] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 203.592347][ T7635] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 203.841959][ T7635] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 203.874233][ T7635] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 204.119402][ T10] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 204.211849][ T5638] Bluetooth: hci6: command tx timeout [ 204.304534][ T5981] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 204.360464][ T5981] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.600180][ T5981] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 204.640958][ T5981] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.726175][ T10] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 204.773175][ T10] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 204.784627][ T7669] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 204.792723][ T7669] IPv6: NLM_F_CREATE should be set when creating new route [ 204.824182][ T10] asix 4-1:0.34: probe with driver asix failed with error -71 [ 204.874724][ T10] usb 4-1: USB disconnect, device number 9 [ 204.880733][ T7667] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 205.080152][ T5981] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 205.126220][ T5981] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.291329][ T5638] Bluetooth: hci6: command tx timeout [ 207.006826][ T5981] bridge_slave_1: left allmulticast mode [ 207.108767][ T5981] bridge_slave_1: left promiscuous mode [ 207.150440][ T5981] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.286115][ T5981] bridge_slave_0: left allmulticast mode [ 207.308033][ T5981] bridge_slave_0: left promiscuous mode [ 207.338993][ T5981] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.562972][ T7739] loop0: detected capacity change from 0 to 64 [ 207.670986][ T7733] loop4: detected capacity change from 0 to 4096 [ 207.699091][ T7739] hfs: request for non-existent node 237 in B*Tree [ 207.760182][ T7739] hfs: request for non-existent node 237 in B*Tree [ 207.813069][ T7740] hfs: request for non-existent node 237 in B*Tree [ 207.844598][ T7733] ntfs3(loop4): Failed to load $Extend (-22). [ 207.854694][ T7740] hfs: request for non-existent node 237 in B*Tree [ 207.872358][ T7733] ntfs3(loop4): Failed to initialize $Extend. [ 207.883416][ T7740] hfs: request for non-existent node 237 in B*Tree [ 207.909357][ T7740] hfs: request for non-existent node 237 in B*Tree [ 207.934998][ T7740] hfs: request for non-existent node 237 in B*Tree [ 207.953408][ T7740] hfs: request for non-existent node 237 in B*Tree [ 207.954040][ T31] audit: type=1800 audit(3933048939.175:90): pid=7733 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.694" name="file1" dev="loop4" ino=30 res=0 errno=0 [ 208.164354][ T7733] ntfs3(loop4): ino=5, "/" mi_enum_attr [ 208.197837][ T7733] ntfs3(loop4): ino=5, "/" mi_enum_attr [ 208.283277][ T7733] ntfs3(loop4): ino=5, "/" mi_enum_attr [ 208.336520][ T7733] ntfs3(loop4): ino=5, "/" mi_enum_attr [ 208.372291][ T5638] Bluetooth: hci6: command tx timeout [ 208.501756][ T12] ntfs3(loop4): ino=5, mi_enum_attr [ 208.518782][ T12] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 208.573404][ T7749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.697'. [ 208.604586][ T5981] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 208.685642][ T5981] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 208.728753][ T5981] bond0 (unregistering): Released all slaves [ 208.863459][ T7612] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.890489][ T7612] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.920105][ T7612] bridge_slave_0: entered allmulticast mode [ 208.953240][ T7612] bridge_slave_0: entered promiscuous mode [ 209.002106][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1 [ 209.124324][ T1125] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 209.192536][ T7612] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.212291][ T7612] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.229796][ T7612] bridge_slave_1: entered allmulticast mode [ 209.238087][ T7612] bridge_slave_1: entered promiscuous mode [ 209.528005][ T7612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 209.560957][ T7612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 209.797785][ T5981] hsr_slave_0: left promiscuous mode [ 209.811719][ T5981] hsr_slave_1: left promiscuous mode [ 209.830115][ T5981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.850676][ T5981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.862245][ T5981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 209.881253][ T5981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 209.940119][ T5981] veth1_macvtap: left promiscuous mode [ 209.953759][ T5981] veth0_macvtap: left promiscuous mode [ 209.970424][ T5981] veth1_vlan: left promiscuous mode [ 209.978995][ T5981] veth0_vlan: left promiscuous mode [ 210.451821][ T5638] Bluetooth: hci6: command tx timeout [ 210.579300][ T31] audit: type=1800 audit(3933048941.795:91): pid=7772 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.699" name="use" dev="configfs" ino=15719 res=0 errno=0 [ 210.758543][ T7776] overlayfs: refusing to follow metacopy origin for (/file1) [ 211.168828][ T5981] team0 (unregistering): Port device team_slave_1 removed [ 211.199086][ T5908] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 211.250040][ T5908] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 211.292794][ T5981] team0 (unregistering): Port device team_slave_0 removed [ 211.328797][ T7787] loop0: detected capacity change from 0 to 4096 [ 211.330845][ T7786] loop4: detected capacity change from 0 to 4096 [ 211.369052][ T7786] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 211.408663][ T7787] EXT4-fs (loop0): Test dummy encryption mode enabled [ 211.509241][ T7787] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 211.594624][ T7786] ntfs3(loop4): Failed to load $Extend (-22). [ 211.607483][ T7786] ntfs3(loop4): Failed to initialize $Extend. [ 211.724375][ T31] audit: type=1800 audit(3933048942.945:92): pid=7786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.705" name="bus" dev="loop4" ino=33 res=0 errno=0 [ 211.916275][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.203094][ T7612] team0: Port device team_slave_0 added [ 212.205365][ T7800] netlink: 4 bytes leftover after parsing attributes in process `syz.0.707'. [ 212.243339][ T7612] team0: Port device team_slave_1 added [ 212.259615][ T7798] loop2: detected capacity change from 0 to 4091 [ 212.278182][ T5283] 8021q: adding VLAN 0 to HW filter on device eth2 [ 212.292786][ T7798] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 212.328520][ T7798] NILFS (loop2): invalid segment: Checksum error in segment payload [ 212.346036][ T7798] NILFS (loop2): unable to fall back to spare super block [ 212.371398][ T7798] NILFS (loop2): error -22 while searching super root [ 212.670660][ T7612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.691300][ T7612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.746275][ T7612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 