last executing test programs: 13m14.458442744s ago: executing program 0 (id=415): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000800", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x22080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000021c0), 0x2, 0x0) statx(0xffffffffffffff9c, 0x0, 0x800, 0x40, 0x0) write$FUSE_INIT(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x50ef, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x88b02, 0x0) write$P9_RSTATu(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="300200007d00000005bf0000000000edffffff000000000000000000000000000000000000000000000000000000000000001b00301d6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e11400cfc26dd7c500f04cd85f2a70f5e9930e3c5db45a5500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8e289da649a37002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6", @ANYRES32=0x0, @ANYRES32=0x0], 0x230) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) close_range(r3, 0xffffffffffffffff, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x5, 0x7fffffff}]}) times(0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2) 13m14.356841956s ago: executing program 0 (id=409): socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x1) unlinkat(r3, &(0x7f0000000700)='./file0\x00', 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000300)={{0xeeef0000, 0xdddd1000, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x8, 0x9, 0x10}, {0x6000, 0xd000, 0xc, 0x8, 0x0, 0x0, 0x0, 0xb2, 0x8, 0x7, 0x0, 0xff}, {0x3000, 0x0, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0xe2, 0x0, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x4}, {0xdddd0000, 0x10000, 0x9, 0x0, 0xff, 0x4, 0x6, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0x0, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x8000000, 0x0, 0x6, 0x1, 0x1, 0x83, 0xa, 0x26, 0x5}, {0x4000}, {0xdddd1000, 0xff}, 0xddf8ffdb, 0x0, 0x0, 0x70, 0xfffffffffffffffe, 0xd801, 0x0, [0x4, 0x0, 0x1]}) close(0x4) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 13m1.948187339s ago: executing program 0 (id=432): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2, &(0x7f0000000b40)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@orlov}, {@noload}, {@user_xattr}, {@mblk_io_submit}, {@noinit_itable}, {@noblock_validity}, {@nogrpid}, {@init_itable_val={'init_itable', 0x3d, 0xfff}}]}, 0xfa, 0x477, &(0x7f0000001380)="$eJzs3M9vFFUcAPDvTH/w21bEHyBIFY3EHy0tP+TgRaMJB01M9IDxVNtCKgs1tCZCiFYPeDQk3o3/hfGkF6NeNPGqd0NCDBdQL2tmZwaWZbfd0m0X2M8nme57M6/73ndm3u6bebsbQM8ayf4kEVsj4o+IGMqztxYYyR+uX70w9c/VC1NJVKtv/53Uyl27emGqLFr+35Y8U60W+Q1N6r34XsRkpTJztsiPLZz+cGz+3PkXZ09Pnpw5OXNm4ujRQwf3DB6ZONyROLO4ru36ZG73zmPvXnpz6vil939O0sjjjoY4OmUk37tNPdPpyrpsW1066a/fsvfXm+lmZwLd1BcR2eEaqPX/oeiLTTe2DcXrn3e1ccCaqlar1SVelRerwH0siW63AOiO8o0+u/4tl3UaetwVrrySXwBlcV8vlnxLf6R5Yu9Aw/Xt1g7WPxIRxxf//TpbYo3uQwAA1Ps+G/+80Gz8l8YjeWIw+/NAMYcyHBEPRsT2iHgoInZExMMRtbKPRsRjK6y/cYbk9vFPevmOg2tDNv57uZjbunX8l5ZFhvuK3LZa/APJidnKzIFin+yPgQ0nZpOZ8SXq+OG1379sta1+/JctWf3lWLBox+X+hht005MLk6uJud6VzyJ29TeLP4lyGieJiJ0RsesO65h9rr/ltuXjX0Lrp21b9ZuIZ/PjvxgN8ZeSlvOT4y8dmTg8tjEqMwfGyrPidr/8dvGtVvWvKv4OyI7/5qbn/434h5ONEfPnzp+qzdfOr+jps64TF//8ouU1TRF/1r3aOf+PbSvO/8HkndqKwWLDx5MLC2fHIwaTN25fP3Hz2cp8WT6Lf/++5v1/e9zcE49HxO6I2BMRT2QXhUXbn4yIpyJi3xI74adXn/5gmfibHP/1mSvN4p9e7vhH/fFfeaLv1I/fLR//xohodfwP1VL7izXtvP6128DV7DsAAAC4V+SfgU/S0RvpNB0dzT/DvyM2p5W5+YXnT8x9dGY6n/cejoG0vNM1VHc/dLy4N1zmJxryB4v7xl/1barlR6fmKtPdDh563JYW/T/zV1+3WwesuQ7MowH3KP0fepf+D70p0f+hp+n/0Lua9f9PW5Ye/XZNGwOsK+//0Lva6P+L+UPrUQFwb/L+D71L/4ee1PK78emqvvK/7on/it8zvFvac/8nIr0rmnH/J/rb/jGLFSSqQ3n/z9ZsaFqm269MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnfF/AAAA//8Qi+Nc") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) creat(&(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x9) syz_mount_image$exfat(0x0, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x22c9337721601c52, 0x0, 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$udf(&(0x7f0000000280), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="73686f72746164000000006d653d3030303030303030303030303030303030b030342c6e6f6164696e6963622c7569643d00", @ANYRES8=0x0, @ANYRESHEX], 0x2, 0xa1b, &(0x7f0000001f80)="$eJzs209sm+d9B/Dfw1eyaadrFbd1kzbLWLQIPKUN5P9KvAH2rApt5iZGZWXzZTBlyQ4R/askF043tB42oAjQg1FgPWzAkMsOA3bwDrvsFOwwDBg2GDsMxYp2Wrpm6Y3BBuS0aXhfPpQoWY7VOLZk+/Mx7C/58veSzx+afMmHbwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEb/1lVNDB9N2twIAuJ9eGvvG0GHv/wDwSDnn8z8AAAAAAAAAAAAAAOx0KYr4s0jx6k/a6UJ1vaN+pjV75er4yOjmu+1JkaIWRVVf/q0fPHT4yNFjx4e7+cH7f9SejJfHzp1qnJ6bmV+YWlycmmyMz7Yuzk1Obfke7nb/jQarAWjMvHZl8tKlxcah5w6vu/nqwDu7H9s/cOL4i+f3dWvHR0ZHx3pq+vo/9KPf4nZneOyKIn4WKerfezc1I6IWdz8Wd3ju3Gt7qk4MVp0YHxmtOjLdas4ulTemWq6qRQz07HSyO0b3YS7uSiPiWtn8ssGDZffG5psLzYnpqcbZ5sJSa6k1N5tqndaW/RmIWgyniPmIaBe33l1/FPHvkeL777fTREQU3XF4tjox+M7tqd2DPm5BX9m3IuJmPABztoPtjiLeiBQ/OD8UF/O4VsP2TMTXy3w64ptlLkdcz9dT+QR5KuK9TZ5PPFj6ooh/ihRzqZ0mu3Nfva6ceaXxtdlLcz213deVB/794X7a4a9N9ShionrFb6cPf7ADAAAAAMDOU8TfRoobMwfSfPSuKbZmLzfONSemO98Kd7/7b+S9VlZWVgZSJxs5h3KezHk254Wc8zmv5bye882cN3K+lfNmzuWc7ZxRy4+fs5FzKOfJnGdzXsg5n/Nazus538x5I+dbOW/mXM7ZzhnWvQAAAAAAAADYYfZEET+OFF/4m29V5xVHdV76J04MH/jqF3vPGf/MHe6nrH0uIm7E1s7J7c+nDqda+eej7xdbU48ivpPP//vD7W4MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwrWpRxGcixQ/faKdIEdGIuBCdXC62u3UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAh1FPRZyOFL/4Sr26fjMiPhsR/7dS/omI5ZUNtrvFAAAAAAAAAMAtUhFDkeLxJ9tpICKuDryz+7H9AyeOv3h+XxFFpLKkt/7lsXOnGqfnZuYXphYXpyYb47Oti3OTU1t9uPqZ1uyVq+Mjo/ekM3e05x63f0/99Nz86wuty68ubXr73vqpicWlhebFzW+OPVGLGOrdMlg1eHxktGr0dKs5W+2aardpYC2isdXOAAAAAAAAAPDQ2JuKOBopXm0dSd11477Omv+vdK4Vq7V/8QdrvwWY3pBdvb8f2MrltNWGDlYL743xkdHRsZ7Nff23lpZtSqmIv44Un/vdJ6r18BR7N10bL+t2RYpj3zqS6wY+V9adXFdVHxwfGW28NDf75VPT03MXm0vNiempxth88+KWfzgAAAAAAAAAAPfQ3lTEn0eK3xu6mbrnnef1/77OtZ71/9+oltAr9bQ+V1Vr+x+v1vY7lz9xYrgx+mu3234v1v/LNqVUxL9Fisd//4nqfPru+v/Qhtqy7r8jxb/+41O5rrarrDvY7U7nHi+1pqeGUh6rzz/brY2q9niu/eRa7cGy9vOR4i+fWV87nGs/tVZ7qKz940jxv0c3r/30Wu3hsvaPIsVvv93o1u4ta8/k2v1rtc9dnJuevNOwlvP/d5Hi7C++mrp9vu389/z+49qGXHXLnH/w5Y9q/gd6tl3L8/rjPP8H7zD/fx8p/uSnT+W6ztgfyrc/Xv27Nv+/Eyn+61fX1x7LtfvWag9utVvbrZz/L0WKEz/60Wqf8/znkV2bod75/2zf+lx9lmzT/D/es20gt+vwLzkWj6LF17/9WnN6emrBBRdccGH1wna/MnE/lO///xwpXjhTS93jmPz+/7HOtbXjv/e/s/b+/8KGXLVN7//7era9kI9a+vsi6ksz8/37I+qLr3/7y62Z5uWpy1Ozw8eOHnl++Nix5/t3dY/t1i5teegeCuX8n4kUr/z0X1Y/x6w//tv8+H/vhly1TfP/yd4+rTuu2fJQPJLK+b8eKb779rurnzc/6Pi/+/n/wBfW5+r/v22a/0/1bKt+4//xiOd7th34dMSprT4WAAAAPGT25nXyP/31f1g953395//4Yre29/uf29kJ5/8DAAAAAMCjbm8q4q8ixf8MfSl1zyHbyu8/Jzfkqm36/d/+nm2T9+m8li0PMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADADpSiiKcjxas/aaflorzeUT/Tmr1ydXxkdPPd9qRIUYuiqi//1g8eOnzk6LHjw9384P0/ak/Gy2PnTjVOz83ML0wtLk5NNsZnWxfnJqe2fA93u/9Gg9UANGZeuzJ56dJi49Bzh9fdfHXgnd2P7R84cfzF8/u6teMjo6NjPTV9/R/60W+RbrN9VxRxKVLUv/du+o8iohZ3PxZ3eO7ca3uqTgxWnRgfGa06Mt1qzi6VN6ZarqpFDPTsdLI7RvdhLu5KI+Ja2fyywYNl98bmmwvNiempxtnmwlJrqTU3m2qd1pb9GYhaDKeI+YhoF7feXX8UMREpvv9+O71dRBTdcXj2pbFvDB2+c3tq96CPvVa+u+nmvrJvRcTNeADmbAfbHUV8LFL84PxQ/KzojGs1bM9EfL3MpyO+WeZyxPV8PZVPkKci3tvk+cSDpS+KOBsp5lI7/WeR5756XTnzSuNrs5fmemq7rysP/PvD/bTDX5vqUcTPq1f8dvq5/88AAAAAAA+RIn4zUtyYOZCq9cHVNcXW7OXGuebEdOdr/e53/42818rKyspA6mQj51DOkznP5ryQcz7ntZzXc76Z80bOt3LezLmcs50zavnxczZyDuU8mfNszgs553Ney3k955s5b+R8K+fNnMs52znD9+QAAAAAAADADlSLIp6IFD98o51Wis4C74Xo5LJ1zofe/wcAAP//Vsw/Lg==") r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x101442, 0x11f) pwrite64(r5, &(0x7f0000000140)='2', 0xfdef, 0xe7c) syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) getdents64(r6, &(0x7f0000000940)=""/229, 0xe5) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400)=0x0) timer_gettime(r7, &(0x7f0000000080)) creat(&(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(&(0x7f0000000140)='./file0\x00', &(0x7f0000001900)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 12m59.248269345s ago: executing program 0 (id=437): socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000500)={@broadcast, @loopback, 0x0}, &(0x7f0000000580)=0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x4, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback=0x27, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2, 0xfffffffe}, 0x8}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x48) mbind(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, &(0x7f0000000040)=0x6, 0x8, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) r7 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r7, 0x400442c8, &(0x7f0000000100)={r6, 0x5, 0x8, "70cd59df64f6170f1f08094635a659b05e7b1ef5f834a39b"}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000480)={&(0x7f0000525000/0x2000)=nil, &(0x7f000090c000/0x2000)=nil, &(0x7f000024b000/0x3000)=nil, &(0x7f0000a65000/0x1000)=nil, &(0x7f0000613000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000597000/0x3000)=nil, &(0x7f000055e000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000af6000/0x1000)=nil, &(0x7f00000003c0)="454f7ad99936d043784ef5357a8f1fd87bc485ac40d5c8dbb627d8660920ad1b2d524246463b362ccb539749caa77aed667f0320497bdd3cb98cc5e9a497032e0b0e5e97a02ba24b04bab2615c5811b06cfcc827fe74b11ed6e58669289101534bf18ba9bcc4dc047fb9967eb4cceafb2c7b315ae34ccdb37d451b5fe5483e3ac84a352bc596ad34b969407a2792a5a9857430ebf33db77ff6abd6e3", 0x9c, r1}, 0x68) mlock(&(0x7f0000a33000/0x4000)=nil, 0x4000) r8 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9}) 12m56.603170059s ago: executing program 0 (id=440): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@delchain={0x4c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff4, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) rseq(&(0x7f0000000080), 0x20, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r4, &(0x7f0000000300)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket(0x1e, 0x1, 0x0) sendmmsg$sock(r8, &(0x7f0000000100)=[{{&(0x7f0000000000)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x1}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{&(0x7f0000000180)=@pppol2tpv3={0x1e, 0x4, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, 0x0}}], 0x2, 0x4048040) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$packet(r7, &(0x7f0000000000)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @link_local}, 0x14) r11 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x86100) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r11, 0x4c0a, &(0x7f00000005c0)={r12, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) r13 = syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x40240) ioctl$LOOP_CONFIGURE(r13, 0x4c0a, &(0x7f0000001280)={r11, 0x0, {0x2a12, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe, 0x14, "fee8a2ab78fc179fd1f809000000aca7ca64c6a4b4e00d9683dda1af01000000deff1200100000000000000000000000000800", "2809e8dbe1b22d0000b420a1a93c7540f476779e0117613dd4070000ebff08000000000000000000020000000800000000faffffff00", "e7460000102000000000e4440000002000000000000000000000008bd02800", [0xe0]}}) ioctl$LOOP_CHANGE_FD(r11, 0x4c06, r13) preadv(r6, &(0x7f0000000000)=[{&(0x7f0000000480)=""/187, 0xbb}], 0x1, 0x25, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) 12m48.36808473s ago: executing program 0 (id=453): openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x220001, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0xffffffffffffffbd, &(0x7f0000000040)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r1, &(0x7f0000000280)={&(0x7f0000000000)=@in={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, &(0x7f0000000100)=[{&(0x7f00000024c0)="e0", 0x1}], 0x1, 0x0, 0x30, 0x4}, 0x20000040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x101080, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r5 = fanotify_init(0x200, 0x0) fanotify_mark(r5, 0x1, 0x4800003e, 0xffffffffffffffff, 0x0) unlink(0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x37}, 0x80, &(0x7f0000000580)}, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="500100001a000100000000000200000002001c1f0000c808ffffffea0800060007", @ANYRES32=r6, @ANYRESHEX=r1], 0x150}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4040080) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) 12m48.060468007s ago: executing program 32 (id=453): openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x220001, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0xffffffffffffffbd, &(0x7f0000000040)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r1, &(0x7f0000000280)={&(0x7f0000000000)=@in={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, &(0x7f0000000100)=[{&(0x7f00000024c0)="e0", 0x1}], 0x1, 0x0, 0x30, 0x4}, 0x20000040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x101080, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r5 = fanotify_init(0x200, 0x0) fanotify_mark(r5, 0x1, 0x4800003e, 0xffffffffffffffff, 0x0) unlink(0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x37}, 0x80, &(0x7f0000000580)}, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="500100001a000100000000000200000002001c1f0000c808ffffffea0800060007", @ANYRES32=r6, @ANYRESHEX=r1], 0x150}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4040080) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) 10m0.428160372s ago: executing program 4 (id=1272): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r0, 0x0, 0x0}, 0x20) syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000040)='./file0\x00', 0x10000, &(0x7f0000002380)=ANY=[@ANYBLOB='nodots,showexec,dots,uid=', @ANYRESHEX=0xee00, @ANYBLOB=',check=normal,fmask=00000000000000000000002,sys_immutable,nodots,dots,nodots,nodots,nodots,fmask=00000000000000000177777,dots,quiet,nodots,nodots,check=relaxed,nodots,umask=00000000000000000076645,nodots,nodots,nfs=stale_rw,nodots,smackfsfloor=fmask,defcontext=unconfined_u,permit_directio,permit_directio,fscontext=staff_u,seclabel,euid>', @ANYRESDEC, @ANYRES64=0x0], 0x1, 0x1f5, &(0x7f0000000600)="$eJzs3cFqE1EUANCbmCYTcdGdIAgjLnRV1C+oSAUxIFSy0J2gK7NqN6mb9jP8Bf/LD5CuspEncSadmKYxBDKj7Tmb3pn7Xt+7M2SSTW5SFL7f/RpZ1or2fuzHpBW70Y6ZswAArpNJSvEjFZreCwBQjzXe/3/WvCUAYMvevnv/+vlgcHCY51nE+dl4OB4Wf4v8y1eDgyf5b7vVrPPxeHjrIv80X/zsMM3vxO0y/6yYn1+kuxEx7Mbjh0V+mnvxZpD/Ob8XH7dcOwAAAAAAAAAAAAAAAAAAAAAANOV+5DNL+/vs7S3m+2W+OJrrD7TQv6cT9zrlYdUeKJ3WURQAAAAAAAAAAAAAAAAAAAD8Z45Pvnz+MBp9OqqCXkTMn+ksGXN10Cr/8VqDmw/asdn0flnmBou2yku03QL7y2/uOkF0/pW7s2mQ17BWf+XlTWkaLH8VzNpiXDm9GxGrV390uOnmJyml0bcHR8cnkVYOrp4RvVqfSAAAAAAAAAAAAAAAAAAAcHPNfev7kqyJDQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAA6rf/58Gl8+sDE4j4k78dfBsrZ3IGq0VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6+tXAAAA//85ziI4") r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xae) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r1, 0x40047211, &(0x7f0000000100)) 10m0.272033546s ago: executing program 4 (id=1273): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x6, 0x2, 0x4, 0x1, 0x10, 0x8, 0x0, 0x9, 0x0, 0x8}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={r1, 0x5}, &(0x7f0000000140)=0x8) 10m0.144108139s ago: executing program 4 (id=1274): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r0, &(0x7f0000000d00)='0', 0x1) 10m0.024196873s ago: executing program 4 (id=1276): syz_mount_image$f2fs(&(0x7f0000000040), &(0x7f0000000680)='./bus\x00', 0x800000, &(0x7f0000000340)=ANY=[@ANYBLOB="6e6f757365725f78617474722c666c7573685f6d657267652c6673796e635f6d6f64653d706f7369782c64697361626c655f6578745f6964656e746966792c6261636b67726f756e645f67633d73796e632c6673796e635f6d6f64653d7374726963742c6e6f626172726965722c6e6f696e6c696e655f646174612c6e6f626172726965722c71756f74612c6261636b67726f756e645f67633d6f66662c6e6f61636c2c6e6f657874656e745f63616368652c6e6f646973636172642c6163746976655f6c6f67733d342c00e62bc03000c35169ed09803fa1bee488c680f339e530b5e8ad120a2b4f078093a8e0ba2b3d1b5fe99356b80a454c1ec2f8e12392bbffe9fae2fa05e18a6b61f5eded2e484f574d2757a5fe762c770477aa3460313ee54451c6a6159eca600d6c85a8c09cef9996dc851a5f5edf1a4a22576c6dfe6b9e8dade2d3a8e6a8c7710733c1f69aabd8880291"], 0x1, 0x5516, &(0x7f00000006c0)="$eJzs3M1rI2UYAPB32u1+uxbx4G0HFqGFTWj6seit6i5+YJey6sGTpsk0ZDfJlCZNa08ePIoH/xNR8OTRv8GDZ2/iQfEmKJl3qls/QGma2O3vB5Nn5p03zzxvKIVnJiQA59Z8+vOPSbgRroQQZkMI10Mo9pNyK6zH8Fx5buaxLSnHfx+4GEK4GkK4MUoecyblqU9vD2+t/fDGT199c+nCtc++/HZ6qwam7fkQQncn7u93Y8xbMT4sx+vDdhG7q8MyxhPdR+VxHuN+tlVk2K8fzasXcaUV5+c7e/1R3O7UG6PYam8X4zu9eMH+sHWUp3jDw/pucdzMtorY7udFbB3Gug4O4/+2w/4g5mmW+T4o0ofB4CjG8ewgi+vZeVTERm9Qjse8eTM7GMVhGcvLhUbeaRZ1bJ3kk/5/e7Pd2ztIh9luv5330rVq7YVq7U6ltps3s0G2Wql3m3dW04VWZzStMsjq3fVWnrc6WbWRdxfThVajUanV0oW72Va73ktrtepKdamytlju3U5fvf9O2mmmC6P4cru3N2h3+ul2vpvGdyymy9WVFxfTW7X0rY3NdPPBvXsbm2+/d/fd+y9tvP5KOekvZaULy0vLy5XaUmW5tniO1v9RWfQY1w8nkky7AICz57/2/zf1/8AYnF7/v/sghNPv/4P+fyzOVP973vv/U1g/nIj+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg3Ppu7vPXip35eHytHH+qHHqmPE5CCDMhhF//xmy4eCznbJln7h/mz/2phq+TUGQYXeNSuV0NIayX2y9Pn/anAAAAAE+uLz68+Uns1uPL/LQLYpLiTZuZ6++PKV8SQpib/35M2WZGL8+OKVnx930hHIwpW3ED6/KYksVbbhfGle1fmT0WLj8WkhhmJloOAAAwEcc7gcl2IQAAAEzSx9MugOlIwtGjzKNnwcU37/94IHjl2BEAAABwBiXTLgAAAAA4dUX/7/f/AAAA4MkWf/8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH5j525yEojhOIB2BkbwKxLj3qu4g2N4BJcuDQfwEhwBr+AFPAPuPIIBQzsQETQmdJho3kuG0mHyS0tg0X+TAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABNeq2mo6eH68d9c+aLXynjw72w9UGOuQAAAAC7zarpKL4ZpP5pff+8vnVZ94sQwnLxvmtR3wlHG5mdOqf65vnqyxieQ4gJRSwNpOskhHBTX+8XTX8LAAAA8H+9jCfDtFpPL4O2B8QhpaJNeXabKa8IIVSDt0xp5TLvKlNY/H13w32mtFjA6mcKSyW3bq60bTui4999XbXrf2qK1JQ/R2abOwAAcECdjabBVQgAAAAtu2t7ALSjCKutzPVWYC819fbe8UYPAAAA+IOKtgcAAAAANC6u/9s8/29VgHD+HwAAADQnnf8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAk2bVdFSNJ8N9c+aL/eSZDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8sD/vKBACYRAGe9d3JnP/w0qDpqYmVSB8/I3BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCb3/3l/8TUOJPMvTaWnkeStVNj69TYOzeO/jC+fg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDF/rycAAjEYBiMbz0p23+vyo9agwgzIH4k5LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAn5z7/e+er/o3hsRRVWOmiSnjVlVzVoklq8Sag8SWg/bpkwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC527uc1jioOAPh3f8zGVsUYJYeIKHjQi023tbU38aAED/4JQki3NXbrjzYHW4qQizfJuRfRo4igxFv/h55b6KXeesihghcvlbczk7zGoFtKZ5bm84E377vTx3vfNwsl35lJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMjvv78W9dJgv42517tb9a2upv72vT25s3VlKLcWd6txcU4nPvlfzD53F9hIBAADg8OjV9X1E3C22V1LfnZ/U/0U9JtX8PzxfxnU9v7/ur/u69k/t99/uvby70Hy5Tpr03Pp4dPzfqfSf3C5n2wv/O6I/ufKTey+9yRfS/WjzpZ1icj073928+cFgErrJAgAz61jdV0H981Dqh20mBsCh0c8K77r+7823mxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAE3Y249k67kTEUn8vTm7fv7Z2UH9j685S3U5fv76Vz5mmKCLi3Pp4dLzBvcy6y1euXlgdj0eXmg9ei4i2Vn+v2v6FT6YYHNHK9RH8ZzA39eBu9WW3n/PjB0W1lye/Vkv/IQEA8NQqqpbq+rvF9ko611mIePDjw/X/m1kcU9b/9z49fStfK6//h43tcPYtb1z8cvnylatvr19cPT86P/r8nRPDd4cnz5w6dWZ5cq9k2R0TAAAAHs+gann9P9g3Jv3b0SyOKev/r74ffpPP01P/H2jvoV/bmQAAABxuL77+15+dA853BoP4enVj49KwPO5+PlEeW0j1kc1VLa//ewttZwUAAAA0YWez89D7/2ezOKZ8/v/cT6/8ks/Zi4gj1fP/Y2tfjM82t52Z1sSvLre9RwAAANp1pGr58/9iIdX/3d1XHroR8dYbZVz9GcCp6v/eh9/+nK+Vv/9/srktzqTuYnk9Jv1iRH+x7YwAAAB4Wv39IOKZKFsq9v8otlc++/XoxwPv/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA07Z8AAAD//ylXMzw=") syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) setuid(0xee00) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, 