212.768561][ T7612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.789191][ T7612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.861905][ T7612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 213.026954][ T7612] hsr_slave_0: entered promiscuous mode [ 213.046899][ T7612] hsr_slave_1: entered promiscuous mode [ 213.062391][ T7612] debugfs: 'hsr0' already exists in 'hsr' [ 213.081351][ T7612] Cannot create hsr debugfs directory [ 213.579390][ T7812] loop1: detected capacity change from 0 to 4096 [ 213.744014][ T7812] ntfs3(loop1): Failed to load $Extend (-22). [ 213.771755][ T7812] ntfs3(loop1): Failed to initialize $Extend. [ 213.855053][ T31] audit: type=1800 audit(3933048945.075:93): pid=7812 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.710" name="file1" dev="loop1" ino=30 res=0 errno=0 [ 214.009292][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.024315][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.034526][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.047965][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.113967][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.129001][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.168189][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.193834][ T7812] ntfs3(loop1): ino=5, "/" mi_enum_attr [ 214.287836][ T31] audit: type=1800 audit(3933048945.505:94): pid=7836 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.717" name="use" dev="configfs" ino=14992 res=0 errno=0 [ 214.698638][ T7612] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 214.763393][ T7612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 214.796483][ T7612] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 214.849341][ T7612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 214.887920][ T7612] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 214.920771][ T7612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 214.980203][ T7612] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 215.021354][ T5908] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 215.025329][ T7612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 215.080137][ T5283] 8021q: adding VLAN 0 to HW filter on device eth3 [ 215.221333][ T5908] usb 5-1: Using ep0 maxpacket: 8 [ 215.232765][ T5908] usb 5-1: config 0 has no interfaces? [ 215.239978][ T5908] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 215.275304][ T5908] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.314617][ T5908] usb 5-1: config 0 descriptor?? [ 215.431635][ T187] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 215.480438][ T7612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.569911][ T7612] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.617493][ T187] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 215.648467][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.655698][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.668979][ T187] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 215.695344][ T187] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 215.723784][ T187] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.744774][ T10] usb 5-1: USB disconnect, device number 7 [ 215.754405][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.761613][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.807155][ T187] usb 4-1: config 0 descriptor?? [ 216.138664][ T5638] Bluetooth: hci3: command 0x0406 tx timeout [ 216.145717][ T5637] Bluetooth: hci2: command 0x0406 tx timeout [ 216.473361][ T187] usb 4-1: language id specifier not provided by device, defaulting to English [ 216.930261][ T7893] loop4: detected capacity change from 0 to 4091 [ 216.963962][ T7893] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 217.068490][ T7893] NILFS (loop4): invalid segment: Checksum error in segment payload [ 217.083987][ T187] uclogic 0003:256C:006D.000E: failed retrieving string descriptor #100: -71 [ 217.124314][ T187] uclogic 0003:256C:006D.000E: failed retrieving pen parameters: -71 [ 217.132766][ T7893] NILFS (loop4): unable to fall back to spare super block [ 217.153144][ T187] uclogic 0003:256C:006D.000E: failed probing pen v1 parameters: -71 [ 217.162947][ T7893] NILFS (loop4): error -22 while searching super root [ 217.184916][ T187] uclogic 0003:256C:006D.000E: failed probing parameters: -71 [ 217.215657][ T187] uclogic 0003:256C:006D.000E: probe with driver uclogic failed with error -71 [ 217.265973][ T187] usb 4-1: USB disconnect, device number 10 [ 217.423925][ T5283] 8021q: adding VLAN 0 to HW filter on device eth4 [ 217.786737][ T7612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 218.214557][ T7909] loop4: detected capacity change from 0 to 32768 [ 218.234359][ T7909] (syz.4.731,7909,0):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 218.250910][ T7909] (syz.4.731,7909,0):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 218.311598][ T7909] JBD2: Ignoring recovery information on journal [ 218.331334][ T29] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 218.355892][ T7916] loop3: detected capacity change from 0 to 4096 [ 218.391453][ T7909] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 218.563225][ T29] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 218.574467][ T7916] ntfs3(loop3): Failed to load $Extend (-22). [ 218.604096][ T7916] ntfs3(loop3): Failed to initialize $Extend. [ 218.611104][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.674779][ T29] usb 2-1: config 0 descriptor?? [ 218.740812][ T31] audit: type=1800 audit(3933048949.955:95): pid=7916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.730" name="file1" dev="loop3" ino=30 res=0 errno=0 [ 218.808683][ T29] cp210x 2-1:0.0: cp210x converter detected [ 218.965149][ T5632] ocfs2: Unmounting device (7,4) on (node local) [ 218.967919][ T7916] ntfs3(loop3): ino=5, "/" mi_enum_attr [ 219.039081][ T7916] ntfs3(loop3): ino=5, "/" mi_enum_attr [ 219.071936][ T7916] ntfs3(loop3): ino=5, "/" mi_enum_attr [ 219.097450][ T7916] ntfs3(loop3): ino=5, "/" mi_enum_attr [ 219.146423][ T29] cp210x 2-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 219.147314][ T7916] ntfs3(loop3): ino=5, "/" mi_enum_attr [ 219.240990][ T7916] ntfs3(loop3): ino=5, "/" mi_enum_attr [ 219.251113][ T29] usb 2-1: cp210x converter now attached to ttyUSB0 [ 219.480384][ T5968] ntfs3(loop3): ino=5, mi_enum_attr [ 219.494878][ T24] usb 2-1: USB disconnect, device number 10 [ 219.509158][ T5968] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 219.534095][ T5774] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 219.544151][ T24] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 219.608633][ T24] cp210x 2-1:0.0: device disconnected [ 219.728981][ T5774] usb 5-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 219.755444][ T7612] veth0_vlan: entered promiscuous mode [ 219.770159][ T5774] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.799620][ T5774] usb 5-1: Product: syz [ 219.812191][ T5774] usb 5-1: Manufacturer: syz [ 219.826048][ T5774] usb 5-1: SerialNumber: syz [ 219.847853][ T7612] veth1_vlan: entered promiscuous mode [ 219.960779][ T7612] veth0_macvtap: entered promiscuous mode [ 220.003227][ T7612] veth1_macvtap: entered promiscuous mode [ 220.077645][ T7612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.131964][ T7612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.238144][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.275249][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.422667][ T5968] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.478810][ T5968] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.642865][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.669210][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 220.762477][ T5974] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.782032][ T5974] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 221.071894][ T5774] usb 5-1: usb_control_msg returned -71 [ 221.111961][ T5774] usbtmc 5-1:1.0: can't read capabilities [ 221.165978][ T5774] usb 5-1: USB disconnect, device number 8 [ 223.184909][ T7990] loop4: detected capacity change from 0 to 4096 [ 223.323952][ T7990] ntfs3(loop4): Failed to load $Extend (-22). [ 223.338573][ T7990] ntfs3(loop4): Failed to initialize $Extend. [ 223.902721][ T5774] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 224.109400][ T5774] usb 7-1: Using ep0 maxpacket: 8 [ 224.151298][ T5774] usb 7-1: config 0 has no interfaces? [ 224.172959][ T5774] usb 7-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 224.260755][ T5774] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.364519][ T5774] usb 7-1: config 0 descriptor?? [ 224.710725][ T5774] usb 7-1: USB disconnect, device number 2 [ 225.585251][ T8047] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.772'. [ 225.697321][ T8053] ip6erspan0: entered allmulticast mode [ 226.612378][ T5908] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 226.805175][ T5908] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 226.806168][ T8076] loop3: detected capacity change from 0 to 4096 [ 226.866198][ T5908] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 226.905314][ T5908] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 226.945681][ T5908] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.948244][ T8076] NILFS (loop3): invalid segment: Sequence number mismatch [ 227.001331][ T8076] NILFS (loop3): trying rollback from an earlier position [ 227.002228][ T5908] usb 5-1: config 0 descriptor?? [ 227.118111][ T8076] NILFS (loop3): recovery complete [ 227.152655][ T8082] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 227.670373][ T5908] hid-led 0003:27B8:01ED.000F: probe with driver hid-led failed with error -71 [ 227.721697][ T5908] usb 5-1: USB disconnect, device number 9 [ 228.273031][ T5908] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 228.441255][ T5908] usb 1-1: Using ep0 maxpacket: 8 [ 228.456684][ T5908] usb 1-1: config 0 has no interfaces? [ 228.471252][ T5908] usb 1-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 228.502835][ T5908] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.547054][ T5908] usb 1-1: config 0 descriptor?? [ 229.018141][ T29] usb 1-1: USB disconnect, device number 6 [ 230.652110][ T29] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 230.834057][ T29] usb 4-1: Using ep0 maxpacket: 8 [ 230.868634][ T29] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 230.886235][ T8148] loop0: detected capacity change from 0 to 2048 [ 230.904788][ T29] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 230.954455][ T29] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 230.966147][ T8148] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 230.994406][ T29] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 231.022999][ T8124] loop6: detected capacity change from 0 to 32768 [ 231.025397][ T29] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 231.109294][ T29] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 231.135051][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.194043][ T8124] XFS (loop6): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 231.410075][ T29] usb 4-1: usb_control_msg returned -32 [ 231.434820][ T29] usbtmc 4-1:16.0: can't read capabilities [ 231.466069][ T8124] XFS (loop6): Ending clean mount [ 231.651741][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 232.388606][ T8167] loop4: detected capacity change from 0 to 131072 [ 232.427235][ T8167] F2FS-fs (loop4): invalid crc value [ 232.549257][ T8167] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 232.593470][ T8167] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 232.712228][ T8170] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 232.825828][ T7612] XFS (loop6): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 232.957873][ T5908] usb 4-1: USB disconnect, device number 11 [ 234.029548][ T8189] loop0: detected capacity change from 0 to 4096 [ 234.097379][ T8189] NILFS (loop0): invalid segment: Sequence number mismatch [ 234.136976][ T8189] NILFS (loop0): trying rollback from an earlier position [ 234.250781][ T8189] NILFS (loop0): recovery complete [ 234.289873][ T8199] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 234.469575][ T8203] loop1: detected capacity change from 0 to 2048 [ 234.512661][ T8203] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 234.596048][ T8203] NILFS (loop1): mounting unchecked fs [ 234.713787][ T8203] NILFS (loop1): recovery complete [ 234.735226][ T5614] udevd[5614]: incorrect nilfs2 checksum on /dev/loop1 [ 234.776009][ T8207] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 236.449893][ T8228] loop1: detected capacity change from 0 to 32768 [ 236.482122][ T8228] (syz.1.831,8228,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 236.510117][ T8228] (syz.1.831,8228,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 236.546436][ T8228] JBD2: Ignoring recovery information on journal [ 236.605129][ T8228] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 237.237610][ T5629] ocfs2: Unmounting device (7,1) on (node local) [ 237.361470][ T5609] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 237.482469][ T8255] gadgetfs: bound to dummy_udc driver [ 237.558262][ T5609] usb 5-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 237.608267][ T5609] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.040486][ T5609] qmi_wwan 5-1:1.0: cdc-wdm0: USB WDM device [ 238.332399][ T5609] wwan wwan0: port wwan0qmi0 attached [ 238.355069][ T10] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 238.428687][ T5609] qmi_wwan 5-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.4-1, WWAN/QMI device, b6:39:b3:d1:85:45 [ 238.531381][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 238.539671][ T10] usb 4-1: config 0 has no interfaces? [ 238.566602][ T10] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 238.634542][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.746200][ T10] usb 4-1: config 0 descriptor?? [ 238.901607][ T5774] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 239.074572][ T5774] usb 2-1: unable to get BOS descriptor or descriptor too short [ 239.108264][ T5774] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.150508][ T5774] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 239.192162][ T5774] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 239.247133][ T5774] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 239.263475][ T5908] usb 4-1: USB disconnect, device number 12 [ 239.269875][ T5774] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.306333][ T5774] usb 2-1: Product: syz [ 239.328062][ T5774] usb 2-1: Manufacturer: syz [ 239.344459][ T5774] usb 2-1: SerialNumber: syz [ 239.788346][ T5774] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 239.839926][ T5774] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 239.884280][ T5774] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 240.153222][ T37] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 240.189830][ T5774] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 240.216878][ T5774] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 240.237872][ T5774] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 240.307445][ T10] usb 5-1: USB disconnect, device number 10 [ 240.335451][ T10] qmi_wwan 5-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.4-1, WWAN/QMI device [ 240.394022][ T5774] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 240.562132][ T24] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 240.598599][ T8324] loop4: detected capacity change from 0 to 16 [ 240.610573][ T10] wwan wwan0: port wwan0qmi0 disconnected [ 240.694500][ T8324] erofs (device loop4): mounted with root inode @ nid 36. [ 240.738885][ T8324] syz.4.840: attempt to access beyond end of device [ 240.738885][ T8324] loop4: rw=524288, sector=8, nr_sectors = 24 limit=16 [ 240.746066][ T24] usb 4-1: config index 0 descriptor too short (expected 28277, got 36) [ 240.770093][ T8324] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 4096 [ 240.791973][ T5609] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 240.807544][ T8324] erofs (device loop4): read error -117 @ 0 of nid 89 [ 240.818094][ T31] audit: type=1800 audit(3933048972.035:96): pid=8324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.840" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 240.825383][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 240.926058][ T24] usb 4-1: config 0 has no interfaces? [ 240.939404][ T5774] usb 2-1: USB disconnect, device number 11 [ 240.961481][ T5609] usb 3-1: Using ep0 maxpacket: 8 [ 240.963277][ T24] usb 4-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 240.976448][ T5609] usb 3-1: config 0 has no interfaces? [ 240.976499][ T5609] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 240.976542][ T5609] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.049931][ T5609] usb 3-1: config 0 descriptor?? [ 241.091014][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.162606][ T24] usb 4-1: config 0 descriptor?? [ 241.643185][ T5774] usb 4-1: USB disconnect, device number 13 [ 241.728990][ T5611] udevd[5611]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 241.859284][ T10] usb 3-1: USB disconnect, device number 9 [ 242.801311][ T10] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 242.991303][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 243.045726][ T10] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 243.076991][ T10] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 243.092073][ T24] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 243.103925][ T8386] loop3: detected capacity change from 0 to 16 [ 243.126732][ T10] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 243.150700][ T8386] erofs (device loop3): mounted with root inode @ nid 36. [ 243.173717][ T10] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 243.192076][ T10] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 243.219243][ T10] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 243.245569][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.268804][ T8386] syz.3.858: attempt to access beyond end of device [ 243.268804][ T8386] loop3: rw=524288, sector=8, nr_sectors = 24 limit=16 [ 243.339750][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 243.365533][ T8386] erofs (device loop3): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 4096 [ 243.380326][ T24] usb 3-1: config 0 has no interfaces? [ 243.404985][ T24] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 243.456890][ T8386] erofs (device loop3): read error -117 @ 0 of nid 89 [ 243.459682][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.490927][ T31] audit: type=1800 audit(3933048974.705:97): pid=8386 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.858" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 243.535054][ T10] usb 2-1: usb_control_msg returned -32 [ 243.551129][ T10] usbtmc 2-1:16.0: can't read capabilities [ 243.554721][ T24] usb 3-1: config 0 descriptor?? [ 243.730881][ T8393] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 243.815124][ T8393] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 244.054002][ T8393] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 244.127445][ T8393] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 244.434814][ T8416] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 244.638242][ T187] usb 2-1: USB disconnect, device number 12 [ 244.775885][ C1] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 245.226623][ T5774] usb 3-1: USB disconnect, device number 10 [ 245.839420][ T8452] gadgetfs: bound to dummy_udc driver [ 245.959290][ T8451] loop6: detected capacity change from 0 to 4096 [ 246.030878][ T8451] NILFS (loop6): invalid segment: Sequence number mismatch [ 246.061356][ T8451] NILFS (loop6): trying rollback from an earlier position [ 246.200497][ T8460] loop1: detected capacity change from 0 to 16 [ 246.247473][ T8460] erofs (device loop1): mounted with root inode @ nid 36. [ 246.268083][ T8451] NILFS (loop6): recovery complete [ 246.323559][ T8463] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 246.345792][ T8460] syz.1.877: attempt to access beyond end of device [ 246.345792][ T8460] loop1: rw=524288, sector=8, nr_sectors = 24 limit=16 [ 246.442896][ T8460] erofs (device loop1): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 4096 [ 246.534224][ T8460] erofs (device loop1): read error -117 @ 0 of nid 89 [ 246.561256][ T31] audit: type=1800 audit(3933048977.775:98): pid=8460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.877" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 247.087030][ T8441] loop0: detected capacity change from 0 to 32768 [ 247.229704][ T8441] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 247.643221][ T8441] XFS (loop0): Ending clean mount [ 248.129042][ T5628] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 249.014707][ T8522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.889'. [ 249.046700][ T8523] netlink: 28 bytes leftover after parsing attributes in process `syz.4.888'. [ 249.423319][ T5609] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 249.591789][ T5609] usb 4-1: Using ep0 maxpacket: 8 [ 249.604637][ T5609] usb 4-1: config 0 has no interfaces? [ 249.624316][ T5609] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 249.660960][ T5609] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.708360][ T5609] usb 4-1: config 0 descriptor?? [ 249.801282][ T5774] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 249.971674][ T5774] usb 5-1: Using ep0 maxpacket: 8 [ 249.991467][ T5774] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 250.034500][ T5774] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 250.075352][ T5609] usb 4-1: USB disconnect, device number 14 [ 250.076439][ T5774] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 250.131715][ T5774] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 250.170635][ T5774] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 250.180495][ T5774] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.442391][ T5774] usb 5-1: GET_CAPABILITIES returned 0 [ 250.454946][ T5774] usbtmc 5-1:16.0: can't read capabilities [ 250.720841][ C0] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 250.755219][ T5609] usb 5-1: USB disconnect, device number 11 [ 251.662851][ T8581] loop4: detected capacity change from 0 to 4096 [ 251.706638][ T8581] NILFS (loop4): invalid segment: Sequence number mismatch [ 251.735656][ T8581] NILFS (loop4): trying rollback from an earlier position [ 251.801527][ T8581] NILFS (loop4): recovery complete [ 251.822112][ T8582] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 252.276330][ T8598] syz_tun: entered allmulticast mode [ 252.351935][ T8598] pim6reg: entered allmulticast mode [ 252.385899][ T8601] pim6reg: left allmulticast mode [ 252.431846][ T8601] syz_tun: left allmulticast mode [ 253.008595][ T185] Bluetooth: hci5: Frame reassembly failed (-84) [ 255.023865][ T5648] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 255.024259][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.030530][ T5645] Bluetooth: hci5: command 0x1003 tx timeout [ 255.036741][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.106383][ T8657] loop3: detected capacity change from 0 to 4096 [ 255.242641][ T8657] ntfs3(loop3): Failed to load $Extend (-22). [ 255.269299][ T8657] ntfs3(loop3): Failed to initialize $Extend. [ 255.722477][ T8672] Mass Storage Function, version: 2009/09/11 [ 255.746059][ T8672] LUN: removable file: (no medium) [ 256.679575][ T8680] loop0: detected capacity change from 0 to 1024 [ 256.882995][ T2008] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 257.083634][ T2008] usb 3-1: Using ep0 maxpacket: 32 [ 257.119553][ T2008] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.147245][ T2008] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 257.179360][ T2008] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 257.200298][ T2008] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.238004][ T2008] usb 3-1: config 0 descriptor?? [ 257.272473][ T2008] hub 3-1:0.0: USB hub found [ 257.487328][ T2008] hub 3-1:0.0: 1 port detected [ 258.226441][ T2008] hub 3-1:0.0: activate --> -90 [ 258.320239][ T8731] loop3: detected capacity change from 0 to 512 [ 258.386367][ T8731] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a857e02c, mo2=0102] [ 258.414081][ T8731] System zones: 1-12 [ 258.437185][ T8731] EXT4-fs error (device loop3): ext4_get_branch:178: inode #11: block 33261: comm syz.3.949: invalid block [ 258.464511][ T8731] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 258.471192][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 258.487857][ C1] EXT4-fs (loop3): initial error at time 6080532637: ext4_get_branch:178: inode 11: block 33261 [ 258.498393][ C1] EXT4-fs (loop3): last error at time 6080532637: ext4_get_branch:178: inode 11: block 33261 [ 258.539923][ T8731] EXT4-fs (loop3): Remounting filesystem read-only [ 258.559741][ T8731] EXT4-fs (loop3): 1 truncate cleaned up [ 258.579934][ T8731] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 258.628049][ T5774] usb 3-1: USB disconnect, device number 11 [ 258.790848][ T5630] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 258.863590][ T2008] usb 3-1-port1: config error [ 259.355113][ T5972] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.569067][ T5972] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.790464][ T8752] netlink: 'syz.1.958': attribute type 14 has an invalid length. [ 259.812135][ T8752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.958'. [ 259.840729][ T5972] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.890436][ T8760] usbip-vudc usbip-vudc.0: gadget not bound [ 259.925275][ T8752] netlink: 'syz.1.958': attribute type 14 has an invalid length. [ 259.948446][ T8752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.958'. [ 260.135615][ T5972] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.239442][ T8768] loop2: detected capacity change from 0 to 64 [ 260.350818][ T5648] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 260.368129][ T5648] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 260.379365][ T5648] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 260.386121][ T31] audit: type=1800 audit(6080532639.594:99): pid=8768 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.964" name="file1" dev="loop2" ino=21 res=0 errno=0 [ 260.418209][ T5648] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 260.427734][ T8773] netlink: 24 bytes leftover after parsing attributes in process `syz.1.965'. [ 260.443332][ T5648] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 261.000707][ T8778] loop1: detected capacity change from 0 to 512 [ 261.086160][ T8778] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a857e02c, mo2=0102] [ 261.094342][ T8778] System zones: 1-12 [ 261.110823][ T8778] EXT4-fs error (device loop1): ext4_free_branches:1020: inode #11: comm syz.1.966: invalid indirect mapped block 8 (level 2) [ 261.126540][ T8778] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 261.132007][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 261.147608][ C0] EXT4-fs (loop1): initial error at time 6080532640: ext4_free_branches:1020: inode 11 [ 261.157342][ C0] EXT4-fs (loop1): last error at time 6080532640: ext4_free_branches:1020: inode 11 [ 261.173411][ T8778] EXT4-fs (loop1): Remounting filesystem read-only [ 261.181317][ T8778] EXT4-fs (loop1): 1 truncate cleaned up [ 261.189169][ T8778] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 261.195739][ T5972] bridge_slave_1: left allmulticast mode [ 261.303666][ T5972] bridge_slave_1: left promiscuous mode [ 261.342263][ T5972] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.423529][ T5972] bridge_slave_0: left allmulticast mode [ 261.462712][ T5629] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.466158][ T5972] bridge_slave_0: left promiscuous mode [ 261.532761][ T5972] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.795863][ T8794] loop6: detected capacity change from 0 to 128 [ 261.924362][ T8794] minix filesystem being mounted at /35/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 262.108115][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.108115][ T49] loop2: rw=1, sector=1995, nr_sectors = 8 limit=64 [ 262.160703][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.160703][ T49] loop2: rw=1, sector=2011, nr_sectors = 8 limit=64 [ 