0x0) 9m59.164838694s ago: executing program 4 (id=1281): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\'\x00\x00\x00\a'], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='2', 0x1, 0x4fed0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 9m58.124803899s ago: executing program 4 (id=1285): syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000040, &(0x7f0000000880), 0x1, 0x5a3, &(0x7f00000002c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, &(0x7f00000000c0)={0x17c04, 0xffffffffffffffff, 0x8, 0xfff, 0x1000000007}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x0) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 9m57.762016448s ago: executing program 33 (id=1285): syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000040, &(0x7f0000000880), 0x1, 0x5a3, &(0x7f00000002c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, &(0x7f00000000c0)={0x17c04, 0xffffffffffffffff, 0x8, 0xfff, 0x1000000007}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x0) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 8m38.391980332s ago: executing program 5 (id=1861): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000005a0000008500000022000000180100002020702500000000002020200100000000000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) timer_gettime(0x0, 0x0) syz_emit_ethernet(0xaa, &(0x7f0000000800)=ANY=[], 0x0) futex(0x0, 0x5, 0xfffffffd, 0x0, 0x0, 0x9a020006) 8m38.287351885s ago: executing program 5 (id=1862): socket(0x1d, 0x2, 0x2) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x8bf7b16aee579f38) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xa10852, &(0x7f00000006c0)=ANY=[@ANYBLOB='dmask=00000000000000000002621,utf8,umask=00000000000000000200000,namecase=1,discard,errors=remount-ro,umask=00000000000000000200004,umask=00000000000000000003377,namecase=1,utf8,iocharset=iso8859-4,iocharset=cp874,dmask=01777777777777777777770,errors=remount-ro,uid=', @ANYRES32, @ANYBLOB="d9b2de1a2f7d06000000000000f0955139afd5c85d409cd57977db7b7c40ade28a33a6a4636ff400fb97e6caf4db25c1ccd8fee922c9ca87d19e19bed2941af9fc3561a936e805795a9965b5eb669fb143b894f24dbf2cd930f396d0a6d2451810d29d7c5e9dbda0be77473bb0431e71cfa02a873d927ec49990e8ac2bb9469d53e0420e67beaa46cb9850de015b11ed84f357d67ae57d156d5a089f321ec719835c6eeb76ad4a79ca0a80f230d9110b57272d24eb8d5effb24faddf3ffcb309d9000000000000000000ce8d0113cc8e073fc339e82352bcdc64195fe94d66d7", @ANYRESDEC=0x0, @ANYRES8, @ANYRESDEC=0x0, @ANYRES8, @ANYRESOCT, @ANYRES8, @ANYRES8, @ANYRES16=0x0, @ANYRES64, @ANYRES32], 0xff, 0x1508, &(0x7f0000000a00)="$eJzs3AvYTdX2MPAx5pyLl6Sd5D7HHIudXkySJJckuSRJcuRIbglJkiRJ5X5LckvIPck9JLeQ3O+33JMkSZKE5JbM79Hf+XRO53yd8/+f/+P5zjt+z7Oed4691phrrD3286619n72/q7dgEp1KpevxczwP4L/9aczAKQAQG8AuA4AIgAonqV4lkvrM2js/D/bifj3enjK1a5AXE3S/7RN+p+2Sf/TNul/2ib9T9uk/2mb9D9tk/4LkZZtmZrzelnS7iLv/6dlcv7/D3Ko8Kiv1hW+sf2/kCL9T9uk/2mb9D9tk/6nbdL/tE36n7ZJ/9M26b8Qadl//71j+ezgP2G52q8/IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBpw9lwhQGAv4yvdl1CCCGEEEIIIYT49wnpr3YFQgghhBBCCCGE+N+HoECDgQjSQXpIgQyQEa6BTHAtZIbrIAHXQxa4AbLCjZANskMOyAm5IDfkAQsEDhhiyAv5IAk3QX64GVKhABSEQuChMBSBW6Ao3ArF4DYoDrdDCbgDSkIpKA1l4E4oC3dBObgbysM9UAEqQiWoDPdCFbgPqsL9UA0egOrwINSAh6Am/AlqwcNQG/4MdeARqAuPQj2oDw2gITT6b+W/BC/DK9AROkFn6AJdoRt0hx7QE3pBb3gV+kDK5eemPwyAgTAI3oDB8CYMgaEwDN6C4TACRsIoGA1jYCy8DePgHRgP78IEmAiTYDJMgakwDd6D6TADZsL7MAs+gNkwB+bCPJgPH8ICWAiL4CNYDB/DElgKy2A5rICVsApWwxpYC+tgPWyAjbAJNsMW+AS2wjbYDjtgJ+yC3fAp7IHPYC98Dvvgi38x/8zf5LdHQECFCg0aTIfpMAVTMCNmxEyYCTNjZkxgArNgFsyKWTEbZrs5B+bAXJgL82AeJCQAZMyLeTGJScyP+TEVU7EgFkSPHotgESyKt2IxLIbFsTiWwBJYEkthKSyDZbAslsVyWA7LY3msgBWwElbCe/FevA+rYlWshtWwOlbHGlgDD+WuibWwFtbG2lgH62BdrIv1sB42wAbYCBthY2yMTbAJNsNm2BybYwtsgS2xJbbCVtgaW2MbbINtsS22w3bYHl/EF/ElfAlfwVewE1ZQXbArdsXu2B17Yi/sha9iH3wNX8PXsR/2xwE4EAfiGzgYT+MQHIrDcBiWVSNwJI5CVmNwLI7FcTgOx+N4nIATcSJOxik4FafhNJyOM3AGvo+z8AP8AOfgHJyH83E+LsCFAy+/wnAJLsVluBxX4EpcgatxDa7Gdbge1+FG3IibcTN+gp/gNtyGO3AH7kIDgJ/iZ/gZ9sN9uA/34348gAfwIB7EQ3gID+NhPIJH8CgexWN4DI/jCTyJJ/AUnsLTeAbP4lk8j+fxAj6f65vauwqs7QfqEqOMSqfSqRSVojKqjCqTyqQyq8wqoRIqi8qisqqsKpvKpnKoHCqXyqXyqHOKFClWscqr8qqkSqr8Kr9KVamqoCqovPKqiCqiiqqiqpgqpoqr21UJdYcqqUqppr6MKqPKqma+nLpblVflVQVVUVVSlVVlVUVVUVVVVVVNVVPVVXVVQz2kaqou2BMfVpc6U0f1x7pqANZT9VUD1VC9gY+pxmowNlFNVTP1hBqKQ7CFauxbqqdVKzUSW6tn1Sh8TrVVY7CdekG1Vy+qDipSL6smvqPqpCZgF9VVTcbuqofqqXqp6VhRXepYJfW66qf6qwFqoJqHb6jB6k01RA1Vw9RbargaoUaqUWq0GqPGqrfVOPWOGq/eVRPURDVJTVZT1FQ1Tb2npqsZaqZ6X81SH6jZao6aq+ap+epDtUAtVIvUR2qx+lgtUUvVMrVcrVAr1Sq1Wq1Ra9U6tV5tUBvVJrVZbVGfqK1qm9qudqidapfarT5Ve9Rnaq/6XO1TX6j96kt1QH2lDqqv1SH1jTqsvlVH1HfqqPpeHVM/qOPqhDqpflSn1E/qtDqjzqpz6rz6WV1Qv6iLKijQqJXW2uhIp9PpdYrOoDPqa3Qmfa3OrK/TCX29zqJv0Fn1jTqbzq5z6Jw6l86t82irSTvNOtZ5dT6d1Dfp/PpmnaoL6IK6kPa6sC6ib9FF9a26mL5NF9e36xL6Dl1Sl9KldRl9py6r79Ll9N26vL5HV9AVdSVdWd+rq+j7dFV9v66mH9DV9YO6hn5I19R/0rX0w7q2/rOuox/RdfWjup6urxvohrqRfkw31o/rJrqpbqaf0M31k7qFfkq31E/rVvoZ3Vo/q9vo53Rb/bxup1/Q7fWLuoP+RV/UQXfUnXRn3UV31d10d91D99S9dG/9qu6jX9N99eu6n+6vB+iBepB+Qw/Wb+oheqgept/Sw/UIPVKP0qP1GD1Wv63H6Xf0eP2unqAn6kl6sp6ip+qel2ea+U/kv/N38vv+uvfNeov+RG/V2/R2vUPv1Lv0br1b79F79F69V+/T+/R+vV8f0Af0QX1QH9KH9GF9WB/RR/RRfVQf08f0cX1Cn9M/6lP6J31an9Fn9Dl9Xp/XFy4/B2DQKKONMZFJZ9KbFJPBZDTXmEzmWpPZXGcS5nqTxdxgspobTTaT3eQwOU0uk9vkMdaQcYZNbPKafCZpbsLLJ01T0BQy3hQ2Rcwt/0q+yW9uNqmmwF/l/1F9jUwj09g0Nk1ME9PMNDPNTXPTwrS49VIdrUwr09q0Nm1MG9PWtDXtTDvT3rQ3HUwH87J52XQ0HU1n09l0Nd1Md9PD9DS9TG/zqulj+pi+pq/pZ/qZAWaAGWQGmcFmsBlihphhZpgZboabkWakGW1Gm7FmrBlnxpnxZryZYCaYSWaSmWKmmGlmmpluppuZZqaZZWaZ2Wa2mWvmmvlmvllgFphFZpFZbBabJWapWWqWm+VmpVlpVpvVZq1Za9ab9Waj2WiWpN9itpitZqvZbrabnWan2W12mz1mj9lr9pp9Zp/Zb/abA+aAOWgOmkPmkDlsDpsj5og5ao6aY+aYOW6Om5PmpDllTpnT5rQ5a86a8+a8uWAumIvm4qXLvkhFKjKRidJF6aKUKCXKGGWMMkWZosxR5igRJaIsUZYoa3RjlC3KHuWIcka5otxRnshGFLmIozjKG+WLktFNUf7o5ig1KhAVjApFPiocFYluiYpGt0bFotui4tHtUYnojqhkVCoqHZWJ7ozKRndF5aK7o/LRPVGFqGJUKaoc3RtVie6Lqkb3R9WiB6Lq0YNRjeihqGb0p6hW9HBUO/pzVCd6JKobPRrVi+pHDaKGUaN/6/whnM7+uO9oO9nOtovtarvZ7raH7Wl72d72VdvHvmb72tdtP9vfDrAD7SD7hh1s37RD7FA7zL5lh9sRdqQdZUfbMXasfduOs+/Y8fZdO8FOtJPsZDvFTrXT7Ht2up1hZ9r37Sz7gZ1t59i5dp6dbz+0C+xCu8h+ZBfbj+0Su9Qus8vtCrvSrrKr7Rq71q6z6+0Gu9FuspvtFvuJ3Wq32e12h91pd9nd9lO7x35m99rP7T77hd1vv7QH7Ff2oP3aHrLf2MP2W3vEfmeP2u/tMfuDPW5P2JP2R3vK/mRP2zP2rD1nz9uf7QX7i71ow6WL+0undzJkKB2loxRKoYyUkTJRJspMmSlBCcpCWSgrZaVslI1yUA7KRbkoD+WhS5iY8lJeSlKS8lN+SqVUKkgFyZOnIlSEilJRKkbFqDgVpxJUgkpSSSpNpelOupPuorvobrqb7qF7qCJVpMpUmapQFapKVakaVaPqVJ1qUA2qSTWpFtWi2lSb6lAdqkt1qR7VowbUgBpRI2pMjakJNaFm1IyaU3NqQS2oJbWkVtSKWlNrakNtqC21pXbUjtpTe+pAHehlepk6UkfqTJ2pK3Wl7tSdelJP6k29qQ/1ob7Ul/pRPxpAA2gQDaLBNJiG0FAaRm/RcBpBI2kUjaYxNJbG0jgaR+NpPE2gCTSJJtEUmkLTaBpNp+k0k2bSLJpFs2k2zaW5NJ/m0wJaQItoES2mxbSEltAyWkYraAWtolW0htbQOlpHG2gDbaJNtIW20FbaSttpO+2knbSbdtMe2kN7aS/to320n/bTATpAB+kgHaJDdJgO0xE6QkfpKB2jY3ScjtNJOkmn6BSdptN0ls7SefqZLtAvdJECpbgMLqO7xmVy17rM7jr3t3EOl9PlcrldHmddNpf9r2JyzqW6Aq6gK+S8K+yKuFtc6qUL3t/EJV0pV9qVcXe6su4uV+53cRV3n6vq7nfV3AOusrv3r+Lq7kFXwz3iarpHXS1X39V2DV0d94ir6x519Vx918A1dM3dk66Fe8q1dE+7Vu6Z38UL3EK3xq1169x6t8d95s66c+6I+86ddz+7jq6T6+1edX3ca66ve931c/1/Fw9zb7nhboQb6Ua50W7M7+JJbrKb4qa6ae49N93N+F08333oZrlFbrab4+a6eb/Gl2pa5D5yi93Hbolb6pa55W6FW+lWudX/t9blbqPb5Da73e5Tt9Vtc9vdDrfT7fo1vnQce93nbp/7wh1237oD7it30B11h9w3v8aXju+o+94dcz+44+6EO+l+dKfcT+60O/Pr8V869h/dL+6iCw4YWbFmwxGn4/Scwhk4I1/DmfhazszXcYKv5yx8A2flGzkbZ+ccnJNzcW7Ow5aJHTPHnJfzcZJv4vx8M6dyAS7IhdhzYS7Ct3BRvpWL8W1cnG/nEnwHl+RSXJrL8J1clu/icnw3l+d7uAJX5Epcme/lKnwfV+X7uRo/wNX5Qa7BD3FN/hPX4oe5Nv+Z6/AjXJcf5XpcnxtwQ27Ej3FjfpybcFNuxk9wc36SW/BT3JKf5lb8DLfmZ7kNP8dt+Xluxy9we36RO/BL/DK/wh25E3fmLtyVu3F37sE9uRf35le5D7/Gffl17sf9eQAP5EH8Bg/mN3kID+Vh/BYP5xE8kkfxaB7DY/ltHsfv8Hh+lyfwRJ7Ek3kKT+Vp/B5P5xk8k9/nWfwBz+Y5PJfn8Xz+kBfwQl7EH/Fi/piX8FJexst5Ba/kVbya1/BaXsfreQNv5E28mbfwJ7yVt/F23sE7eRfv5k95D3/Ge/lz3sdf8H7+kg/wV3yQv+ZD/A0f5m/5CH/HR/l7PsY/8HE+wSf5Rz7FP/FpPsNn+Ryf55/5Av/CFzkwxBirWMcmjuJ0cfo4Jc4QZ4yviTPF18aZ4+viRHx9nCW+Ic4a3xhni7PHOeKcca44d5wntjHFLuY4jvPG+eJkfFOcP745To0LxAXjQrGPC8dF4lviovGtcbH4trh4fHtcIr4jLhmXih95oEx8Z1w2visuF98dl4/viSvEFeNKceX43rhKfF9cNb4/rhY/EBeLH4xrxA/FcPn7KrXjP8d14kfiuvGjcb24ftwgbhg3ih+LG8ePx03ipnGz+Im4efxk3CJ+Km4ZPx23ip/5w/Wd4y5x17hb3C0O4X49NzkvOT/5YXJBcmFyUfKj5OLkx8klyaXJZcnlyRXJlclVydXJNcm1yXXJ9ckNyY3JTcnNyRAqpwePXnntjY98Op/ep/gMPqO/xmfy1/rM/jqf8Nf7LP4Gn9Xf6LP57D6Hz+lz+dw+j7eevPPsY5/X5/NJf5PP72/2qb6AL+gLee8L+yK+oW/kG/nG/nHfxDf1zfwT/gn/pH/SP+Wf8k/7Vv4Z39o/69v453xb/7x/3r/g2/sXfQf/kn/Zv+I7+k6+s+/su/quvrvv7nv6nr637+37+D6+r+/r+/l+foAf4Af5QX6wH+yH+CF+mB/mh/vhfqQf6Uf70X6sH+vH+XF+vB/vJ/gJfpKf5Kf4KX6an+an++l+pp/pZ6XO8rP9bD/Xz/Xz/Xy/wC/wi/wiv9gv9kv8Er/ML/Mr/Aq/yq/ya/wav86v8xv8Br/Jb/Jb/Ba/1W/12/12v9Pv9Lv9br/H7/F7/V6/z+/z+/1+f8Af8Af91/6Q/8Yf9t/6I/47f9R/74/5H/xxf8Kf9D/6U/4nf9qf8Wf9OX/e/+wv+F/8RR/82MTbiXGJdxLjE+8mJiQmJiYlJiemJKYmpiXeS0xPzEjMTLyfmJX4IDE7MScxNzEvMT/xYWJBYmFiUeKjxOLEx4kliaWJZYnliRWJlYkQcm+NQ96QLyTDTSF/uDmkhgKhYCgUfCgcioRbQtFwaygWbgvFw+2hRLgjlAylQunwaKgX6ocGoWFoFB4LjcPjoUloGpqFJ0Lz8GRoEZ4KLcPToVV4JrQOz4Y24bnQNjwf2oUXQvu/3HGFV0LH0Cl0Dl1C19AtdA89Qs/QK/QOr4Y+4bXQN7we+oX+YUAYGAaFN8Lg8GYYEoaGYeGtMDyMCCPDqDA6jAljw9thXHgnjA/vhglhYpgUJocpYWqYFt4L08OMMDO8H2aFD8LsMCfMDfPC/PBhWBAWhkXho7A4fByWhKVhWVgeVoSVYVVYHdaEtWFdWB82hI1hU9gctoRPwtawLWwPO8LOsCvsDp+GPeGzsDd8HvaFL8L+8GU4EL4KB8PX4VD4JhwO34Yj4btwNHwfjoUfwvFwIpwMP4ZT4adwOpwJZ8O5cD78HC6EX8JF+c6aEEIIIcQ/pdsfrO/ydx4zAKAuj7sCwLXbch767XoNABuy/de4h8rVPAEAT3dq9/BflgoVOnfufHnbJRqifHMAIPE3O7gcL4Vm8CS0hKZQ9O/W10O9eJ7/YP7k7QAZf5OTAlfiK/N/+Q/mf+yJYQtKxGez/D/mnwOQmu9KTga4Ei+FZl+8AgBNodg/mD974z+oP8NXYwGa/CYnE1yJr9RfBB6HZ6DlX235Nx645h+vE0IIIYQQQgjxH62HKt3mj+6fL92f5zJXctLDlfiP7s+FEEIIIYQQQghx9T33YoenHmvZsmmbf36Q/l/ZWAYykMH/j4Or/Z9JCCGEEEII8e925aL/ymMZrmZBQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFEGvSbH/3KAAD/Kz8ndrWPUQghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhLja/k8AAAD//3BjMQc=") r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000180)=0x401, 0x4) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r0, &(0x7f0000000080), 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 8m37.991905502s ago: executing program 5 (id=1864): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) mount(0x0, &(0x7f0000002100)='.\x00', &(0x7f00000020c0)='devpts\x00', 0x22048de, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r4, &(0x7f0000000100)='.\x00', 0x9000, &(0x7f0000001dc0)={0x0, 0x8a, 0x20000}, 0x20) 8m37.65852974s ago: executing program 5 (id=1867): syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000180)='./file2\x00', 0x14018, &(0x7f0000000340)=ANY=[@ANYBLOB="706172743d3078303030303030303030303030303030392c747970653dd710211b2c706172743d3078303030303030303030303030313030312c7569643d", @ANYRESHEX=0x0, @ANYBLOB="2c6465636f6d706f736500000000000000033d1eeb39072c6769643d", @ANYRESHEX=0x0, @ANYBLOB=',gid=', @ANYRESHEX=0x0, @ANYBLOB="2c747970653df606a15d2c7569643d", @ANYRESHEX=0x0, @ANYBLOB="2c63726561746f723daf2afe272c756d61736b3d30303030303030303030303030303030303030303030362c61707072616973652c657569643c", @ANYRESDEC=0x0, @ANYBLOB=',obj_type=}}@@[/-,\x00'], 0xdf, 0x6c8, &(0x7f0000000d40)="$eJzs3ctvHHcdAPDvzK7tXSMlTpu0BVXCakRBWCR+yAVziUEI+VChCg6cV4nTWNm4le2CGyEw72sP/QPKwTdOSNyDyhkuCI4Wp0qIXDj5tmgeu157d+11nHht+Hyi2fnN/N7fnZndWSuaAP5vrcxE9UkksTLz9na2vbe70NzbXZgos5sRkaXTiGqximQ9Ivk0YjmKJT6f7SzLJ4P6+Xht6ft//8/eZ8VWtVzy8mlvvZ+1IuJLw89ip1xiOiIq5brXWO+u2snt3R3YXmGiK91//kknJwvYzXbgYNRaPXZOU33g+Q5cHknxudljKmKy/JjMP+fKq0N6vqN7/k51lQMAAIARW/n3jfnTlK+X66v7sR/bl/42HgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM5V+fz/pFzSdno6kvbz/8fLfVGmL7Unox4AAAAAAAAAAPQY69kz0U7c6V/ji/uxH9txpb3dSvK/+b+Rb1zPXz8XH8RmrMZG3IrtaMRWbMVGzEXEVFdD49uNra2NuSFqzvetOX94XJXhJlwbrhgAAAAAAAAA/M/7Rawc/P0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAugiSiUqzy5Xo7PRVpNSJqETGelduJ+Gs7fUkk/XY+Of9xAAAAwJnUnqHO1f3Yj+240t5uJfk9/yv5/XItPoj12Iq12IpmrMa98h46u+tP93YXmnu7C4+y5cxDz1uM4reH/j2/lpeox/1Yy/fcirv5YO5FmtfM/DMiHrXH1Duunz/N2r5T+PGQI7tXrrPOPmr/ijBx5gk/B1MR1TTGOhGZzcdWHATXuqPQG4lvPR3U6HKxqh7tKbp7mou088vP9aKHLHlizO8MObPJcp3N5zeDfrl53moHne4MLNSJRBp5JOa7jr5Xjo95xJf/+PuPHjTXHz64vzlzLlN6kY4eEwtdkXh1iEj88MJGonp8dnp0x2y+80ZneyW+Gz+ImZiOd2Ij1uJH0YitWI2knGmjPJ6z16njI7V8aOudk0Y+Xr4vlXKgJ49pOr6TpxrxRl73SqxFEu/FvViNt/J/8zEXX4/FWIylrnf4xsBx53PLz/r0dGf9za+UiXpE/LZcj1pxUcjieq0rrt3X3Kk8r3vPQZReOv7d7b02njzl6hfKRNbHL/sdjiNzNBJzXZF4+fhI/K6VvW421x9uPGi83+fTtZWM5eu/3YxotYp9b5Z52RH365O//vzprPM7Qdd1LDteXopaeSW5FmPF0CrtvJc7V5nD8Rov/+JS5KVH8mrZ+ZwWPRVn6vcGnqnj5Xe43pbm87xX++Yt5HmvdeV1f9+KeC+ane9DAFxgk1+dHK//q/6X+if1X9Uf1N+ufXviGxOvj8fYn8e+WZ2tvJm+nvwhPomfHtz/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz27zw8cPG83m6kb/RFoZmDUgEa3HDxvtJ/kMWys2k/JJOqfqa1SJziN/Lsh4XkCiGklPVjbj59NF+yGCp6s123tELY8yUP84ba2oDTXlyTLRulpE6VRdTB09MiMGFJ4oglkZcJ6Wb9GzPFwUuBRubz16//bmh4+/tvao8e7qu6vrY4uLS7NLi28t3L6/1lydLV5HPUrgRTj43n7YhXjSNQAAAAAAAAAAANDXefx/iVHPEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjcVmai+iSSmJu9NZtt7+0uNLOlnT4oWY2INI1IfhKRfBqxHMUSU13NJYP6+XhtqRIRnx20VW2XT4+p15oYahY75RLTEVEp12dwqL27Z24v6cwwi9XNduBg1P4bAAD//21q7G8=") socket$netlink(0x10, 0x3, 0x6) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) 8m36.472176519s ago: executing program 5 (id=1870): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x10, 0x1, 0x0, 0x0, {0x1}, [@generic="060001000001"]}, 0x1c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1001}) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/net/ipv6/conf/syz_tun/ioam6_enabled\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1\n', 0x2) syz_emit_ethernet(0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="ffffffffffff66778899aabb86dd6000000000180040fe800000000000000000000000000001ff02000000000000000000000000000100020100310e00"/76], 0x0) 8m35.814891765s ago: executing program 5 (id=1875): r0 = timerfd_create(0x0, 0x0) r1 = timerfd_create(0x0, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x1) syz_clone3(&(0x7f0000000300)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r3, 0x0}]) timerfd_settime(r1, 0x3, &(0x7f0000000380)={{0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0xf6d, 0x0, 0xd, 0x7fffffff, 0x0, 0x4, 0x200000000000000, 0x0, 0x100, 0x0, 0x0, 0x9, 0x3, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x1000, 0x2000000000008, 0x9, 0x3, 0x8000000000005a, 0x3}) 8m35.571468371s ago: executing program 34 (id=1875): r0 = timerfd_create(0x0, 0x0) r1 = timerfd_create(0x0, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x1) syz_clone3(&(0x7f0000000300)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r3, 0x0}]) timerfd_settime(r1, 0x3, &(0x7f0000000380)={{0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0xf6d, 0x0, 0xd, 0x7fffffff, 0x0, 0x4, 0x200000000000000, 0x0, 0x100, 0x0, 0x0, 0x9, 0x3, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x1000, 0x2000000000008, 0x9, 0x3, 0x8000000000005a, 0x3}) 5m56.532162737s ago: executing program 1 (id=2434): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x20040, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpgrp(0x0) sched_setaffinity(r2, 0xfffffffffffffdc3, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002240)={0x34, r1, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000090}, 0x8884) 5m54.492400857s ago: executing program 1 (id=2436): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101402, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYRES64, @ANYRESOCT=r2], 0x44}}, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) keyctl$join(0x1, &(0x7f0000000100)={'syz', 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 5m45.048198407s ago: executing program 3 (id=2451): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000940), 0x80000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x0, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) 5m42.663505145s ago: executing program 3 (id=2453): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) socket$nl_route(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x0, 0x13) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$kcm(0x10, 0x3, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000000), &(0x7f0000000200), &(0x7f0000000000)=[0x2], 0x0, 0x1}) 5m39.808121324s ago: executing program 1 (id=2459): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000680), 0x200202, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0xffff, 0x2, 0x2, {0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x400}}}, 0x32) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffd}}, 0x2e) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r6, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r6, 0x40047435, &(0x7f0000000200)=0x2) 5m38.837560808s ago: executing program 3 (id=2460): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e01, 0x2, @loopback, 0xa}}, 0x0, 0x0, 0x3d, 0x0, "bb02a3c364ca41d6357e544524474004000b42a21d7214bf92494925208a0e2f964e0000c534a6324d6193fcf19b2df3ee818afaa4ff1f56c54dc46d8b6d2ccd008aa0cc1dc2767bbe00"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r0, 0x800) accept4(r0, 0x0, 0x0, 0x80000) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="e8700e4f5256b1e4344d50a944ff67347cff6127e6ef12", 0x17}], 0x1}], 0x1, 0x40800) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) 5m38.78314318s ago: executing program 1 (id=2461): openat$tun(0xffffffffffffff9c, 0x0, 0xa2f01, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000080)='./bus\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="61636c2c757365725f78617474722c6e6f61636c2c63616368655f73747261746567793d64697361626c65642c6e6f757365725f78617474722c6e6f61636c2c00d4a87b439fa421753f060fe37a330d2dfca47c4e52e78d71fc65b972e2bb306bb4a29b1fe3019842462c5fee84a2e6eb90d57b8725e3a2eff0b0b471dac5c01bee53cd8d"], 0xfe, 0x17d, &(0x7f0000000340)="$eJzslM9K80AUxc9M+rX0Q1fuBHFhwbpomqQqbkSKL1DwH+6MNpZqaksbwdaVuPUB3Lr1FboRfBF1JUKXriPJTJuptFUELeL9LW7OZO7c3LmBA4Ig/ixPj68PVy/tcw3ABFJIyPfPWpTDlfzTQnJ/KrN+276+v1yrzVQH1fT9z38/BuAur8Hrne0/nZLPTfCe3gLHgtQ7YNCl3gPHttQOGHalPlJ0NcjX9cOy6+gHVbcYCCMIZhCsIOTe99e5YCgq/TFlv9FsHduu69S/UXw0v06eY1XpT/1f3dkYyvxMcJhS58CwIfUKEt3ZiJEo95+ORfW1H74/CRIkfpuI/Mm/YZhX/Cmm+EfWq9SyjWYrU67YJafknFhWbtlYNIwlKxsakYgj/C8Z+tN/pf6/IblxFseZ7Xl1U8Te2hJxkOPy0P840nNiHXh/fGg3Yp/JcyxUaW1EOkEQxNiYBYNv+wqT0kX7sArjbpQgCIIgCIIgCIIgiC/zFgAA///dqHHL") r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000300)=ANY=[]) 5m37.672897497s ago: executing program 3 (id=2464): bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[], 0x50) open_tree(0xffffffffffffff9c, 0x0, 0x9801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newspdinfo={0x1c, 0x24, 0x209, 0x70bd28, 0x25dfdbfe, 0x8, [@XFRMA_SPD_IPV6_HTHRESH={0x6, 0x4, {0x0, 0x1}}]}, 0x1c}}, 0x8800) 5m36.488022196s ago: executing program 3 (id=2466): socket(0x10, 0x80002, 0x0) r0 = syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, 0x0, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x4, 0x0, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0xfffffffffffffffe}) 5m36.317673119s ago: executing program 1 (id=2467): bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) unshare(0x20000400) r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) 5m32.962918362s ago: executing program 3 (id=2476): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42, 0x100}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40094}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x4}, {}, {0x6, 0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x7, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x3, 0x9, 0x2d}, {0xffffff8a, 0x9d2, 0x2, 0x10000}, {0x9, 0xc, 0x8, 0x8}, {0x0, 0xde74, 0x3b7, 0x5}, {0x553e3387, 0x3, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0x1000, 0xa8c, 0xfffffff8, 0xd}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) 5m32.212088779s ago: executing program 1 (id=2477): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r6, {0xb, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x7f, 0x8, 0xc9d, 0xd155}, 0x5f}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(r4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r6, 0x10042}, 0x80, &(0x7f0000003300)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff11125ce882cbf400180bf4533f00429c65112a", 0x26}, {&(0x7f00000022c0)="02db0b9ef1cafdab", 0xa888}], 0x2}, 0x4005) 5m17.381297791s ago: executing program 35 (id=2476): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42, 0x100}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40094}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x4}, {}, {0x6, 0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x7, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x3, 0x9, 0x2d}, {0xffffff8a, 0x9d2, 0x2, 0x10000}, {0x9, 0xc, 0x8, 0x8}, {0x0, 0xde74, 0x3b7, 0x5}, {0x553e3387, 0x3, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0x1000, 0xa8c, 0xfffffff8, 0xd}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) 5m17.00163579s ago: executing program 36 (id=2477): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r6, {0xb, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x7f, 0x8, 0xc9d, 0xd155}, 0x5f}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(r4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r6, 0x10042}, 0x80, &(0x7f0000003300)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff11125ce882cbf400180bf4533f00429c65112a", 0x26}, {&(0x7f00000022c0)="02db0b9ef1cafdab", 0xa888}], 0x2}, 0x4005) 34.307876734s ago: executing program 7 (id=2816): r0 = socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x105, 0x4800003a, r1, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.swap.current\x00', 0x275a, 0x0) ftruncate(r5, 0x3) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000280)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x5, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e1f, 0x3, 'lc\x00', 0x34, 0x83, 0x5}, {@dev={0xac, 0x14, 0x14, 0x34}, 0x4e23, 0x2, 0xcf, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014002000000035c0461c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cee0090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6cc", 0xd8}], 0x1}, 0x0) 27.707387129s ago: executing program 7 (id=2825): openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r0 = socket$kcm(0x21, 0x7, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_create(0x5, &(0x7f0000000540)={0x0, 0x37, 0x2, @tid=r1}, &(0x7f0000000580)) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, &(0x7f0000bbdffc)) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x1400b04, 0x0, 0x2, 0x235}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r7 = signalfd4(r0, 0x0, 0x0, 0x180000) ioctl$MON_IOCX_MFETCH(r7, 0xc00c9207, &(0x7f0000000440)={0x0, 0x0, 0x4}) socket$packet(0x11, 0x2, 0x300) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r8) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r9, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000280)=0x1, r10, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r9, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @loopback, 0x2}, {0xa, 0x4e23, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, r10, 0x7}}, 0x48) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) 23.658913739s ago: executing program 7 (id=2829): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB="18010000756c6c2500000000002020207b1af8ff00000000bfa1000000000000070100001cfeffffb702000008000000b7"], &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_tables_matches\x00') preadv(r0, &(0x7f0000000680), 0x0, 0xc4d, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r5, 0x84, 0x7f, 0x0, &(0x7f0000000000)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) writev(0xffffffffffffffff, 0x0, 0x0) poll(&(0x7f0000000140)=[{0xffffffffffffffff, 0x44}], 0x1, 0xe6) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) 20.539104158s ago: executing program 7 (id=2832): r0 = getpgrp(0x0) prlimit64(r0, 0xe, &(0x7f00000000c0)={0xa, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x400000, 0x0, 0xfffffeb6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setpriority(0x2, 0x0, 0xe2ae) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0x5523, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000000}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x24, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x4c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) pipe2(0x0, 0x0) pipe2(&(0x7f0000000580)={0xffffffffffffffff}, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r6, r7, 0x1fc, 0x0) 13.428061135s ago: executing program 8 (id=2844): ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x80}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x3}) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0x50) listen(0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) msgsnd(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x8, 0x800) r3 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r5 = dup3(r3, r4, 0x0) read$FUSE(r5, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x4008000) r6 = socket(0x10, 0x803, 0x0) sendto(r6, &(0x7f0000000c40), 0x0, 0x8800, 0x0, 0x0) recvmmsg(r6, 0x0, 0x0, 0x2000, 0x0) 11.897281733s ago: executing program 8 (id=2846): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x240403, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x320242, 0x0) fsopen(&(0x7f00000003c0)='sysfs\x00', 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f0000000140)=ANY=[@ANYRES64=r3], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r4, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r5, 0x541c, &(0x7f0000000000)) 10.493588768s ago: executing program 8 (id=2847): r0 = openat$null(0xffffffffffffff9c, 0x0, 0xc803, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@empty, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x10, &(0x7f00000006c0)=ANY=[@ANYBLOB='fmask=00000000000006000000000,usefree,nodots,flush,flush,check=normal,dots,gid=', @ANYRESHEX=0x0, @ANYBLOB=',nodots,allow_utime=01777777777777777777777,mask=^MAY_APPEND,smackfsfloor=rootmode,uid=', @ANYRESDEC=r1, @ANYBLOB="280001afc45a1591faa1f471e6c5fa2446492735c7200f1c00c77eba673b7db7d6d77607fb2df41f1316ad365a3620ae92aaba4dcbce7e32f3299817243f4127dcd444bbca2592f16624cdb5c214ab115c6b12c5538aa0df939ba9bc9819fd8641a3b4f546f4a66e3091a7f10eb0571ad301f38a5b3ca8065cbea65ea479c3a9fb4e871b75a1da6585083fc154f2a66c724726d32da5dfef2b36a7e1a64ea924e3903b7a4d1024cba43a7455bde38bebfefbc0921217254d03128891a0bf4274d039523b99c34286dd1615c324f5344c083776d446e0b76e62ffe2c4cf7a451c213fdca9c80706a942ecb9040725668a2c2fd78fe80926"], 0x1, 0x542, &(0x7f0000000b40)="$eJzs2s9qE1EUB+BjE9MiglmLiwE3rkL1CQySQnFAiMxCceFA4yYjwsxmklUfxCfweXySrLqLtBPaxn8bm05jvg+Ge5jfDJzLwNy7uB+ffJ6efKk+ffj+NQ5eJtGNiL2ziH7sRSca91bj3kXdi+tOAwDYNuNxPmy7BzarLIf5+R5u/5ck+9ZKQwAAAAAAAAAAAPwz5/8BYPc4////K8th3lvt39Y5/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC052y5fLT8y9V2fwDAzbP+A8Dusf4DwO6x/gPA7nn77v3rYZqOxklyELE4rbM6a8YmPzpOR4fJhf7VW4u6zjqX+fMmT9bz+/Fglb/4bd6LZ0+b/Dx79Sb9Kd+Pk81PHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALhmkFzqX91d1HXWafLBn/KmOjpOR4erB9bzbjzu3to0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBtQzebTvCgmpWKLi8HD5mvelX4U21+0/WcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADaUs3m07woJmXVdicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwF1RzebTvCgm5QaLtucIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA7fsRAAD//7BtjrY=") prlimit64(0x0, 0xe, &(0x7f0000000200)={0x6, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) capset(0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000808, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @loopback, 0xdbb}, 0x1c) r5 = syz_io_uring_setup(0xf03, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_enter(r5, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$apparmor_exec(r0, 0x0, 0x564) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x0, 0x8, &(0x7f00000002c0), &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = syz_open_dev$sg(0x0, 0x6f5e, 0x1) ioctl$FIBMAP(r7, 0x1, &(0x7f0000000040)=0x85) 8.182649536s ago: executing program 6 (id=2850): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) socket$inet_icmp(0x2, 0x2, 0x1) socket(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$igmp(0x2, 0x3, 0x2) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$kcm(0xa, 0x2, 0x73) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$can_raw(0x1d, 0x3, 0x1) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x3, 0x8000000003c) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) 8.167113117s ago: executing program 8 (id=2851): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mount$9p_virtio(0x0, 0x0, 0x0, 0x3200006, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000500)={{0x1, 0x1, 0x6b, 0xffffffffffffffff, {0x101}}, '\x00'}) getpid() openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000019080)=@req={0x7, 0x50d, 0x0, 0x6}, 0x10) sendmsg$nl_generic(r3, 0x0, 0x4004000) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2716, 0x0, &(0x7f0000000000)) r4 = syz_io_uring_setup(0x264a, &(0x7f00000190c0)={0x0, 0x8847, 0x40, 0x2, 0x266}, &(0x7f0000019140), &(0x7f0000000180), &(0x7f00000191c0)) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r4, 0x12, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x8000000, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xbc2a4219f6b34c13}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x20000840) 8.072097068s ago: executing program 2 (id=2852): socket$can_bcm(0x1d, 0x2, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, 0x0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x49, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) eventfd2(0x9, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000007880)=""/102400, 0x19000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r5 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f0000000180)={&(0x7f0000000140)={0x1d, r6}, 0x10, &(0x7f0000000000)={&(0x7f00000000c0)=@can={{0x0, 0x0, 0x1}, 0x5, 0x1, 0x0, 0x0, "89c5a938cab61257"}, 0x10}, 0x1, 0x0, 0x0, 0x4008851}, 0x40008d5) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000040)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x22) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x2200000, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x11, 0x13, &(0x7f0000000380)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.025842235s ago: executing program 6 (id=2853): socket$can_bcm(0x1d, 0x2, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, 0x0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x49, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) eventfd2(0x9, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000007880)=""/102400, 0x19000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32], 0x50) r5 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, 0x0) sendmsg$can_raw(r5, &(0x7f0000000180)={&(0x7f0000000140), 0x10, &(0x7f0000000000)={&(0x7f00000000c0)=@can={{0x0, 0x0, 0x1}, 0x5, 0x1, 0x0, 0x0, "89c5a938cab61257"}, 0x10}, 0x1, 0x0, 0x0, 0x4008851}, 0x40008d5) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000340)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000040)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, r6, 0x0, 0x1, 0x4}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x22) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x2200000, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x11, 0x13, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000300000001000000030000001801000020786c2500000200002020207b1af8ff00000000bfa100000000800007010000f8ffffffb702000008000000b703000080370000850000002d00000018010000786c6c2500000000002020207b1af8ff00000000bfa10000000000000701"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.970349176s ago: executing program 7 (id=2854): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000000280)={[{@resgid={'resgid', 0x3d, 0xee00}}, {@nojournal_checksum}, {@grpquota}, {@noauto_da_alloc}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@i_version}]}, 0x3, 0x572, &(0x7f00000006c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pwritev2(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109842, 0x184) pwrite64(r1, &(0x7f0000000140), 0x0, 0xe7c) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = gettid() rt_sigtimedwait(&(0x7f00000000c0)={[0xe]}, 0x0, 0x0, 0x8) tkill(r5, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r3, 0x40189429, &(0x7f0000000100)={0x1, 0x1b2, 0x4000000000}) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x81, 0x100, 0x100, 0x107, 0x4000}}) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r7 = memfd_create(0x0, 0x1) ftruncate(r7, 0x7) finit_module(r7, 0x0, 0x7) 6.120519857s ago: executing program 8 (id=2855): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0x20, &(0x7f0000000640)={&(0x7f0000000400)=""/211, 0xd3, 0x0, &(0x7f00000005c0)=""/66, 0x42}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') read$FUSE(r4, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r5, @ANYRESDEC=r0], 0x48) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0x0, 0x8, 0x0, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00\x00\r', 0x0, 0x80000003, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet6(0x10, 0x3, 0xf7ffffff) 6.113269097s ago: executing program 2 (id=2856): openat$rtc(0xffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001040)=ANY=[@ANYBLOB="1c0000001d00070f000000000000000007000000", @ANYRES32=r0, @ANYBLOB="07279f"], 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r2 = accept$alg(r1, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000040)={'#! ', '', [{}, {0x20, '\x05{+\x0f+{'}, {0x20, '}'}, {0x20, 'configfs\x00'}]}, 0x18) recvmmsg(r2, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)=""/9, 0x9}, {&(0x7f0000000300)=""/225, 0xe1}], 0x2, 0x0, 0x0, 0x2000000}}], 0x1, 0xcb, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500007700000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r3, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000540)='2', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/first_group\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x1, 0x0) write(r4, &(0x7f0000000840)='3', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r5 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r5, &(0x7f0000000940)='dummy_udc.0', 0xb) ioctl$XFS_IOC_SCRUB_METADATA(0xffffffffffffffff, 0xc040583c, &(0x7f0000000000)={0x3, 0x20, 0xa, 0x9, 0x48002}) 5.972086001s ago: executing program 6 (id=2857): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = getpid() sched_setscheduler(r3, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000380)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffe}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000000)=0x1) socket(0x10, 0x5, 0x4) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 4.450331179s ago: executing program 8 (id=2858): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r6, &(0x7f0000000080), 0x12) writev(r6, &(0x7f00000003c0), 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newtaction={0x6c, 0x30, 0x1, 0x70bd25, 0x25dfdbff, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_BOS={0x5}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x3, 0x9, 0x1, 0x7, 0x8}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000003e0007012bbd70000000000001"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 4.083983558s ago: executing program 2 (id=2859): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int={0x0, 0x12, 0x0, 0x1, 0x0, 0x7b, 0x0, 0xd, 0x3}]}}, 0x0, 0x2a, 0x0, 0x0, 0x6}, 0x28) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000002300000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000080), &(0x7f0000000340)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r0, &(0x7f0000000140)='W', 0x0}, 0x20) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r2, &(0x7f00000001c0)='\\', 0x1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f00000005c0), 0x87af, 0xffffffffffffffff, 0x4}, 0x38) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, &(0x7f00000046c0)={0x2020}, 0x2020) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000040)=0x42, 0x4) r5 = dup(r4) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000040)=0x4, 0x4) 3.017102865s ago: executing program 6 (id=2860): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0xb, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x80, 0x8, 0x8, 0x8, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x60}}, 0x44) write(0xffffffffffffffff, &(0x7f0000000240)="14000000140005b7ffccca38b9000000060860eb", 0x14) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) write$nci(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="e87d1120c34370074c8c3159e585e1e7d9d64a51aed756c6943ef9fd32f2845cbdf2adf9b97e6be3d8dea2bee1471e88037c2ffb589116b46549ed728fa80200000000000000565d0879d80203c98a72320180f58b97c9e7006bc20e6abd9264e308eca7ef78d98a2d6b410d2b15e6e085cca6a169fd5801b79b5e5dd5ca55"], 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000500)={0x9, 0x6, 0x5, 0x80000001}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000540)='.