262.210559][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.210559][ T49] loop2: rw=1, sector=2675, nr_sectors = 88 limit=64 [ 262.254700][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.254700][ T49] loop2: rw=1, sector=2775, nr_sectors = 16 limit=64 [ 262.292972][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.292972][ T49] loop2: rw=1, sector=2807, nr_sectors = 8 limit=64 [ 262.329142][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.329142][ T49] loop2: rw=1, sector=2827, nr_sectors = 8 limit=64 [ 262.387857][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.387857][ T49] loop2: rw=1, sector=2843, nr_sectors = 24 limit=64 [ 262.417076][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.417076][ T49] loop2: rw=1, sector=2875, nr_sectors = 24 limit=64 [ 262.463673][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.463673][ T49] loop2: rw=1, sector=2919, nr_sectors = 16 limit=64 [ 262.499369][ T49] kworker/u8:3: attempt to access beyond end of device [ 262.499369][ T49] loop2: rw=1, sector=2943, nr_sectors = 8 limit=64 [ 262.527770][ T49] buffer_io_error: 286 callbacks suppressed [ 262.527796][ T49] Buffer I/O error on dev loop2, logical block 3343, lost async page write [ 262.538071][ T5648] Bluetooth: hci2: command tx timeout [ 262.545153][ T49] Buffer I/O error on dev loop2, logical block 3344, lost async page write [ 262.580265][ T49] Buffer I/O error on dev loop2, logical block 3345, lost async page write [ 262.600344][ T49] Buffer I/O error on dev loop2, logical block 3346, lost async page write [ 262.637491][ T49] Buffer I/O error on dev loop2, logical block 3367, lost async page write [ 262.646205][ T49] Buffer I/O error on dev loop2, logical block 3368, lost async page write [ 262.656684][ T49] Buffer I/O error on dev loop2, logical block 3369, lost async page write [ 262.665390][ T49] Buffer I/O error on dev loop2, logical block 3370, lost async page write [ 262.679209][ T49] Buffer I/O error on dev loop2, logical block 3455, lost async page write [ 262.691377][ T49] Buffer I/O error on dev loop2, logical block 3456, lost async page write [ 262.949297][ T5972] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 262.977576][ T5972] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 263.011569][ T5972] bond0 (unregistering): Released all slaves [ 263.142963][ T5283] 8021q: adding VLAN 0 to HW filter on device eth5 [ 263.659600][ T8823] LUN: removable file: (no medium) [ 263.956082][ T5972] hsr_slave_0: left promiscuous mode [ 263.984819][ T5972] hsr_slave_1: left promiscuous mode [ 263.998845][ T5972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 264.017450][ T5972] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 264.043112][ T5972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 264.050537][ T5972] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 264.108011][ T5972] veth1_macvtap: left promiscuous mode [ 264.134530][ T5972] veth0_macvtap: left promiscuous mode [ 264.161075][ T5972] veth1_vlan: left promiscuous mode [ 264.171109][ T5972] veth0_vlan: left promiscuous mode [ 264.597555][ T5645] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 264.612839][ T5645] Bluetooth: hci2: command tx timeout [ 264.630470][ T5645] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 264.648701][ T5645] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 264.666219][ T5645] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 264.677858][ T5645] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 265.029720][ T8834] udc dummy_udc.0: failed to start g1: -4 [ 265.071223][ T8834] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -4 [ 265.164323][ T8834] UDC core: g1: couldn't find an available UDC or it's busy [ 265.234451][ T8856] loop2: detected capacity change from 0 to 160 [ 265.355621][ T8856] ISOFS: Logical zone size(1024) < hardware blocksize(2048) [ 265.416328][ T5972] team0 (unregistering): Port device team_slave_1 removed [ 265.482500][ T5972] team0 (unregistering): Port device team_slave_0 removed [ 265.640909][ T5283] 8021q: adding VLAN 0 to HW filter on device eth6 [ 266.074529][ T8868] loop6: detected capacity change from 0 to 1024 [ 266.201678][ T8870] loop2: detected capacity change from 0 to 4096 [ 266.222953][ T8868] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 266.285065][ T8870] NILFS (loop2): invalid segment: Sequence number mismatch [ 266.320251][ T8870] NILFS (loop2): trying rollback from an earlier position [ 266.330645][ T8873] netlink: 24 bytes leftover after parsing attributes in process `syz.0.994'. [ 266.390909][ T8868] EXT4-fs error (device loop6): ext4_read_inline_dir:1493: inode #12: block 7: comm syz.6.986: path /38/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=40, inode=14, rec_len=8, size=80 fake=0 [ 266.434396][ T8870] NILFS (loop2): recovery complete [ 266.463956][ T8882] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 266.692007][ T5648] Bluetooth: hci2: command tx timeout [ 266.771689][ T5648] Bluetooth: hci1: command tx timeout [ 266.798857][ T7612] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 267.038581][ T5972] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 267.073134][ T5972] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.462482][ T5972] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 267.487500][ T5972] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.840686][ T5972] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 267.872772][ T5972] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.904798][ T8904] loop6: detected capacity change from 0 to 1024 [ 267.980598][ T5283] 8021q: adding VLAN 0 to HW filter on device eth7 [ 268.140908][ T8764] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.192470][ T8764] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.223027][ T8764] bridge_slave_0: entered allmulticast mode [ 268.250866][ T8764] bridge_slave_0: entered promiscuous mode [ 268.312431][ T8764] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.329327][ T8764] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.348077][ T8764] bridge_slave_1: entered allmulticast mode [ 268.386350][ T8764] bridge_slave_1: entered promiscuous mode [ 268.595510][ T5972] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 268.619435][ T5972] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 268.771416][ T5648] Bluetooth: hci2: command tx timeout [ 268.812074][ T8764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.853319][ T5648] Bluetooth: hci1: command tx timeout [ 268.891751][ T8764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 268.989254][ T8926] loop0: detected capacity change from 0 to 512 [ 269.019813][ T8926] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 269.076469][ T8926] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 269.148565][ T8926] EXT4-fs error (device loop0): ext4_orphan_get:1425: comm syz.0.996: bad orphan inode 131083 [ 269.171450][ T8926] loop0: lost filesystem error report for type 5 error -117 [ 269.178363][ T8926] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 269.234386][ T8764] team0: Port device team_slave_0 added [ 269.385559][ T8764] team0: Port device team_slave_1 added [ 269.586853][ T5628] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 270.007957][ T8764] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 270.054278][ T8764] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 270.145568][ T8764] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 270.227305][ T8764] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 270.259337][ T8764] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 270.339390][ T8764] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 270.535194][ T5283] 8021q: adding VLAN 0 to HW filter on device eth8 [ 270.810440][ T5972] bridge_slave_1: left allmulticast mode [ 270.819889][ T5972] bridge_slave_1: left promiscuous mode [ 270.827732][ T5972] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.889169][ T5972] bridge_slave_0: left allmulticast mode [ 270.914838][ T5972] bridge_slave_0: left promiscuous mode [ 270.931620][ T5648] Bluetooth: hci1: command tx timeout [ 270.942383][ T5972] bridge0: port 1(bridge_slave_0) entered disabled state [ 271.131084][ T8979] ================================================================== [ 271.139191][ T8979] BUG: KASAN: slab-use-after-free in pn_bind+0x550/0x5b0 [ 271.146253][ T8979] Write of size 8 at addr ffff88803497c800 by task syz.6.1008/8979 [ 271.154208][ T8979] [ 271.156552][ T8979] CPU: 0 UID: 0 PID: 8979 Comm: syz.6.1008 Tainted: G L syzkaller #0 PREEMPT(full) [ 271.156610][ T8979] Tainted: [L]=SOFTLOCKUP [ 271.156624][ T8979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 271.156648][ T8979] Call Trace: [ 271.156660][ T8979] [ 271.156674][ T8979] dump_stack_lvl+0x100/0x190 [ 271.156721][ T8979] print_report+0x13d/0x4b0 [ 271.156779][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.156827][ T8979] ? __virt_addr_valid+0x239/0x430 [ 271.156877][ T8979] ? pn_bind+0x550/0x5b0 [ 271.156925][ T8979] kasan_report+0xdf/0x1c0 [ 271.156968][ T8979] ? pn_bind+0x550/0x5b0 [ 271.157015][ T8979] pn_bind+0x550/0x5b0 [ 271.157056][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.157106][ T8979] ? __pfx_pn_bind+0x10/0x10 [ 271.157148][ T8979] usb_add_function+0x219/0x890 [ 271.157207][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.157257][ T8979] configfs_composite_bind+0xd83/0x1960 [ 271.157327][ T8979] gadget_bind_driver+0x28c/0xbf0 [ 271.157369][ T8979] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 271.157430][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.157478][ T8979] ? __pfx_gadget_bind_driver+0x10/0x10 [ 271.157521][ T8979] really_probe+0x241/0xa60 [ 271.157578][ T8979] __driver_probe_device+0x20e/0x450 [ 271.157636][ T8979] driver_probe_device+0x4a/0x140 [ 271.157691][ T8979] __driver_attach+0x21f/0x5b0 [ 271.157745][ T8979] ? __pfx___driver_attach+0x10/0x10 [ 271.157800][ T8979] bus_for_each_dev+0x13e/0x1d0 [ 271.157842][ T8979] ? __pfx_bus_for_each_dev+0x10/0x10 [ 271.157883][ T8979] ? bus_add_driver+0x2b5/0x5b0 [ 271.157936][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.157990][ T8979] bus_add_driver+0x305/0x5b0 [ 271.158040][ T8979] driver_register+0x1e2/0x360 [ 271.158098][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.158149][ T8979] usb_gadget_register_driver_owner+0x132/0x210 [ 271.158196][ T8979] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 271.158254][ T8979] configfs_write_iter+0x302/0x4e0 [ 271.158319][ T8979] vfs_write+0x6ac/0x1050 [ 271.158369][ T8979] ? __pfx_configfs_write_iter+0x10/0x10 [ 271.158432][ T8979] ? __pfx_vfs_write+0x10/0x10 [ 271.158498][ T8979] ksys_write+0x12a/0x250 [ 271.158546][ T8979] ? __pfx_ksys_write+0x10/0x10 [ 271.158598][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 271.158650][ T8979] do_syscall_64+0x115/0x870 [ 271.158707][ T8979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.158747][ T8979] RIP: 0033:0x7f4af359e019 [ 271.158776][ T8979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.158815][ T8979] RSP: 002b:00007f4af449d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 271.158851][ T8979] RAX: ffffffffffffffda RBX: 00007f4af3825fa0 RCX: 00007f4af359e019 [ 271.158878][ T8979] RDX: 000000000000000b RSI: 00002000000003c0 RDI: 0000000000000003 [ 271.158903][ T8979] RBP: 00007f4af363500c R08: 0000000000000000 R09: 0000000000000000 [ 271.158934][ T8979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 271.158958][ T8979] R13: 00007f4af3826038 R14: 00007f4af3825fa0 R15: 00007ffec50b6008 [ 271.158999][ T8979] [ 271.159012][ T8979] [ 271.170801][ T8984] loop2: detected capacity change from 0 to 1024 [ 271.174160][ T8979] Allocated by task 7252: [ 271.174181][ T8979] kasan_save_stack+0x30/0x50 [ 271.174244][ T8979] kasan_save_track+0x14/0x30 [ 271.174300][ T8979] __kasan_kmalloc+0xaa/0xb0 [ 271.174355][ T8979] __kvmalloc_node_noprof+0x34f/0x970 [ 271.174414][ T8979] alloc_netdev_mqs+0xd7/0x15c0 [ 271.174464][ T8979] gphonet_setup_default+0x37/0x80 [ 271.509489][ T8979] phonet_alloc_inst+0x83/0x130 [ 271.514362][ T8979] try_get_usb_function_instance+0x136/0x1f0 [ 271.520630][ T8979] usb_get_function_instance+0x16/0x70 [ 271.526098][ T8979] function_make+0x18c/0x3f0 [ 271.530711][ T8979] configfs_mkdir+0x51e/0xb70 [ 271.535397][ T8979] vfs_mkdir+0x361/0x850 [ 271.539648][ T8979] filename_mkdirat+0x48b/0x5e0 [ 271.544521][ T8979] __x64_sys_mkdirat+0x89/0xc0 [ 271.549310][ T8979] do_syscall_64+0x115/0x870 [ 271.553928][ T8979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.560001][ T8979] [ 271.562487][ T8979] Freed by task 8834: [ 271.566458][ T8979] kasan_save_stack+0x30/0x50 [ 271.571165][ T8979] kasan_save_track+0x14/0x30 [ 271.575871][ T8979] kasan_save_free_info+0x3b/0x70 [ 271.580942][ T8979] __kasan_slab_free+0x5f/0x80 [ 271.585718][ T8979] kfree+0x22b/0x6c0 [ 271.589633][ T8979] free_netdev+0x6a0/0x8c0 [ 271.594072][ T8979] pn_bind+0x3a7/0x5b0 [ 271.598152][ T8979] usb_add_function+0x219/0x890 [ 271.603034][ T8979] configfs_composite_bind+0xd83/0x1960 [ 271.608613][ T8979] gadget_bind_driver+0x28c/0xbf0 [ 271.613652][ T8979] really_probe+0x241/0xa60 [ 271.618182][ T8979] __driver_probe_device+0x20e/0x450 [ 271.623494][ T8979] driver_probe_device+0x4a/0x140 [ 271.628548][ T8979] __driver_attach+0x21f/0x5b0 [ 271.633336][ T8979] bus_for_each_dev+0x13e/0x1d0 [ 271.638201][ T8979] bus_add_driver+0x305/0x5b0 [ 271.642922][ T8979] driver_register+0x1e2/0x360 [ 271.647714][ T8979] usb_gadget_register_driver_owner+0x132/0x210 [ 271.653968][ T8979] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 271.659621][ T8979] configfs_write_iter+0x302/0x4e0 [ 271.664844][ T8979] vfs_write+0x6ac/0x1050 [ 271.669291][ T8979] ksys_write+0x12a/0x250 [ 271.673640][ T8979] do_syscall_64+0x115/0x870 [ 271.678249][ T8979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.684150][ T8979] [ 271.686463][ T8979] The buggy address belongs to the object at ffff88803497c000 [ 271.686463][ T8979] which belongs to the cache kmalloc-cg-4k of size 4096 [ 271.700812][ T8979] The buggy address is located 2048 bytes inside of [ 271.700812][ T8979] freed 4096-byte region [ffff88803497c000, ffff88803497d000) [ 271.714798][ T8979] [ 271.717114][ T8979] The buggy