\x00', 0x850003d1) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$snapshot(0xffffff9c, &(0x7f0000000280), 0x2a000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) ioctl$BLKZEROOUT(r4, 0x127f, &(0x7f00000000c0)={0x500, 0x80600}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4048004) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfc, 0x4}, 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r5, 0x0, 0x0) 2.754680151s ago: executing program 7 (id=2861): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/diskstats\x00', 0x0, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(r2, 0x40044160, 0x3) r3 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x45) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) sendfile(r3, r1, 0x0, 0x7ffff000) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='pids.events\x00', 0x26e1, 0x0) close(r8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @multicast}) sendmsg$inet6(r0, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000"], 0x5b0}, 0x20008001) sendmmsg$inet6(r0, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="acb9d2", 0x3}, {&(0x7f0000000500)="097c1332702a5f6c7575056e66e4580d902548174ae04f4f89086f92117bfa78db61e1e5f0487095cefcf108d85ff6fee86fa10cfe799092f4bcd385323e9a5d7042837dcb51bc007111415801", 0x4d}], 0x2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2008000) 2.704272853s ago: executing program 2 (id=2862): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05000000050000000200000007"], 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x18, 0x11, &(0x7f00000005c0)=@raw=[@map_fd={0x18, 0x3, 0x1, 0x0, r0}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd8c}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}], 0x0, 0x1, 0xb4, &(0x7f0000000700)=""/180, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000007c0)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000800)={0x2, 0xb, 0x9, 0xfffffffb}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000840)=[r0, r0, r0, r0, r0], &(0x7f00000009c0)=[{0x8000, 0x4, 0x0, 0x7}, {0x4, 0x5, 0xa, 0x6}, {0x5, 0x3, 0xa, 0x7}, {0xfff, 0x1, 0xc, 0xc}, {0x2, 0x2, 0x9, 0x6}, {0x2, 0x5, 0x0, 0xb}], 0x10, 0x3}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b00)={{r0, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000940)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b40)={{r2}, &(0x7f0000000140), &(0x7f0000000380)=r1}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES64=r2, @ANYRES16=r3], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) listen(r5, 0x9) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, 0x0) recvfrom$inet(r5, 0x0, 0x0, 0x2, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6f616420656372797074667320757365723a748f75737465643a303030303030303030303030304e3420"], 0x32, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r6 = getpgid(0x0) r7 = syz_pidfd_open(r6, 0x0) unshare(0x2a020480) pidfd_getfd(r7, r7, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r8, 0x4c81, 0x2) 1.568013791s ago: executing program 2 (id=2863): write(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[], 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x7) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x66dbf000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) pselect6(0x40, &(0x7f0000000040)={0x9, 0x800, 0x2, 0x300, 0x0, 0x10000000, 0x0, 0x4}, 0x0, &(0x7f0000000100)={0xf2, 0x3, 0x2, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x13f) openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') 1.295329177s ago: executing program 6 (id=2864): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x3, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001800010000000000000000000a1420000000000a002b000008001e00000200000c0016"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x4000050) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2/custom0\x00', 0x802, 0x0) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200998f00000000000000001d00000000004e2300000000ffffffffff0700000000000000", @ANYBLOB="0120200003000000eeff008000000000"], 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x20004010) sendmsg$nl_xfrm(r1, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x64}, 0x1, 0x0, 0x0, 0x20040090}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, 0x0, 0x0) syz_mount_image$udf(&(0x7f0000000100), &(0x7f0000000240)='./file1\x00', 0x18418, &(0x7f00000000c0)=ANY=[@ANYRES8=0x0, @ANYRESOCT], 0x0, 0x4ce, &(0x7f0000000500)="$eJzs20tsVFUcx/Hff+50GIaq5WEBQ6CJJlYQ6AMLpCaGh40mPLRQjcRHKp1ipQ/SKUoJCO7UnQt2unTrwpVxa0hcGhcGY1iYIC7czErcYc59zL0zTNsZaGda+/0Qeu6987/Tc85/7j3nTG4FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACkwy8f6uq2ZtcCAAA00olTg129jP8AAKwqp1n/AwAArCYmT7/LtPt80Y77+4HssbHJi5eGjg5UP22tyZSS58e7/9nunt59L/TtPxCV85+/2Lbq5KnThzqOTE1cmM4XCvmRjqHJsbNTI/ma3+FRz6+00++AjonzF0dGRwsdPXt6y16+1HZ3zbr2tv6+d45kotihowMDpxIx6ZaH/u0PmGuGn5Gn52T68Ptv7YSklB69Lxb47Cy1tX4jdvqNGDo64DdkfGx4csa9aKkwKlXeJ5mojxqQi0eSkly9LLM4a7YWefpBpsN7i3ZSkhf1wy7/i+Ga6tMMabd0ldSpFZCzZWyNPL0n0829bXot7Fc//xnpSrMrhyWXDq//KSva6/79wF1P7rZ57I2OVydHpxKxlgqvqJU+PjTSMr83ZeXppH/FF21QO5pdHTTYWnmakCnz5Uf+vEL+vPSJ/v3bdxxMzjA2L/A+LnZPeHHVMia3hFMHS7l/i98u1CZrnv6U6d5vWX+/MxoDpOv35zvxj4ZUD0vNPI3L9O/VolnFutRLrO9LVvrYv1T1//R+4MjUhdnpsXMfzFQ9PZc99H5hZnr4bPWXg7Wrlzyy0Dq2Uqq+JVnOghXfZx8XS+eFa4DHgr24Nt9ciT8LnRVlJPn5qWW75lXsA+PJX19pjnmUq5OZpzsyjb67JRhnlKu7b1YDl/8BmQrFny3KdJj/dLCXyP+Lcf9lrbws8XP7ePC9VjSX2Hpm01zHHz7/YV2r5N/VyeX/LZkO/7Ml/E4jyL9XEevi2mV6+8a2MC6VcXHpqDnBO46Ojee7XOx9mTb8FMXKj82FsRvj2G4XW5Dp85vlsevC2E1xbI+LvSXT7V+rxz4Zx/a62FmXr9sdUWzOxW4PY9vj2D1np8ZHFupWl/8emd689opFbZ4z/4nr/3pFWfJAzuffXqz8tyWOXQ/zeibMf3qB/H8h0+zf26J2+30ffazW+z/j/Lu58nc3ymOjBeWGOLa71mY1m8v/epnuvnSr1OawbeFunKFk/p9Kl5elfm1S/tcnjrWF9crU2RerUWH28vnh8fH8NBtssFFlw92hlkE1Gr7R7DsTGsGN/4NuVO/zLJrHhON/a7AXz5jufRKP//3+z2xYJjRp/N+QONYfzlpa0lJ2ZuJCy2YpW5i9vHtsYvhc/lx+sndfX1fPwX1dvQdaMtHkLt6qo/dWPpf/XTJd/fGX0jqmfP5Xff6fqyhLqudZwbeLWrL8b0y2qWxeU+svWJ1c/ltl6rtzq7TenG/+H63/O58uL0vXX5Ou/02JY21hvVrr7AsAAAAAAAAAAAAAAAAAWEly5ukZmS4NPm/R3xDV8vzfSEVZsvjPfwWPDi7w/Fd74thIg/6uoa6OBgAAAAAAAAAAaJCUPH0t07Mq2jV3oFU6nizxv/ZfAAAA//9eMU39") ioctl$TUNGETVNETBE(r8, 0x800454df, &(0x7f0000000000)=0x1) 1.244508189s ago: executing program 2 (id=2865): r0 = socket$pptp(0x18, 0x1, 0x2) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, 0x0, 0x0) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x3, @empty}}, 0x1e) socket$netlink(0x10, 0x3, 0x8000000004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000002c0), 0x1012c0, 0x0) write$cgroup_int(r3, &(0x7f0000000100)=0x75e, 0x12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000180)=0x0) getpgrp(r6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0xbe20da00, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000004a"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x2}}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x4f}, 0x94) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000240)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x200000000180, 0x2000000001b0, 0x2000000001e0], 0x0, 0x0, &(0x7f0000000400)=ANY=[]}, 0x78) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000040)={0xf0f024}) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x28102, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) 0s ago: executing program 6 (id=2866): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write(r0, &(0x7f0000000400), 0x0) close(r0) mkdir(&(0x7f0000000500)='./my_dbroot/alua\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_dbroot/alua/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_dbroot/alua/usb_gadget/naa.1234567890abcdef+1\x00', 0x1ff) mkdir(0x0, 0x1ff) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000a00)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000b00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000c00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) mkdir(0x0, 0x1ff) symlink(0x0, &(0x7f0000001500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_write_md\x00', 0x1, 0x0) write(r1, &(0x7f0000001700)='1', 0x1) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r2, 0x0, 0x0) close(r2) kernel console output (not intermixed with test programs): er to recover. [ 551.378340][ T9868] loop4: detected capacity change from 0 to 32768 [ 551.392162][ T9868] XFS: noikeep mount option is deprecated. [ 551.398441][ T9868] XFS (loop4): stripe width (10) must be a multiple of the stripe unit (7) [ 551.860266][ T9876] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1116'. [ 553.018059][ T9886] loop4: detected capacity change from 0 to 65536 [ 553.164136][ T9886] XFS (loop4): Mounting V5 Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 553.205929][ T9886] XFS (loop4): Ending clean mount [ 553.295643][ T9886] XFS (loop4): Quotacheck needed: Please wait. [ 553.541751][ T9886] XFS (loop4): Quotacheck: Done. [ 553.629463][ T9902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 553.991344][ T9909] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1126'. [ 554.028219][ T7761] XFS (loop4): Unmounting Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 554.850081][ T23] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 555.042040][ T23] usb 5-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 555.051341][ T23] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 555.072476][ T23] usb 5-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 555.082199][ T23] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 555.090761][ T23] usb 5-1: Product: syz [ 555.095270][ T23] usb 5-1: Manufacturer: syz [ 555.100773][ T23] usb 5-1: SerialNumber: syz [ 555.109677][ T23] usb 5-1: config 0 descriptor?? [ 555.122684][ T23] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 555.415335][ T9932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 555.775233][ T23] gspca_sunplus: reg_r err -71 [ 555.787588][ T23] sunplus: probe of 5-1:0.0 failed with error -71 [ 555.801607][ T23] usb 5-1: USB disconnect, device number 17 [ 555.976669][ T9936] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1136'. [ 559.534218][T10004] libceph: resolve '0.4' (ret=-3): failed [ 559.740153][ T23] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 559.920307][ T23] usb 5-1: Using ep0 maxpacket: 16 [ 559.927266][ T23] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.942670][ T23] usb 5-1: config 0 has no interfaces? [ 559.952803][ T23] usb 5-1: New USB device found, idVendor=06f8, idProduct=a302, bcdDevice=1a.0e [ 559.965554][ T23] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.984160][ T23] usb 5-1: Product: syz [ 559.988389][ T23] usb 5-1: Manufacturer: syz [ 559.995347][ T23] usb 5-1: SerialNumber: syz [ 560.003098][ T23] usb 5-1: config 0 descriptor?? [ 560.176965][T10015] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1167'. [ 560.225156][ T5815] usb 5-1: USB disconnect, device number 18 [ 560.267131][T10015] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 560.486025][T10017] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 560.937257][T10021] bridge0: port 3(syz_tun) entered blocking state [ 560.956493][T10021] bridge0: port 3(syz_tun) entered disabled state [ 560.963618][T10021] syz_tun: entered allmulticast mode [ 560.972910][T10021] syz_tun: entered promiscuous mode [ 560.981945][T10021] bridge0: port 3(syz_tun) entered blocking state [ 560.988902][T10021] bridge0: port 3(syz_tun) entered forwarding state [ 562.254672][T10042] bond0: entered promiscuous mode [ 562.259858][T10042] bond_slave_0: entered promiscuous mode [ 562.266153][T10042] bond_slave_1: entered promiscuous mode [ 562.274949][T10042] batadv0: entered promiscuous mode [ 562.305274][T10042] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 562.315605][T10042] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 562.328301][T10042] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 562.688327][T10051] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1183'. [ 562.718646][T10044] loop4: detected capacity change from 0 to 32768 [ 562.773802][T10052] bridge2: port 1(veth0_to_bond) entered blocking state [ 562.784443][T10052] bridge2: port 1(veth0_to_bond) entered disabled state [ 562.795987][T10044] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 562.847452][T10044] (syz.4.1181,10044,1):ocfs2_remove_inode_range:1793 ERROR: status = -22 [ 562.881519][T10044] (syz.4.1181,10044,1):__ocfs2_change_file_space:2044 ERROR: status = -22 [ 563.013599][ T7761] ocfs2: Unmounting device (7,4) on (node local) [ 563.137653][T10052] veth0_to_bond: entered allmulticast mode [ 563.147680][T10052] veth0_to_bond: entered promiscuous mode [ 563.264527][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.279498][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.740557][T10070] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 565.093072][T10077] bond0: entered promiscuous mode [ 565.118716][T10077] bond_slave_0: entered promiscuous mode [ 565.130551][T10077] bond_slave_1: entered promiscuous mode [ 565.155240][T10077] batadv0: entered promiscuous mode [ 565.169474][T10077] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 565.187068][T10077] Cannot create hsr debugfs directory [ 565.218112][T10077] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 566.835063][T10104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1197'. [ 566.869458][T10104] bridge4: port 1(veth0_to_bond) entered blocking state [ 566.876847][T10104] bridge4: port 1(veth0_to_bond) entered disabled state [ 566.892691][T10104] veth0_to_bond: entered allmulticast mode [ 566.907533][T10104] veth0_to_bond: entered promiscuous mode [ 571.052951][T10176] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1225'. [ 571.457706][T10195] Need at least one configuration in g1. [ 571.469198][T10195] udc dummy_udc.0: failed to start g1: -22 [ 571.475549][T10195] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 571.495717][T10195] UDC core: g1: couldn't find an available UDC or it's busy [ 571.758935][T10211] veth1_to_bond: entered allmulticast mode [ 571.776522][T10208] veth1_to_bond: left allmulticast mode [ 572.468812][T10233] fuse: Bad value for 'fd' [ 572.521200][T10235] loop4: detected capacity change from 0 to 512 [ 572.539563][T10235] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 572.597133][T10235] EXT4-fs (loop4): mounted filesystem 007f0000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 572.615115][T10235] ext4 filesystem being mounted at /201/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 572.643152][T10235] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #2: block 2: comm syz.4.1252: lblock 0 mapped to illegal pblock 2 (length 1) [ 572.697759][T10235] EXT4-fs (loop4): Remounting filesystem read-only [ 572.757149][ T7761] EXT4-fs (loop4): unmounting filesystem 007f0000-0000-0000-0000-000000000000. [ 573.008475][T10247] input: syz0 as /devices/virtual/input/input10 [ 573.724103][T10269] loop4: detected capacity change from 0 to 4096 [ 573.798892][T10270] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 573.840353][ T28] audit: type=1800 audit(1785223979.331:11): pid=10269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1267" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 573.861295][T10269] NILFS error (device loop4): nilfs_find_entry: dir 2 size 2147487744 exceeds block count 1 [ 573.907456][T10269] Remounting filesystem read-only [ 573.994496][ T7761] NILFS (loop4): disposed unprocessed dirty file(s) when stopping log writer [ 574.005434][ T7761] NILFS (loop4): disposed unprocessed dirty file(s) when detaching log writer [ 574.021460][ T7761] NILFS (loop4): discard dirty page: offset=0, ino=2 [ 574.028340][ T7761] NILFS (loop4): discard dirty block: blocknr=14, size=4096 [ 574.037764][ T7761] NILFS (loop4): discard dirty page: offset=0, ino=6 [ 574.050519][ T7761] NILFS (loop4): discard dirty block: blocknr=23, size=4096 [ 574.058461][ T7761] NILFS (loop4): discard dirty page: offset=4096, ino=6 [ 574.066349][ T7761] NILFS (loop4): discard dirty block: blocknr=24, size=4096 [ 574.079967][ T7761] NILFS (loop4): discard dirty page: offset=8192, ino=6 [ 574.086976][ T7761] NILFS (loop4): discard dirty block: blocknr=25, size=4096 [ 574.096614][ T7761] NILFS (loop4): discard dirty page: offset=0, ino=5 [ 574.104941][ T7761] NILFS (loop4): discard dirty block: blocknr=27, size=4096 [ 574.116342][ T7761] NILFS (loop4): discard dirty page: offset=0, ino=3 [ 574.124196][ T7761] NILFS (loop4): discard dirty block: blocknr=28, size=4096 [ 574.131844][ T7761] NILFS (loop4): discard dirty page: offset=4096, ino=3 [ 574.138835][ T7761] NILFS (loop4): discard dirty block: blocknr=29, size=4096 [ 574.146959][ T7761] NILFS (loop4): discard dirty page: offset=925696, ino=3 [ 574.154604][ T7761] NILFS (loop4): discard dirty block: blocknr=36, size=4096 [ 574.248235][T10278] loop4: detected capacity change from 0 to 256 [ 574.329814][T10280] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1271'. [ 574.355107][T10280] bridge2: port 1(veth0_to_bond) entered blocking state [ 574.415866][T10282] loop4: detected capacity change from 0 to 256 [ 574.432731][T10280] bridge2: port 1(veth0_to_bond) entered disabled state [ 574.449363][T10280] veth0_to_bond: entered allmulticast mode [ 574.465373][T10280] veth0_to_bond: entered promiscuous mode [ 575.213501][T10297] overlayfs: failed to clone upperpath [ 575.296622][T10289] loop4: detected capacity change from 0 to 40427 [ 575.320166][T10289] F2FS-fs (loop4): Small segment_count (9 < 1 * 24) [ 575.327628][T10289] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 575.373584][T10289] F2FS-fs (loop4): invalid crc value [ 575.397790][T10289] F2FS-fs (loop4): Found nat_bits in checkpoint [ 575.483003][T10289] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 575.490861][T10289] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 575.629312][ T7761] syz-executor: attempt to access beyond end of device [ 575.629312][ T7761] loop4: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 575.673698][ T7761] syz-executor: attempt to access beyond end of device [ 575.673698][ T7761] loop4: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 575.892580][T10028] syz.4.1170: attempt to access beyond end of device [ 575.892580][T10028] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 575.908782][T10028] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 576.246939][T10308] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 576.311620][T10028] bridge0: port 3(syz_tun) entered disabled state [ 576.357278][T10028] syz_tun (unregistering): left allmulticast mode [ 576.363952][T10028] syz_tun (unregistering): left promiscuous mode [ 576.371549][T10028] bridge0: port 3(syz_tun) entered disabled state [ 576.505305][T10311] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1284'. [ 577.446572][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 577.465255][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 577.479193][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 577.488724][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 577.499274][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 577.506923][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 577.651227][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.775982][T10318] veth0_to_bond: left allmulticast mode [ 577.785288][T10318] veth0_to_bond: left promiscuous mode [ 577.800788][T10318] bridge2: port 1(veth0_to_bond) entered disabled state [ 577.826414][T10318] bridge3: port 1(veth0_to_bond) entered blocking state [ 577.956256][T10318] bridge3: port 1(veth0_to_bond) entered disabled state [ 578.026776][T10318] veth0_to_bond: entered allmulticast mode [ 578.035277][T10318] veth0_to_bond: entered promiscuous mode [ 578.087509][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.144211][T10321] wlan0 speed is unknown, defaulting to 1000 [ 578.206397][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.293009][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.934645][T10321] chnl_net:caif_netlink_parms(): no params data found [ 579.231974][T10321] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.278918][T10321] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.306346][T10321] bridge_slave_0: entered allmulticast mode [ 579.316669][T10321] bridge_slave_0: entered promiscuous mode [ 579.334817][T10321] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.343539][T10321] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.351206][T10321] bridge_slave_1: entered allmulticast mode [ 579.358742][T10321] bridge_slave_1: entered promiscuous mode [ 579.426062][T10321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 579.453610][T10321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 579.529179][T10321] team0: Port device team_slave_0 added [ 579.567843][T10321] team0: Port device team_slave_1 added [ 579.583794][ T51] Bluetooth: hci1: command tx timeout [ 579.628702][T10321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 579.635822][T10321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 579.671267][T10321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 579.694179][T10321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 579.707446][T10321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 579.753426][T10321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 579.798522][T10372] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1296'. [ 579.999841][T10375] veth0_to_bond: left allmulticast mode [ 580.009417][T10375] veth0_to_bond: left promiscuous mode [ 580.022291][T10375] bridge4: port 1(veth0_to_bond) entered disabled state [ 580.058869][T10375] bridge5: port 1(veth0_to_bond) entered blocking state [ 580.066486][T10375] bridge5: port 1(veth0_to_bond) entered disabled state [ 580.081270][T10375] veth0_to_bond: entered allmulticast mode [ 580.089098][T10375] veth0_to_bond: entered promiscuous mode [ 580.118945][T10321] hsr_slave_0: entered promiscuous mode [ 580.130433][T10321] hsr_slave_1: entered promiscuous mode [ 580.144358][T10321] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 580.152150][T10321] Cannot create hsr debugfs directory [ 580.244474][ T12] tipc: Left network mode [ 580.623907][T10321] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 580.675504][T10321] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 580.715004][T10321] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 580.737465][T10321] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 581.199755][T10321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 581.311507][T10321] 8021q: adding VLAN 0 to HW filter on device team0 [ 581.332612][ T2982] bridge0: port 1(bridge_slave_0) entered blocking state [ 581.339765][ T2982] bridge0: port 1(bridge_slave_0) entered forwarding state [ 581.468364][ T2941] bridge0: port 2(bridge_slave_1) entered blocking state [ 581.475620][ T2941] bridge0: port 2(bridge_slave_1) entered forwarding state [ 581.664274][ T51] Bluetooth: hci1: command tx timeout [ 582.110721][T10321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 582.454077][T10433] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1306'. [ 582.805593][T10436] veth0_to_bond: left allmulticast mode [ 582.824050][T10436] veth0_to_bond: left promiscuous mode [ 582.829985][T10436] bridge5: port 1(veth0_to_bond) entered disabled state [ 582.892880][T10436] bridge6: port 1(veth0_to_bond) entered blocking state [ 582.903003][T10436] bridge6: port 1(veth0_to_bond) entered disabled state [ 582.915701][T10436] veth0_to_bond: entered allmulticast mode [ 582.924420][T10436] veth0_to_bond: entered promiscuous mode [ 583.033244][ T12] hsr_slave_0: left promiscuous mode [ 583.039515][ T12] hsr_slave_1: left promiscuous mode [ 583.047074][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 583.054760][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 583.068251][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 583.076583][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 583.085163][ T12] bridge_slave_1: left allmulticast mode [ 583.091104][ T12] bridge_slave_1: left promiscuous mode [ 583.097300][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.113068][ T12] bridge_slave_0: left allmulticast mode [ 583.118924][ T12] bridge_slave_0: left promiscuous mode [ 583.125604][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 583.167971][ T12] veth1_macvtap: left promiscuous mode [ 583.175763][ T12] veth0_macvtap: left promiscuous mode [ 583.181955][ T12] veth1_vlan: left promiscuous mode [ 583.188783][ T12] veth0_vlan: left promiscuous mode [ 583.466466][ T12] pim6reg (unregistering): left allmulticast mode [ 583.753346][ T51] Bluetooth: hci1: command tx timeout [ 584.393867][ T12] team0 (unregistering): Port device team_slave_1 removed [ 584.455383][ T12] team0 (unregistering): Port device team_slave_0 removed [ 584.513744][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 584.576583][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 585.039062][ T12] bond0 (unregistering): Released all slaves [ 585.175103][T10460] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1316'. [ 585.198640][T10465] veth0_to_bond: left allmulticast mode [ 585.206884][T10465] veth0_to_bond: left promiscuous mode [ 585.213131][T10465] bridge6: port 1(veth0_to_bond) entered disabled state [ 585.226122][T10465] bridge7: port 1(veth0_to_bond) entered blocking state [ 585.233894][T10465] bridge7: port 1(veth0_to_bond) entered disabled state [ 585.243376][T10465] veth0_to_bond: entered allmulticast mode [ 585.250434][T10465] veth0_to_bond: entered promiscuous mode [ 585.305326][T10479] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1313'. [ 585.403219][T10321] veth0_vlan: entered promiscuous mode [ 585.453400][T10321] veth1_vlan: entered promiscuous mode [ 585.538545][T10321] veth0_macvtap: entered promiscuous mode [ 585.566307][T10321] veth1_macvtap: entered promiscuous mode [ 585.588567][T10321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 585.610099][T10321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.641565][T10321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 585.666461][T10321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.676530][T10321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 585.694750][T10321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.712449][T10321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 585.783900][T10321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 585.799567][T10321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.814266][T10321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 585.824955][ T51] Bluetooth: hci1: command tx timeout [ 585.837919][T10321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 585.870599][T10321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 585.883612][T10321] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.893567][T10321] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.903617][T10321] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.912868][T10321] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.506215][T10510] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1325'. [ 586.596011][T10516] veth0_to_bond: left allmulticast mode [ 586.613154][T10516] veth0_to_bond: left promiscuous mode [ 586.637573][T10516] bridge7: port 1(veth0_to_bond) entered disabled state [ 586.694014][T10516] bridge8: port 1(veth0_to_bond) entered blocking state [ 586.708395][T10516] bridge8: port 1(veth0_to_bond) entered disabled state [ 586.716816][T10516] veth0_to_bond: entered allmulticast mode [ 586.733635][T10516] veth0_to_bond: entered promiscuous mode [ 586.860201][ T3505] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.868094][ T3505] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.939249][ T3505] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.965664][ T3505] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.298822][T10580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 591.449115][T10629] loop5: detected capacity change from 0 to 512 [ 591.479970][T10629] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 592.207543][T10654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 593.537319][T10685] loop5: detected capacity change from 0 to 512 [ 593.559092][T10685] EXT4-fs: Ignoring removed nomblk_io_submit option [ 593.567674][T10685] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 593.632076][T10685] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 593.645067][T10685] ext4 filesystem being mounted at /12/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 593.732743][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 593.814584][T10692] loop5: detected capacity change from 0 to 512 [ 593.852604][T10692] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 593.863432][T10692] FAT-fs (loop5): Filesystem has been set read-only [ 593.876268][T10692] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 594.732713][T10715] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 595.225247][T10722] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 597.905924][ T28] audit: type=1326 audit(1785224003.401:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10797 comm="syz.2.1397" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f423919de99 code=0x0 [ 598.799273][T10817] loop5: detected capacity change from 0 to 32768 [ 598.863574][T10817] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 598.969644][T10321] ocfs2: Unmounting device (7,5) on (node local) [ 600.016908][ T28] audit: type=1326 audit(1785224005.511:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.062679][ T28] audit: type=1326 audit(1785224005.541:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.093249][ T28] audit: type=1326 audit(1785224005.541:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.123865][ T28] audit: type=1326 audit(1785224005.591:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.150427][ T28] audit: type=1326 audit(1785224005.591:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.175049][ T28] audit: type=1326 audit(1785224005.591:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10854 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f37b2d5e6ce code=0x7ffc0000 [ 600.199825][ T28] audit: type=1326 audit(1785224005.611:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.228291][ T28] audit: type=1326 audit(1785224005.611:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 600.257728][ T28] audit: type=1326 audit(1785224005.621:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10852 comm="syz.5.1412" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f37b2d9de99 code=0x7ffc0000 [ 602.901538][T10938] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 607.301936][T11078] vlan2: entered allmulticast mode [ 607.307129][T11078] bond0: entered allmulticast mode [ 607.323139][T11078] bond_slave_0: entered allmulticast mode [ 607.328934][T11078] bond_slave_1: entered allmulticast mode [ 607.342343][T11078] bridge0: port 3(vlan2) entered blocking state [ 607.353265][T11089] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 607.368086][T11078] bridge0: port 3(vlan2) entered disabled state [ 607.376804][T11078] vlan2: entered promiscuous mode [ 607.397063][T11078] bond0: entered promiscuous mode [ 607.408814][T11078] bond_slave_0: entered promiscuous mode [ 607.416368][T11078] bond_slave_1: entered promiscuous mode [ 607.429278][T11078] bridge0: port 3(vlan2) entered blocking state [ 607.435762][T11078] bridge0: port 3(vlan2) entered forwarding state [ 608.190113][ T5836] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 608.293969][T11124] kvm: Disabled LAPIC found during irq injection [ 608.485953][ T5836] usb 6-1: Using ep0 maxpacket: 8 [ 608.494068][ T5836] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 608.502521][ T5836] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 608.512736][ T5836] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 608.523515][ T5836] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 608.533705][ T5836] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 608.546918][ T5836] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 608.556073][ T5836] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.797586][ T5836] usb 6-1: usb_control_msg returned -32 [ 608.807586][ T5836] usbtmc 6-1:16.0: can't read capabilities [ 609.302177][T11150] kvm: user requested TSC rate below hardware speed [ 609.313650][T11150] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1865440455 (119388189120 ns) > initial count (28075889792 ns). Using initial count to start timer. [ 609.559645][T11159] usbtmc 6-1:16.0: usb_clear_halt returned -32 [ 609.761131][ T5835] usb 6-1: USB disconnect, device number 2 [ 610.060298][ T23] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 610.262301][ T23] usb 2-1: Using ep0 maxpacket: 16 [ 610.281949][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 610.402830][ T23] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 610.418089][T11171] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1496'. [ 610.428451][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.448779][ T23] usb 2-1: Product: syz [ 610.458970][ T23] usb 2-1: Manufacturer: syz [ 610.479178][ T23] usb 2-1: SerialNumber: syz [ 610.508693][ T23] usb 2-1: config 0 descriptor?? [ 610.536462][T11171] bridge9: port 1(veth9) entered blocking state [ 610.546968][ T23] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 610.557295][T11171] bridge9: port 1(veth9) entered disabled state [ 610.565925][T11171] veth9: entered allmulticast mode [ 610.571639][ T23] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 610.589403][T11171] veth9: entered promiscuous mode [ 610.610749][T11174] veth0_to_bond: left allmulticast mode [ 610.619143][T11174] veth0_to_bond: left promiscuous mode [ 610.635221][T11174] bridge8: port 1(veth0_to_bond) entered disabled state [ 611.022832][T11181] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1500'. [ 611.079442][T11181] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1500'. [ 611.228655][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 611.228738][ T28] audit: type=1326 audit(1785224016.721:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11182 comm="syz.2.1502" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f423919de99 code=0x0 [ 611.375788][T11189] syzkaller1: entered promiscuous mode [ 611.383037][T11189] syzkaller1: entered allmulticast mode [ 611.404232][ T23] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 611.784694][T11195] netlink: 88 bytes leftover after parsing attributes in process `syz.5.1506'. [ 611.860777][ T23] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 611.869546][ T23] em28xx 2-1:0.0: board has no eeprom [ 611.932681][T11197] loop5: detected capacity change from 0 to 512 [ 611.960135][ T23] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 611.976715][ T23] em28xx 2-1:0.0: dvb set to bulk mode. [ 611.985964][ T5835] em28xx 2-1:0.0: Binding DVB extension [ 612.008067][ T23] usb 2-1: USB disconnect, device number 20 [ 612.030236][ T23] em28xx 2-1:0.0: Disconnecting em28xx [ 612.067717][T11197] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 612.121782][T11197] ext4 filesystem being mounted at /61/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 612.205232][ T5835] em28xx 2-1:0.0: Registering input extension [ 612.221429][ T23] em28xx 2-1:0.0: Closing input extension [ 612.319357][ T23] em28xx 2-1:0.0: Freeing device [ 612.379395][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 612.940429][T11217] loop5: detected capacity change from 0 to 40427 [ 612.960257][T11217] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 612.979522][T11217] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 613.002703][T11217] F2FS-fs (loop5): invalid crc value [ 613.034132][T11217] F2FS-fs (loop5): Found nat_bits in checkpoint [ 613.156767][T11217] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 613.164676][T11217] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 614.154160][T11247] fuse: Bad value for 'fd' [ 614.728362][T11268] macvlan2: entered promiscuous mode [ 614.737941][T11268] geneve1: entered promiscuous mode [ 614.753532][T11268] team0: Port device macvlan2 added [ 615.725287][T11272] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1531'. [ 616.037561][T11277] bridge3: port 1(veth5) entered blocking state [ 616.055800][T11277] bridge3: port 1(veth5) entered disabled state [ 616.073294][T11277] veth5: entered allmulticast mode [ 616.092477][T11277] veth5: entered promiscuous mode [ 616.125268][T11272] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1531'. [ 616.653226][T11305] overlayfs: failed to clone upperpath [ 618.207035][T11312] loop5: detected capacity change from 0 to 32768 [ 618.227165][T11312] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop5 scanned by syz.5.1544 (11312) [ 618.327558][T11312] BTRFS info (device loop5): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 618.352829][T11312] BTRFS info (device loop5): using xxhash64 (xxhash64-generic) checksum algorithm [ 618.378593][T11312] BTRFS info (device loop5): force zlib compression, level 3 [ 618.408121][T11312] BTRFS info (device loop5): force clearing of disk cache [ 618.425581][T11312] BTRFS info (device loop5): setting nodatasum [ 618.434884][T11312] BTRFS info (device loop5): use zlib compression, level 3 [ 618.449275][T11312] BTRFS info (device loop5): allowing degraded mounts [ 618.464482][T11312] BTRFS info (device loop5): enabling disk space caching [ 618.480099][T11312] BTRFS info (device loop5): disk space caching is enabled [ 618.552757][T11312] BTRFS info (device loop5): enabling ssd optimizations [ 618.570653][T11312] BTRFS