address belongs to the physical page: [ 271.723545][ T8979] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803497a000 pfn:0x34978 [ 271.733640][ T8979] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 271.742142][ T8979] memcg:ffff888035c79401 [ 271.746373][ T8979] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 271.754916][ T8979] page_type: f5(slab) [ 271.758905][ T8979] raw: 00fff00000000240 ffff88813fe2b500 ffffea00014a4210 ffffea000149ca10 [ 271.767504][ T8979] raw: ffff88803497a000 0000000800040002 00000000f5000000 ffff888035c79401 [ 271.776099][ T8979] head: 00fff00000000240 ffff88813fe2b500 ffffea00014a4210 ffffea000149ca10 [ 271.784781][ T8979] head: ffff88803497a000 0000000800040002 00000000f5000000 ffff888035c79401 [ 271.793459][ T8979] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 271.802139][ T8979] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 271.810803][ T8979] page dumped because: kasan: bad access detected [ 271.817209][ T8979] page_owner tracks the page as allocated [ 271.822917][ T8979] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5633, tgid 5633 (syz-executor), ts 98963027252, free_ts 59025545859 [ 271.844309][ T8979] post_alloc_hook+0xfd/0x120 [ 271.849015][ T8979] get_page_from_freelist+0xf48/0x3530 [ 271.854499][ T8979] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 271.860419][ T8979] new_slab+0xa2/0x640 [ 271.864505][ T8979] refill_objects+0xe3/0x410 [ 271.869117][ T8979] __pcs_replace_empty_main+0x376/0x680 [ 271.874682][ T8979] __kmalloc_cache_noprof+0x479/0x6c0 [ 271.880075][ T8979] ipv6_add_dev+0x670/0x1520 [ 271.884689][ T8979] addrconf_notify+0x5db/0x1ba0 [ 271.889655][ T8979] notifier_call_chain+0x99/0x3f0 [ 271.894706][ T8979] call_netdevice_notifiers_info+0xbe/0x110 [ 271.900632][ T8979] register_netdevice+0x1998/0x25a0 [ 271.905856][ T8979] veth_newlink+0x44a/0xa00 [ 271.910385][ T8979] rtnl_newlink+0x1499/0x2380 [ 271.915083][ T8979] rtnetlink_rcv_msg+0x95e/0xe90 [ 271.920044][ T8979] netlink_rcv_skb+0x159/0x420 [ 271.924819][ T8979] page last free pid 5283 tgid 5283 stack trace: [ 271.931150][ T8979] __free_frozen_pages+0x79f/0x1090 [ 271.936367][ T8979] qlist_free_all+0x47/0xf0 [ 271.940894][ T8979] kasan_quarantine_reduce+0x1a0/0x1f0 [ 271.946382][ T8979] __kasan_slab_alloc+0x69/0x90 [ 271.951238][ T8979] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 271.957162][ T8979] __alloc_skb+0x140/0x710 [ 271.961595][ T8979] alloc_skb_with_frags+0xdd/0x760 [ 271.966738][ T8979] sock_alloc_send_pskb+0x801/0x980 [ 271.972043][ T8979] unix_dgram_sendmsg+0x3c7/0x1810 [ 271.977180][ T8979] unix_seqpacket_sendmsg+0x12a/0x1d0 [ 271.982569][ T8979] sock_write_iter+0x53a/0x5b0 [ 271.987337][ T8979] do_iter_readv_writev+0x6f7/0x930 [ 271.992553][ T8979] vfs_writev+0x360/0xdd0 [ 271.996894][ T8979] do_writev+0x28a/0x340 [ 272.001163][ T8979] do_syscall_64+0x115/0x870 [ 272.005780][ T8979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.011690][ T8979] [ 272.014007][ T8979] Memory state around the buggy address: [ 272.019658][ T8979] ffff88803497c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 272.027771][ T8979] ffff88803497c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.035839][ T8979] >ffff88803497c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.043898][ T8979] ^ [ 272.047966][ T8979] ffff88803497c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.056030][ T8979] ffff88803497c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.064085][ T8979] ================================================================== [ 272.104916][ T8979] Kernel panic - not syncing: kasan.fault=panic_on_write set ... [ 272.112689][ T8979] CPU: 1 UID: 0 PID: 8979 Comm: syz.6.1008 Tainted: G L syzkaller #0 PREEMPT(full) [ 272.123570][ T8979] Tainted: [L]=SOFTLOCKUP [ 272.127897][ T8979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 272.138058][ T8979] Call Trace: [ 272.141341][ T8979] [ 272.144278][ T8979] dump_stack_lvl+0x100/0x190 [ 272.148981][ T8979] vpanic+0x552/0x970 [ 272.152975][ T8979] ? __pfx_vpanic+0x10/0x10 [ 272.157499][ T8979] ? __pfx___schedule+0x10/0x10 [ 272.162377][ T8979] ? pn_bind+0x550/0x5b0 [ 272.166638][ T8979] panic+0xd1/0xe0 [ 272.170370][ T8979] ? __pfx_panic+0x10/0x10 [ 272.174798][ T8979] ? preempt_schedule_common+0x42/0xc0 [ 272.180278][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.185943][ T8979] ? preempt_schedule_thunk+0x16/0x40 [ 272.191360][ T8979] end_report.part.0+0x68/0x90 [ 272.196162][ T8979] kasan_report.cold+0xe/0x18 [ 272.200869][ T8979] ? pn_bind+0x550/0x5b0 [ 272.205172][ T8979] pn_bind+0x550/0x5b0 [ 272.209260][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.214914][ T8979] ? __pfx_pn_bind+0x10/0x10 [ 272.219534][ T8979] usb_add_function+0x219/0x890 [ 272.224418][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.230074][ T8979] configfs_composite_bind+0xd83/0x1960 [ 272.235665][ T8979] gadget_bind_driver+0x28c/0xbf0 [ 272.240702][ T8979] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 272.246367][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.252026][ T8979] ? __pfx_gadget_bind_driver+0x10/0x10 [ 272.257586][ T8979] really_probe+0x241/0xa60 [ 272.262119][ T8979] __driver_probe_device+0x20e/0x450 [ 272.267433][ T8979] driver_probe_device+0x4a/0x140 [ 272.272486][ T8979] __driver_attach+0x21f/0x5b0 [ 272.277273][ T8979] ? __pfx___driver_attach+0x10/0x10 [ 272.282581][ T8979] bus_for_each_dev+0x13e/0x1d0 [ 272.287458][ T8979] ? __pfx_bus_for_each_dev+0x10/0x10 [ 272.292844][ T8979] ? bus_add_driver+0x2b5/0x5b0 [ 272.297711][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.303369][ T8979] bus_add_driver+0x305/0x5b0 [ 272.308085][ T8979] driver_register+0x1e2/0x360 [ 272.312879][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.318535][ T8979] usb_gadget_register_driver_owner+0x132/0x210 [ 272.324793][ T8979] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 272.330463][ T8979] configfs_write_iter+0x302/0x4e0 [ 272.335611][ T8979] vfs_write+0x6ac/0x1050 [ 272.339963][ T8979] ? __pfx_configfs_write_iter+0x10/0x10 [ 272.345630][ T8979] ? __pfx_vfs_write+0x10/0x10 [ 272.350473][ T8979] ksys_write+0x12a/0x250 [ 272.354823][ T8979] ? __pfx_ksys_write+0x10/0x10 [ 272.359697][ T8979] ? srso_alias_return_thunk+0x5/0xfbef5 [ 272.365351][ T8979] do_syscall_64+0x115/0x870 [ 272.369971][ T8979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.375876][ T8979] RIP: 0033:0x7f4af359e019 [ 272.380324][ T8979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.399947][ T8979] RSP: 002b:00007f4af449d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 272.408378][ T8979] RAX: ffffffffffffffda RBX: 00007f4af3825fa0 RCX: 00007f4af359e019 [ 272.416369][ T8979] RDX: 000000000000000b RSI: 00002000000003c0 RDI: 0000000000000003 [ 272.424351][ T8979] RBP: 00007f4af363500c R08: 0000000000000000 R09: 0000000000000000 [ 272.432331][ T8979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 272.440307][ T8979] R13: 00007f4af3826038 R14: 00007f4af3825fa0 R15: 00007ffec50b6008 [ 272.448327][ T8979] [ 272.451562][ T8979] Kernel Offset: disabled [ 272.455893][ T8979] Rebooting in 86400 seconds..