info (device loop5): auto enabling async discard [ 618.586061][T11312] BTRFS info (device loop5): rebuilding free space tree [ 618.627759][T11312] BTRFS info (device loop5): disabling free space tree [ 618.643841][T11312] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 618.667753][T11312] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 618.857331][T10321] BTRFS info (device loop5): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 619.404876][T11351] block device autoloading is deprecated and will be removed. [ 619.528624][ C1] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 619.754905][T11372] macvlan2: entered promiscuous mode [ 620.007827][T11378] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1560'. [ 620.055994][T11378] bridge10: port 1(veth11) entered blocking state [ 620.063091][T11378] bridge10: port 1(veth11) entered disabled state [ 620.069829][T11378] veth11: entered allmulticast mode [ 620.077001][T11378] veth11: entered promiscuous mode [ 620.095296][T11378] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1560'. [ 620.364371][T11386] syzkaller1: entered promiscuous mode [ 620.370068][T11386] syzkaller1: entered allmulticast mode [ 622.451299][T11427] loop5: detected capacity change from 0 to 64 [ 622.559462][ T28] audit: type=1800 audit(1785224028.051:25): pid=11427 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1580" name="file1" dev="loop5" ino=22 res=0 errno=0 [ 623.218049][T11439] loop8: detected capacity change from 0 to 524288000 [ 624.167564][T11472] gre2: entered promiscuous mode [ 624.298421][T11475] loop5: detected capacity change from 0 to 128 [ 624.355832][T11475] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 624.414002][T11475] ext4 filesystem being mounted at /85/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 624.526158][T10321] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 624.706813][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.713711][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.608524][ T5836] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 626.589952][ T5836] usb 6-1: Using ep0 maxpacket: 32 [ 626.602654][ T5836] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 626.611337][ T5836] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 626.624611][ T5836] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 626.633844][ T5836] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 626.643583][ T5836] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 626.654287][ T5836] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 626.667481][ T5836] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 626.676803][ T5836] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.696023][ T5836] usb 6-1: config 0 descriptor?? [ 626.940528][ T5836] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 627.232019][ C0] usblp0: nonzero read bulk status received: -71 [ 627.232354][ T23] usb 6-1: USB disconnect, device number 3 [ 627.241069][T11499] usblp0: error -71 reading from printer [ 627.253408][T11517] overlayfs: failed to clone upperpath [ 627.281266][T11499] usblp0: removed [ 629.375784][T11567] loop5: detected capacity change from 0 to 512 [ 629.431221][T11567] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 629.457864][T11567] EXT4-fs (loop5): 1 truncate cleaned up [ 629.481005][T11567] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 630.750979][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 630.869555][T11574] xt_hashlimit: size too large, truncated to 1048576 [ 630.913762][T11596] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-61) [ 631.068536][T11598] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 631.215868][T11600] loop5: detected capacity change from 0 to 1024 [ 631.230802][T11600] EXT4-fs: Ignoring removed orlov option [ 631.263842][T11600] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 631.363627][T11574] syz.3.1628: vmalloc error: size 8392704, failed to allocated page array size 16392, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 631.390041][T11574] CPU: 0 PID: 11574 Comm: syz.3.1628 Not tainted syzkaller #0 [ 631.397585][T11574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 631.407695][T11574] Call Trace: [ 631.411071][T11574] [ 631.414097][T11574] dump_stack_lvl+0x18c/0x250 [ 631.418957][T11574] ? show_regs_print_info+0x20/0x20 [ 631.424239][T11574] ? load_image+0x420/0x420 [ 631.428913][T11574] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 631.435432][T11574] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 631.441993][T11574] warn_alloc+0x246/0x340 [ 631.446401][T11574] ? zone_watermark_ok_safe+0x230/0x230 [ 631.451995][T11574] ? _raw_spin_unlock+0x28/0x40 [ 631.456968][T11574] __vmalloc_node_range+0x661/0x1320 [ 631.462298][T11574] ? __mutex_trylock_common+0x160/0x270 [ 631.467916][T11574] ? free_vm_area+0x50/0x50 [ 631.472447][T11574] ? hashlimit_pernet+0x23/0x230 [ 631.477495][T11574] ? htable_create+0xf1/0x780 [ 631.482198][T11574] vmalloc+0x79/0x90 [ 631.486226][T11574] ? htable_create+0xf1/0x780 [ 631.490947][T11574] htable_create+0xf1/0x780 [ 631.495491][T11574] hashlimit_mt_check_common+0x6c4/0x9e0 [ 631.501155][T11574] xt_check_match+0x49d/0xc60 [ 631.505922][T11574] ? xt_check_proc_name+0x270/0x270 [ 631.511138][T11574] ? pcpu_alloc+0x11e7/0x1880 [ 631.515834][T11574] ? xt_percpu_counter_alloc+0x139/0x1e0 [ 631.521487][T11574] ? xt_find_match+0x1f1/0x230 [ 631.526359][T11574] translate_table+0x150c/0x2020 [ 631.531403][T11574] ? ip6t_register_table+0x7c0/0x7c0 [ 631.536706][T11574] ? __might_fault+0xaa/0x120 [ 631.541397][T11574] ? __virt_addr_valid+0x10c/0x380 [ 631.546656][T11574] ? __virt_addr_valid+0x10c/0x380 [ 631.551787][T11574] ? __might_fault+0xc6/0x120 [ 631.556475][T11574] ? __might_fault+0xaa/0x120 [ 631.561177][T11574] do_ip6t_set_ctl+0x9fe/0xe10 [ 631.565970][T11574] ? ip6t_unregister_table_exit+0x230/0x230 [ 631.571882][T11574] ? __lock_acquire+0x7d80/0x7d80 [ 631.576925][T11574] ? rcu_is_watching+0x15/0xb0 [ 631.581708][T11574] ? trace_contention_end+0x39/0xe0 [ 631.586928][T11574] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 631.592582][T11574] ? mutex_unlock+0x10/0x10 [ 631.597112][T11574] nf_setsockopt+0x263/0x280 [ 631.601980][T11574] rawv6_setsockopt+0x276/0x5d0 [ 631.606875][T11574] ? raw6_destroy+0x30/0x30 [ 631.611393][T11574] ? __fget_files+0x28/0x460 [ 631.616053][T11574] ? aa_sock_opt_perm+0x74/0x100 [ 631.621091][T11574] ? sock_common_setsockopt+0x36/0xc0 [ 631.626574][T11574] ? sock_common_recvmsg+0x190/0x190 [ 631.631973][T11574] do_sock_setsockopt+0x175/0x1a0 [ 631.637131][T11574] ? __fdget+0x180/0x210 [ 631.641415][T11574] __x64_sys_setsockopt+0x182/0x200 [ 631.646653][T11574] do_syscall_64+0x55/0xb0 [ 631.651089][T11574] ? clear_bhb_loop+0x40/0x90 [ 631.655875][T11574] ? clear_bhb_loop+0x40/0x90 [ 631.660595][T11574] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 631.666500][T11574] RIP: 0033:0x7f43ea19de99 [ 631.670969][T11574] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 631.690615][T11574] RSP: 002b:00007f43eb045028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 631.699076][T11574] RAX: ffffffffffffffda RBX: 00007f43ea425fa0 RCX: 00007f43ea19de99 [ 631.707062][T11574] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 631.715051][T11574] RBP: 00007f43ea233eaf R08: 0000000000000528 R09: 0000000000000000 [ 631.723032][T11574] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000000 [ 631.731015][T11574] R13: 00007f43ea426038 R14: 00007f43ea425fa0 R15: 00007ffc44b3b3e8 [ 631.739011][T11574] [ 631.817182][T11574] Mem-Info: [ 631.834912][T11574] active_anon:79749 inactive_anon:0 isolated_anon:0 [ 631.834912][T11574] active_file:18543 inactive_file:40202 isolated_file:0 [ 631.834912][T11574] unevictable:0 dirty:25 writeback:0 [ 631.834912][T11574] slab_reclaimable:11113 slab_unreclaimable:97191 [ 631.834912][T11574] mapped:24933 shmem:71145 pagetables:1383 [ 631.834912][T11574] sec_pagetables:0 bounce:0 [ 631.834912][T11574] kernel_misc_reclaimable:0 [ 631.834912][T11574] free:1268001 free_pcp:8585 free_cma:0 [ 631.952826][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 632.006064][T11574] Node 0 active_anon:301560kB inactive_anon:0kB active_file:74132kB inactive_file:160608kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:99692kB dirty:100kB writeback:0kB shmem:267144kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12100kB pagetables:5432kB sec_pagetables:0kB all_unreclaimable? no [ 632.071850][T11574] Node 1 active_anon:1536kB inactive_anon:0kB active_file:40kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:40kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 632.293608][T11574] Node 0 DMA free:15328kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:32kB local_pcp:0kB free_cma:0kB [ 632.378228][T11574] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 632.439693][T11574] Node 0 DMA32 free:1165028kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:307248kB inactive_anon:0kB active_file:74132kB inactive_file:159792kB unevictable:0kB writepending:128kB present:3129332kB managed:2586840kB mlocked:0kB bounce:0kB free_pcp:26100kB local_pcp:19580kB free_cma:0kB [ 632.567848][T11574] lowmem_reserve[]: 0 0 0 0 0 [ 632.597084][T11574] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 632.738450][T11608] loop5: detected capacity change from 0 to 40427 [ 632.767272][T11608] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 632.773698][T11574] lowmem_reserve[]: 0 0 0 0 0 [ 632.775531][T11608] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 632.793846][T11608] F2FS-fs (loop5): invalid crc value [ 632.822957][T11608] F2FS-fs (loop5): Found nat_bits in checkpoint [ 633.049986][T11608] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 633.067871][T11608] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 633.197529][T11574] Node 1 Normal free:3891452kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:1536kB inactive_anon:0kB active_file:40kB inactive_file:200kB unevictable:0kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:19356kB local_pcp:10016kB free_cma:0kB [ 633.280434][T11574] lowmem_reserve[]: 0 0 0 0 0 [ 633.285336][T11574] Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15328kB [ 633.346050][ T28] audit: type=1804 audit(1785224038.841:26): pid=11608 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.1639" name="/newroot/95/file0/bus" dev="loop5" ino=10 res=1 errno=0 [ 633.411451][T11574] Node 0 DMA32: 11*4kB (UME) 72*8kB (UME) 96*16kB (UE) 75*32kB (UE) 42*64kB (UME) 65*128kB (UME) 56*256kB (UME) 53*512kB (UME) 19*1024kB (UME) 10*2048kB (UME) 257*4096kB (UM) = 1149644kB [ 633.432175][T11574] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 633.458682][T11574] Node 1 Normal: 193*4kB (UME) 49*8kB (UE) 39*16kB (UME) 108*32kB (UME) 26*64kB (UME) 4*128kB (UE) 0*256kB 2*512kB (ME) 0*1024kB 2*2048kB (UE) 947*4096kB (M) = 3891452kB [ 633.508761][T11574] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 633.571402][T11574] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 633.735944][T11574] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 633.763403][T11574] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 633.875823][T11574] 130970 total pagecache pages [ 633.881738][T11574] 0 pages in swap cache [ 633.886314][T11574] Free swap = 124460kB [ 633.919966][T11574] Total swap = 124996kB [ 633.975118][T11574] 2097051 pages RAM [ 633.979001][T11574] 0 pages HighMem/MovableOnly [ 634.007603][T11574] 416955 pages reserved [ 634.027298][T11574] 0 pages cma reserved [ 634.356447][T11643] loop5: detected capacity change from 0 to 512 [ 634.396930][T11643] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 634.543922][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 634.677258][T11650] gretap1: entered promiscuous mode [ 636.276829][T11680] overlayfs: failed to clone upperpath [ 636.413438][T11673] loop5: detected capacity change from 0 to 32768 [ 639.038084][T11718] loop5: detected capacity change from 0 to 1024 [ 639.080229][T11718] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 639.249459][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 639.459327][T11726] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1678'. [ 639.747468][T11732] bridge4: port 1(veth7) entered blocking state [ 639.764403][T11732] bridge4: port 1(veth7) entered disabled state [ 639.821185][T11732] veth7: entered allmulticast mode [ 639.839004][T11732] veth7: entered promiscuous mode [ 639.923140][T11742] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 641.300569][T11782] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1704'. [ 641.357014][T11782] bridge1: port 1(veth3) entered blocking state [ 641.363840][T11782] bridge1: port 1(veth3) entered disabled state [ 641.370595][T11782] veth3: entered allmulticast mode [ 641.377624][T11782] veth3: entered promiscuous mode [ 641.705300][T11794] loop5: detected capacity change from 0 to 512 [ 641.740605][T11794] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 641.757076][T11794] ext4 filesystem being mounted at /114/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 641.897482][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 642.201504][T11800] loop5: detected capacity change from 0 to 4096 [ 642.223871][T11800] EXT4-fs: Ignoring removed orlov option [ 642.263856][T11800] EXT4-fs (loop5): Test dummy encryption mode enabled [ 642.292171][T11800] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 642.407762][T11800] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 642.543681][T10321] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 643.180172][ T51] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 643.189054][ T51] Bluetooth: hci1: Injecting HCI hardware error event [ 643.198551][ T51] Bluetooth: hci1: hardware error 0x00 [ 643.670981][T11840] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1733'. [ 643.691461][T11842] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 643.733805][T11840] bridge2: port 1(veth5) entered blocking state [ 643.747261][T11840] bridge2: port 1(veth5) entered disabled state [ 643.754252][T11840] veth5: entered allmulticast mode [ 643.767494][T11840] veth5: entered promiscuous mode [ 643.777607][T11843] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1733'. [ 644.168664][T11859] ip6erspan0: entered allmulticast mode [ 644.265649][ T787] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 644.296512][T11861] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 644.579934][ T787] usb 2-1: Using ep0 maxpacket: 8 [ 644.597831][ T787] usb 2-1: config 0 has no interfaces? [ 644.610099][ T787] usb 2-1: New USB device found, idVendor=0421, idProduct=033e, bcdDevice=5f.0e [ 644.626367][ T787] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.641689][ T787] usb 2-1: config 0 descriptor?? [ 644.727721][T11866] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1736'. [ 644.788428][T11866] bridge3: port 1(veth7) entered blocking state [ 644.800084][T11866] bridge3: port 1(veth7) entered disabled state [ 644.806598][T11866] veth7: entered allmulticast mode [ 644.816106][T11866] veth7: entered promiscuous mode [ 644.834925][T11871] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1736'. [ 645.079552][ T787] usb 2-1: USB disconnect, device number 21 [ 645.340205][ T51] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 645.545846][T11893] overlayfs: failed to clone upperpath [ 649.515267][T11996] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1786'. [ 649.559069][T11996] bridge4: port 1(veth9) entered blocking state [ 649.570054][T11996] bridge4: port 1(veth9) entered disabled state [ 649.576549][T11996] veth9: entered allmulticast mode [ 649.593995][T11996] veth9: entered promiscuous mode [ 650.183090][T12024] overlayfs: failed to clone upperpath [ 650.352168][T12030] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1801'. [ 651.392526][T12066] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1814'. [ 651.457135][T12066] bridge12: port 1(veth13) entered blocking state [ 651.469150][T12066] bridge12: port 1(veth13) entered disabled state [ 651.476207][T12066] veth13: entered allmulticast mode [ 651.485618][T12066] veth13: entered promiscuous mode [ 651.496892][T12069] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1814'. [ 651.667603][T12077] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1817'. [ 651.818623][T12083] overlayfs: failed to clone upperpath [ 652.104689][T12093] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1825'. [ 652.182439][T12093] bridge5: port 1(veth11) entered blocking state [ 652.188966][T12093] bridge5: port 1(veth11) entered disabled state [ 652.206383][T12093] veth11: entered allmulticast mode [ 652.222127][T12093] veth11: entered promiscuous mode [ 652.232512][T12096] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1825'. [ 654.025373][T12131] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1841'. [ 654.278336][T12133] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1839'. [ 654.351459][T12137] overlayfs: failed to clone upperpath [ 654.376038][T12133] bridge4: port 1(veth7) entered blocking state [ 654.386983][T12133] bridge4: port 1(veth7) entered disabled state [ 654.458894][T12133] veth7: entered allmulticast mode [ 654.483609][T12133] veth7: entered promiscuous mode [ 654.530141][T12139] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1839'. [ 655.356497][ T2967] bond0: (slave bond_slave_0): interface is now down [ 655.364154][ T2967] bond0: (slave bond_slave_1): interface is now down [ 655.379176][ T2967] bond0: now running without any active interface! [ 655.391380][ T1088] bridge0: port 3(vlan2) entered disabled state [ 656.302956][T12193] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1860'. [ 656.546387][T12198] loop5: detected capacity change from 0 to 256 [ 656.563951][T12198] exfat: Deprecated parameter 'utf8' [ 656.579701][T12198] exfat: Deprecated parameter 'namecase' [ 656.594640][T12198] exfat: Deprecated parameter 'namecase' [ 656.602387][T12198] exfat: Deprecated parameter 'utf8' [ 656.645591][T12198] exFAT-fs (loop5): failed to load upcase table (idx : 0x00012153, chksum : 0xc9bffc20, utbl_chksum : 0xe619d30d) [ 656.741575][T12200] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1863'. [ 656.769521][T12200] syzkaller1: entered promiscuous mode [ 656.783380][T12200] syzkaller1: entered allmulticast mode [ 657.378435][T12216] loop5: detected capacity change from 0 to 1024 [ 658.327758][T10321] hfsplus: walked past end of dir [ 658.439143][T12221] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1869'. [ 659.052627][ T2967] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.157855][ T2967] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.332487][ T2967] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.558505][ T2967] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.731229][ T7765] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 659.753821][ T7765] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 659.764925][ T7765] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 659.781351][ T7765] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 659.789368][ T7765] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 659.797042][ T7765] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 659.941339][T12243] wlan0 speed is unknown, defaulting to 1000 [ 660.523336][T12243] chnl_net:caif_netlink_parms(): no params data found [ 660.719613][T12243] bridge0: port 1(bridge_slave_0) entered blocking state [ 660.727344][T12243] bridge0: port 1(bridge_slave_0) entered disabled state [ 660.734888][T12243] bridge_slave_0: entered allmulticast mode [ 660.742778][T12243] bridge_slave_0: entered promiscuous mode [ 660.763333][T12243] bridge0: port 2(bridge_slave_1) entered blocking state [ 660.780288][T12243] bridge0: port 2(bridge_slave_1) entered disabled state [ 660.794873][T12243] bridge_slave_1: entered allmulticast mode [ 660.802908][T12243] bridge_slave_1: entered promiscuous mode [ 661.027772][T12243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 661.058863][T12243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 661.215955][T12243] team0: Port device team_slave_0 added [ 661.242557][T12243] team0: Port device team_slave_1 added [ 661.562608][T12243] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 661.575625][T12243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 661.584344][T12278] kvm: vcpu 0: requested 53248 ns lapic timer period limited to 200000 ns [ 661.622855][T12243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 661.639770][T12243] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 661.648483][T12243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 661.690008][T12243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 661.701342][T12278] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1420284373 (45449099936 ns) > initial count (200000 ns). Using initial count to start timer. [ 661.866220][T12243] hsr_slave_0: entered promiscuous mode [ 661.894225][T12243] hsr_slave_1: entered promiscuous mode [ 661.900031][ T51] Bluetooth: hci1: command tx timeout [ 661.919968][T12243] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 661.938052][T12243] Cannot create hsr debugfs directory [ 662.658474][ T2967] veth11: left allmulticast mode [ 662.664148][ T2967] veth11: left promiscuous mode [ 662.672209][ T2967] bridge5: port 1(veth11) entered disabled state [ 662.690406][ T2967] veth9: left allmulticast mode [ 662.703197][ T2967] veth9: left promiscuous mode [ 662.708322][ T2967] bridge4: port 1(veth9) entered disabled state [ 662.723448][ T2967] veth7: left allmulticast mode [ 662.735407][ T2967] veth7: left promiscuous mode [ 662.742497][ T2967] bridge3: port 1(veth7) entered disabled state [ 662.768931][ T2967] veth5: left allmulticast mode [ 662.778886][ T2967] veth5: left promiscuous mode [ 662.788287][ T2967] bridge2: port 1(veth5) entered disabled state [ 662.802193][ T2967] veth3: left allmulticast mode [ 662.807118][ T2967] veth3: left promiscuous mode [ 662.818679][ T2967] bridge1: port 1(veth3) entered disabled state [ 662.848640][ T2967] hsr_slave_0: left promiscuous mode [ 662.871707][ T2967] hsr_slave_1: left promiscuous mode [ 662.890603][ T2967] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 662.898825][ T2967] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 662.916004][ T2967] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 662.926178][ T2967] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 662.939187][ T2967] bridge_slave_1: left allmulticast mode [ 662.945538][ T2967] bridge_slave_1: left promiscuous mode [ 662.956195][ T2967] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.982560][ T2967] bridge_slave_0: left allmulticast mode [ 662.988511][ T2967] bridge_slave_0: left promiscuous mode [ 663.000451][ T2967] bridge0: port 1(bridge_slave_0) entered disabled state [ 663.183560][ T2967] veth1_macvtap: left promiscuous mode [ 663.189196][ T2967] veth0_macvtap: left promiscuous mode [ 663.541797][T12302] overlayfs: failed to resolve './file0': -2 [ 663.988390][ T51] Bluetooth: hci1: command tx timeout [ 664.261146][ T5835] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 664.456763][ T5835] usb 2-1: Using ep0 maxpacket: 8 [ 664.468050][ T5835] usb 2-1: config 0 has no interfaces? [ 664.480579][ T5835] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 664.495240][ T5835] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.510111][ T2967] team0 (unregistering): Port device team_slave_1 removed [ 664.538044][ T5835] usb 2-1: Product: syz [ 664.543432][ T5835] usb 2-1: Manufacturer: syz [ 664.548165][ T5835] usb 2-1: SerialNumber: syz [ 664.574026][ T5835] usb 2-1: config 0 descriptor?? [ 664.635380][ T2967] team0 (unregistering): Port device team_slave_0 removed [ 664.730946][ T2967] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 664.828496][ T2967] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 665.359696][ T2967] bond0 (unregistering): Released all slaves [ 665.550316][T12313] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1892'. [ 665.597582][T12317] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 665.620715][ T5836] usb 2-1: USB disconnect, device number 22 [ 665.837435][T12243] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 665.887995][T12243] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 665.907897][T12243] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 665.946529][T12243] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 666.066925][ T51] Bluetooth: hci1: command tx timeout [ 666.133632][T12243] 8021q: adding VLAN 0 to HW filter on device bond0 [ 666.244059][T12243] 8021q: adding VLAN 0 to HW filter on device team0 [ 666.265774][ T2941] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.273063][ T2941] bridge0: port 1(bridge_slave_0) entered forwarding state [ 666.315631][ T3505] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.322881][ T3505] bridge0: port 2(bridge_slave_1) entered forwarding state [ 666.732017][T12354] overlayfs: failed to clone upperpath [ 666.786012][T12243] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 667.364603][T12243] veth0_vlan: entered promiscuous mode [ 667.418735][T12243] veth1_vlan: entered promiscuous mode [ 667.447065][T12386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1905'. [ 667.476005][T12386] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1905'. [ 667.552798][T12243] veth0_macvtap: entered promiscuous mode [ 667.585892][T12243] veth1_macvtap: entered promiscuous mode [ 667.662298][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 667.700328][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 667.718020][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 667.730063][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 667.740857][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 667.756523][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 667.768792][T12243] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 667.848678][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 667.863829][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 667.900042][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 667.910799][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 667.923049][T12243] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 667.947902][T12243] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.969074][T12243] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.986654][T12243] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.995936][T12243] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.140326][ T51] Bluetooth: hci1: command tx timeout [ 668.358038][ T2941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 668.371164][ T2941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 668.546824][ T3467] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 668.570284][ T3467] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 668.948250][T12427] loop6: detected capacity change from 0 to 256 [ 669.093008][T12430] FAT-fs (loop6): error, clusters badly computed (2 != 1) [ 669.100828][T12430] FAT-fs (loop6): Filesystem has been set read-only [ 669.398666][T12430] FAT-fs (loop6): error, fat_get_cluster: detected the cluster chain loop (i_pos 198) [ 669.408997][T12430] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 198) [ 669.690222][ T5838] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 669.795695][T12445] overlayfs: upper fs does not support file handles, falling back to index=off. [ 670.120196][ T5838] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 670.129322][ T5838] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.150600][ T5838] usb 2-1: Product: syz [ 670.154839][ T5838] usb 2-1: Manufacturer: syz [ 670.159468][ T5838] usb 2-1: SerialNumber: syz [ 670.196636][ T5838] usb 2-1: config 0 descriptor?? [ 670.364045][T12454] loop6: detected capacity change from 0 to 512 [ 670.382452][T12454] EXT4-fs: Ignoring removed bh option [ 670.411530][T12454] EXT4-fs error (device loop6): ext4_iget_extra_inode:4740: inode #11: comm syz.6.1915: corrupted in-inode xattr: bad e_name length [ 670.430220][T12454] EXT4-fs error (device loop6): ext4_orphan_get:1409: comm syz.6.1915: couldn't read orphan inode 11 (err -117) [ 670.444551][T12454] EXT4-fs (loop6): 1 truncate cleaned up [ 670.452579][T12454] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 670.574089][ T5838] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 670.684344][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 672.121830][ T5838] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -71 [ 672.160362][ T5838] usb 2-1: USB disconnect, device number 23 [ 672.940890][T12501] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 673.023636][T12510] overlayfs: failed to clone lowerpath [ 673.315659][T12514] loop6: detected capacity change from 0 to 8192 [ 673.327847][T12520] netlink: 'syz.2.1928': attribute type 1 has an invalid length. [ 673.339089][T12514] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 673.495397][T12520] 8021q: adding VLAN 0 to HW filter on device bond2 [ 673.614962][T12526] bond2: (slave geneve3): making interface the new active one [ 673.661980][T12526] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 674.285634][ T23] IPVS: starting estimator thread 0... [ 674.380981][T12552] IPVS: using max 17 ests per chain, 40800 per kthread [ 677.179198][T12639] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1963'. [ 677.874731][T12651] mount: server 127. not responding, timed out [ 680.939022][T12723] Bluetooth: (null): Invalid header checksum [ 686.004523][T12843] netlink: 'syz.2.2021': attribute type 12 has an invalid length. [ 686.146622][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.153304][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.905333][T12856] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2024'. [ 687.109112][T12856] 8021q: adding VLAN 0 to HW filter on device bond3 [ 695.769781][T13059] Bluetooth: MGMT ver 1.22 [ 696.945093][T13084] bridge_slave_0: left allmulticast mode [ 696.966602][T13084] bridge_slave_0: left promiscuous mode [ 696.984528][T13084] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.008298][T13084] bridge_slave_1: left allmulticast mode [ 697.020745][T13084] bridge_slave_1: left promiscuous mode [ 697.026592][T13084] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.052336][T13084] bond0: (slave bond_slave_0): Releasing backup interface [ 697.077879][T13084] bond0: (slave bond_slave_1): Releasing backup interface [ 697.142098][T13084] team0: Port device team_slave_0 removed [ 697.171690][T13084] team0: Port device team_slave_1 removed [ 697.178413][T13084] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 697.186353][T13084] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 697.195931][T13084] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 697.204781][T13084] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 697.240052][T13082] »»»»»»: renamed from vlan0 (while UP) [ 697.786779][T13099] kvm: emulating exchange as write [ 698.343668][T13116] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 698.621142][T13128] tipc: Enabling of bearer rejected, failed to enable media [ 698.698470][T13119] process 'newroot/424/bus/file0' started with executable stack [ 698.882033][T13138] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2089'. [ 700.749210][T13182] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2108'. [ 700.852047][T13187] syzkaller0: entered promiscuous mode [ 700.857765][T13187] syzkaller0: entered allmulticast mode [ 702.723806][T13215] loop6: detected capacity change from 0 to 512 [ 702.808211][T13215] Quota error (device loop6): dq_insert_tree: Quota tree root isn't allocated! [ 702.823759][T13215] Quota error (device loop6): qtree_write_dquot: Error -5 occurred while creating quota [ 702.835351][T13215] EXT4-fs error (device loop6): ext4_acquire_dquot:6953: comm syz.6.2118: Failed to acquire dquot type 0 [ 702.856774][T13215] Quota error (device loop6): dq_insert_tree: Quota tree root isn't allocated! [ 702.894665][T13215] Quota error (device loop6): qtree_write_dquot: Error -5 occurred while creating quota [ 702.905186][T13215] EXT4-fs error (device loop6): ext4_acquire_dquot:6953: comm syz.6.2118: Failed to acquire dquot type 0 [ 702.928943][T13215] EXT4-fs error (device loop6): ext4_validate_block_bitmap:439: comm syz.6.2118: bg 0: block 64: padding at end of block bitmap is not set [ 702.947885][T13215] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 702.972132][T13215] Quota error (device loop6): dq_insert_tree: Quota tree root isn't allocated! [ 702.989044][T13215] Quota error (device loop6): qtree_write_dquot: Error -5 occurred while creating quota [ 703.005251][T13215] EXT4-fs error (device loop6): ext4_acquire_dquot:6953: comm syz.6.2118: Failed to acquire dquot type 0 [ 703.031205][T13215] EXT4-fs (loop6): 1 orphan inode deleted [ 703.045957][T13215] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 703.069139][T13215] ext4 filesystem being mounted at /46/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 703.150216][T13215] Quota error (device loop6): dq_insert_tree: Quota tree root isn't allocated! [ 703.166097][T13215] Quota error (device loop6): qtree_write_dquot: Error -5 occurred while creating quota [ 703.180749][T13215] EXT4-fs error (device loop6): ext4_acquire_dquot:6953: comm syz.6.2118: Failed to acquire dquot type 0 [ 703.256554][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 703.447901][T13226] loop6: detected capacity change from 0 to 128 [ 703.642868][T13231] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2122'. [ 703.814164][T13237] file system registered [ 704.032133][T12243] ffs_data_put(): freeing [ 709.038909][T13329] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2150'. [ 709.297689][T13333] veth0_to_bond: left allmulticast mode [ 709.311257][T13333] veth0_to_bond: left promiscuous mode [ 709.318191][T13333] bridge3: port 1(veth0_to_bond) entered disabled state [ 709.347998][T13333] bond0: (slave bond_slave_0): Releasing backup interface [ 709.359658][T13333] bond_slave_0: left promiscuous mode [ 709.394040][T13333] bond0: (slave bond_slave_1): Releasing backup interface [ 709.408877][T13333] bond_slave_1: left promiscuous mode [ 709.475883][T13333] team0: Port device team_slave_0 removed [ 709.508369][T13333] team0: Port device team_slave_1 removed [ 709.515740][T13333] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 709.525414][T13333] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 709.534117][T13333] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 709.545488][T13333] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 709.546241][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880612a5c00: rx timeout, send abort [ 709.574280][T13333] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 709.583748][T13333] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 709.594007][T13333] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 709.603658][T13333] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 709.665492][T13333] team0: Port device vxlan0 removed [ 709.686137][T13333] veth7: left allmulticast mode [ 709.691396][T13333] veth7: left promiscuous mode [ 709.698320][T13333] bridge4: port 1(veth7) entered disabled state [ 709.717045][T13335] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2153'. [ 709.775758][T13336] team0: Mode changed to "broadcast" [ 714.717155][T13410] syzkaller0: entered promiscuous mode [ 714.723143][T13410] syzkaller0: entered allmulticast mode [ 714.949297][T13413] syzkaller0: entered promiscuous mode [ 715.078734][T13413] syzkaller0: entered allmulticast mode [ 716.381043][T13446] overlayfs: failed to clone upperpath [ 716.482710][T13445] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 718.125814][T13463] bridge_slave_0: left allmulticast mode [ 718.147276][T13463] bridge_slave_0: left promiscuous mode [ 718.179570][T13463] bridge0: port 1(bridge_slave_0) entered disabled state [ 718.525840][T13463] bridge_slave_1: left allmulticast mode [ 718.540082][T13463] bridge_slave_1: left promiscuous mode [ 718.546462][T13463] bridge0: port 2(bridge_slave_1) entered disabled state [ 718.613669][T13463] bond0: (slave bond_slave_0): Releasing backup interface [ 718.668278][T13463] bond_slave_0: left promiscuous mode [ 718.721957][T13463] bond0: (slave bond_slave_1): Releasing backup interface [ 718.757389][T13463] bond_slave_1: left promiscuous mode [ 718.904941][T13463] `: Port device team_slave_0 removed [ 719.015145][T13463] `: Port device team_slave_1 removed [ 719.036959][T13463] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 719.060789][T13463] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 719.090940][T13463] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 719.158907][T13463] veth9: left allmulticast mode [ 719.179909][T13463] veth9: left promiscuous mode [ 719.184972][T13463] bridge9: port 1(veth9) entered disabled state [ 719.223935][T13463] veth11: left allmulticast mode [ 719.239241][T13463] veth11: left promiscuous mode [ 719.251253][T13463] bridge10: port 1(veth11) entered disabled state [ 719.286429][T13463] veth13: left allmulticast mode [ 719.307951][T13463] veth13: left promiscuous mode [ 719.337204][T13463] bridge12: port 1(veth13) entered disabled state [ 719.365876][T13463] bond2: (slave geneve3): Releasing active interface [ 720.631234][T13509] syzkaller0: entered promiscuous mode [ 720.653006][T13509] syzkaller0: entered allmulticast mode [ 721.790642][T13516] team0: Mode changed to "broadcast" [ 723.738866][T13542] smc: net device lo applied user defined pnetid SYZ0 [ 725.654309][T13567] tipc: Enabling of bearer rejected, failed to enable media [ 726.081617][T13577] overlayfs: failed to clone upperpath [ 729.905952][T13612] syzkaller0: entered promiscuous mode [ 729.912142][T13612] syzkaller0: entered allmulticast mode [ 730.296186][T13614] syzkaller0: entered promiscuous mode [ 730.303130][T13614] syzkaller0: entered allmulticast mode [ 730.903842][T13619] syzkaller0: entered promiscuous mode [ 730.929747][T13619] syzkaller0: entered allmulticast mode [ 730.983566][T13623] syzkaller0: entered promiscuous mode [ 730.989211][T13623] syzkaller0: entered allmulticast mode [ 731.004404][T13623] af_packet: tpacket_rcv: packet too big, clamped from 64983 to 3952. macoff=96 [ 733.719600][T13643] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 739.529613][T13687] loop6: detected capacity change from 0 to 4096 [ 739.550748][T13687] EXT4-fs: inline encryption not supported [ 739.563366][T13687] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 739.575000][T13687] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a800e018, mo2=0002] [ 739.584955][T13687] System zones: 0-5 [ 739.606555][T13687] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 739.916644][ T28] audit: type=1800 audit(1785224401.409:27): pid=13687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2250" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 740.132852][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 744.120911][T13742] input: syz0 as /devices/virtual/input/input12 [ 747.589637][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.596314][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.833416][T13784] team0: Port device bridge0 added [ 749.037949][T13787] gretap1: left promiscuous mode [ 749.109171][T13796] syzkaller0: entered promiscuous mode [ 749.127089][T13796] syzkaller0: entered allmulticast mode [ 749.151000][T13796] tipc: Started in network mode [ 749.155948][T13796] tipc: Node identity 3a79a723fdde, cluster identity 4711 [ 749.176356][T13796] tipc: Enabled bearer , priority 0 [ 749.238645][T13795] tipc: Resetting bearer [ 749.306700][T13795] tipc: Disabling bearer [ 751.364924][T13813] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 752.547489][T13859] tipc: Enabling of bearer rejected, failed to enable media [ 753.670176][T13880] trusted_key: encrypted_key: insufficient parameters specified [ 753.996104][T13878] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 754.028556][T13878] kvm: pic: single mode not supported [ 754.028968][T13878] kvm: pic: non byte read [ 754.041527][T13878] kvm: pic: level sensitive irq not supported [ 754.041717][T13878] kvm: pic: non byte read [ 754.053725][T13878] kvm: pic: level sensitive irq not supported [ 754.053811][T13878] kvm: pic: non byte read [ 754.067925][T13878] kvm: pic: level sensitive irq not supported [ 754.068013][T13878] kvm: pic: non byte read [ 754.082609][T13878] kvm: pic: level sensitive irq not supported [ 754.082754][T13878] kvm: pic: non byte read [ 754.094923][T13878] kvm: pic: level sensitive irq not supported [ 754.095137][T13878] kvm: pic: non byte read [ 754.106592][T13878] kvm: pic: level sensitive irq not supported [ 754.106735][T13878] kvm: pic: non byte read [ 754.505928][T13888] syzkaller0: entered promiscuous mode [ 754.511999][T13888] syzkaller0: entered allmulticast mode [ 756.392802][T13920] loop6: detected capacity change from 0 to 256 [ 756.409365][T13920] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 756.425976][T13920] exFAT-fs (loop6): Medium has reported failures. Some data may be lost. [ 756.448802][T13920] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 756.666433][T13925] wlan0 speed is unknown, defaulting to 1000 [ 758.645907][T13939] loop6: detected capacity change from 0 to 256 [ 759.046631][T13953] FAT-fs (loop6): unable to read block(17179869180) for building NFS inode [ 759.893238][T13962] loop6: detected capacity change from 0 to 512 [ 759.903136][T13962] EXT4-fs: Ignoring removed nomblk_io_submit option [ 759.958300][T13962] EXT4-fs (loop6): mounting ext3 file system using the ext4 subsystem [ 760.076163][T13962] EXT4-fs (loop6): 1 truncate cleaned up [ 760.087488][T13962] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 760.267298][T13962] EXT4-fs error (device loop6): __ext4_get_inode_loc:4497: comm syz.6.2314: Invalid inode table block 3757049630 in block_group 0 [ 760.336319][T13962] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 760.361841][T13962] EXT4-fs error (device loop6): ext4_dirty_inode:6144: inode #15: comm syz.6.2314: mark_inode_dirty error [ 761.500340][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 769.417181][T14058] tipc: Enabling of bearer rejected, failed to enable media [ 769.702217][T14061] wlan0 speed is unknown, defaulting to 1000 [ 769.795611][T14072] vlan2: entered promiscuous mode [ 769.801778][T14072] bond0: entered promiscuous mode [ 770.242954][T14076] tmpfs: Unknown parameter 'smackfstransmute' [ 770.254457][T14081] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2342'. [ 770.318282][T14076] UDC core: g1: couldn't find an available UDC or it's busy [ 770.661448][T14090] syzkaller0: entered promiscuous mode [ 770.667526][T14090] syzkaller0: entered allmulticast mode [ 772.312893][T14093] loop6: detected capacity change from 0 to 1024 [ 773.778725][T14104] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2349'. [ 776.088199][T14118] syzkaller0: entered promiscuous mode [ 776.100470][T14118] syzkaller0: entered allmulticast mode [ 776.155260][T14125] syzkaller0: entered promiscuous mode [ 776.169692][T14125] syzkaller0: entered allmulticast mode [ 777.018344][T14139] syzkaller0: entered promiscuous mode [ 777.215471][T14139] syzkaller0: entered allmulticast mode [ 781.144282][T14159] loop6: detected capacity change from 0 to 512 [ 781.147665][T14156] tipc: Enabling of bearer rejected, failed to enable media [ 781.163972][T14159] EXT4-fs: Ignoring removed mblk_io_submit option [ 781.259527][T14159] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 781.278121][T14159] ext4 filesystem being mounted at /119/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 781.407942][T14159] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 781.444412][T14159] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 33 with error 28 [ 781.497785][T14159] EXT4-fs (loop6): This should not happen!! Data will be lost [ 781.497785][T14159] [ 781.519772][T14159] EXT4-fs (loop6): Total free blocks count 0 [ 781.527951][T14159] EXT4-fs (loop6): Free/Dirty block details [ 781.548387][T14159] EXT4-fs (loop6): free_blocks=65280 [ 781.558036][T14159] EXT4-fs (loop6): dirty_blocks=33 [ 781.565072][T14159] EXT4-fs (loop6): Block reservation details [ 781.575365][T14159] EXT4-fs (loop6): i_reserved_data_blocks=33 [ 781.846011][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 786.310219][T14215] Bluetooth: hci1: command 0x0406 tx timeout [ 789.229061][T14257] loop6: detected capacity change from 0 to 32768 [ 789.246093][T14257] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop6 scanned by syz.6.2384 (14257) [ 789.278804][T14257] BTRFS info (device loop6): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 789.333460][T14257] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm [ 789.352994][T14257] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 789.379523][T14257] BTRFS info (device loop6): use zstd compression, level 3 [ 789.397812][T14257] BTRFS info (device loop6): using free space tree [ 789.570655][T14257] BTRFS info (device loop6): enabling ssd optimizations [ 789.577699][T14257] BTRFS info (device loop6): auto enabling async discard [ 790.806703][ T28] audit: type=1800 audit(1785224452.299:28): pid=14257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2384" name="bus" dev="loop6" ino=263 res=0 errno=0 [ 790.872742][ T28] audit: type=1800 audit(1785224452.339:29): pid=14257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2384" name="bus" dev="loop6" ino=263 res=0 errno=0 [ 791.409152][T12243] BTRFS info (device loop6): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 794.798873][T14308] syzkaller0: entered promiscuous mode [ 794.821355][T14308] syzkaller0: entered allmulticast mode [ 798.149476][T14326] syzkaller0: entered promiscuous mode [ 798.200863][T14326] syzkaller0: entered allmulticast mode [ 798.462310][T14332] tipc: Enabled bearer , priority 0 [ 798.478288][T14332] syzkaller0: entered promiscuous mode [ 798.489322][T14332] syzkaller0: entered allmulticast mode [ 798.563243][T14332] tipc: Resetting bearer [ 798.588270][T14331] tipc: Resetting bearer [ 798.619739][T14331] tipc: Disabling bearer [ 802.556545][T14360] syzkaller0: entered promiscuous mode [ 802.562413][T14360] syzkaller0: entered allmulticast mode [ 806.436314][T14379] trusted_key: syz.1.2413 sent an empty control message without MSG_MORE. [ 807.148683][T14381] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2416'. [ 809.091340][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.098450][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 823.600866][T14481] SET target dimension over the limit! [ 824.755405][T14493] syzkaller0: entered promiscuous mode [ 824.770053][T14493] syzkaller0: entered allmulticast mode [ 827.605536][T14509] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 827.614257][T14509] IPv6: NLM_F_CREATE should be set when creating new route [ 831.055073][T14509] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 831.064346][T14509] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 831.078712][T14509] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 831.089431][T14509] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 832.519301][T14528] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2454'. [ 834.374835][T14541] ipvlan2: entered promiscuous mode [ 834.387546][T14541] ipvlan2: entered allmulticast mode [ 834.393650][T14541] bridge0: entered allmulticast mode [ 834.399173][T14541] team0: Device ipvlan2 failed to enter team mode [ 834.406965][T14541] team0: Device ipvlan2 failed to enter team mode [ 840.819295][T14609] syzkaller0: entered promiscuous mode [ 840.825309][T14609] syzkaller0: entered allmulticast mode [ 846.184449][T14629] syzkaller0: entered promiscuous mode [ 846.190109][T14629] syzkaller0: entered allmulticast mode [ 849.879430][T14681] loop6: detected capacity change from 0 to 512 [ 849.961445][T14681] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 850.006288][T14681] ext4 filesystem being mounted at /152/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 850.158047][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 858.071510][T14215] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 858.106080][T14215] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 858.122156][T14215] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 858.162732][T14215] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 858.181162][T14215] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 858.188669][T14215] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 858.485518][T14215] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 858.501528][T14215] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 858.531656][T14215] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 858.542221][T14215] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 858.559754][T14215] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 858.576805][T14215] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 858.862083][T14732] wlan0 speed is unknown, defaulting to 1000 [ 858.908846][ T9357] batadv_slave_0: left promiscuous mode [ 859.210586][T14737] wlan0 speed is unknown, defaulting to 1000 [ 859.838424][T14732] chnl_net:caif_netlink_parms(): no params data found [ 860.149436][T14755] loop6: detected capacity change from 0 to 128 [ 860.301778][T14215] Bluetooth: hci4: command tx timeout [ 860.700142][T14215] Bluetooth: hci5: command tx timeout [ 860.970647][T14732] bridge0: port 1(bridge_slave_0) entered blocking state [ 861.022679][T14732] bridge0: port 1(bridge_slave_0) entered disabled state [ 861.082333][T14732] bridge_slave_0: entered allmulticast mode [ 861.125365][T14732] bridge_slave_0: entered promiscuous mode [ 861.155296][T14732] bridge0: port 2(bridge_slave_1) entered blocking state [ 861.162918][T14732] bridge0: port 2(bridge_slave_1) entered disabled state [ 861.179364][T14732] bridge_slave_1: entered allmulticast mode [ 861.186546][T14732] bridge_slave_1: entered promiscuous mode [ 861.460639][T14737] chnl_net:caif_netlink_parms(): no params data found [ 861.478966][T14732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 861.518882][T14732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 862.476840][T14215] Bluetooth: hci4: command tx timeout [ 862.496184][T14732] team0: Port device team_slave_0 added [ 862.780644][T14215] Bluetooth: hci5: command tx timeout [ 864.054175][T14732] team0: Port device team_slave_1 added [ 864.086611][T14737] bridge0: port 1(bridge_slave_0) entered blocking state [ 864.095496][T14737] bridge0: port 1(bridge_slave_0) entered disabled state [ 864.120310][T14737] bridge_slave_0: entered allmulticast mode [ 864.127968][T14737] bridge_slave_0: entered promiscuous mode [ 864.182044][T14737] bridge0: port 2(bridge_slave_1) entered blocking state [ 864.189252][T14737] bridge0: port 2(bridge_slave_1) entered disabled state [ 864.212241][T14737] bridge_slave_1: entered allmulticast mode [ 864.228429][T14737] bridge_slave_1: entered promiscuous mode [ 864.373821][T14732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 864.388236][T14732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 864.440007][T14732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 864.458593][T14732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 864.479807][T14732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 864.524067][T14732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 864.546366][T14215] Bluetooth: hci4: command tx timeout [ 864.558660][T14737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 864.639694][T14802] syzkaller0: entered promiscuous mode [ 864.645542][T14802] syzkaller0: entered allmulticast mode [ 864.663834][T14737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 864.859970][T14215] Bluetooth: hci5: command tx timeout [ 866.620202][T14215] Bluetooth: hci4: command tx timeout [ 866.944990][T14215] Bluetooth: hci5: command tx timeout [ 869.879685][T14737] team0: Port device team_slave_0 added [ 870.404055][T14737] team0: Port device team_slave_1 added [ 870.563963][T14732] hsr_slave_0: entered promiscuous mode [ 870.581722][T14732] hsr_slave_1: entered promiscuous mode [ 870.590539][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.596924][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.609090][T14732] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 870.628028][T14732] Cannot create hsr debugfs directory [ 873.045462][ T3467] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 873.261672][T14737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 873.268688][T14737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 873.310047][T14737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 873.388899][ T3467] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 873.424459][T14737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 873.440123][T14737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 873.499855][T14737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 873.626724][ T3467] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 873.837891][ T3467] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 873.887902][T14737] hsr_slave_0: entered promiscuous mode [ 873.895858][T14737] hsr_slave_1: entered promiscuous mode [ 873.903105][T14737] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 873.916614][T14737] Cannot create hsr debugfs directory [ 874.378050][ T3467] tipc: Left network mode [ 874.395047][T14732] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 874.426267][T14732] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 874.527459][T14732] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 874.537374][T14732] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 877.724778][T14737] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 878.158377][T14737] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 879.270556][T14737] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 879.286921][T14737] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 879.701809][T14732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 879.885218][T14732] 8021q: adding VLAN 0 to HW filter on device team0 [ 879.931164][ T3467] IPVS: stopping master sync thread 7106 ... [ 880.060451][ T2982] bridge0: port 1(bridge_slave_0) entered blocking state [ 880.067645][ T2982] bridge0: port 1(bridge_slave_0) entered forwarding state [ 880.174418][ T2967] bridge0: port 2(bridge_slave_1) entered blocking state [ 880.181661][ T2967] bridge0: port 2(bridge_slave_1) entered forwarding state [ 880.271480][T14877] loop6: detected capacity change from 0 to 16 [ 880.302600][T14877] erofs: (device loop6): erofs_read_inode: unsupported chunk format ffff of nid 36 [ 880.463954][ T3467] veth7: left allmulticast mode [ 880.468880][ T3467] veth7: left promiscuous mode [ 880.510981][ T3467] bridge4: port 1(veth7) entered disabled state [ 880.589466][ T3467] veth5: left allmulticast mode [ 880.610093][ T3467] veth5: left promiscuous mode [ 880.623256][ T3467] bridge3: port 1(veth5) entered disabled state [ 880.681904][ T3467] veth0_to_bond: left allmulticast mode [ 880.687550][ T3467] veth0_to_bond: left promiscuous mode [ 880.720263][ T3467] bridge2: port 1(veth0_to_bond) entered disabled state [ 880.796374][ T3467] hsr_slave_0: left promiscuous mode [ 880.821206][ T3467] hsr_slave_1: left promiscuous mode [ 880.831645][ T3467] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 880.869612][ T3467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 880.901590][ T3467] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 880.922655][ T3467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 880.947260][ T3467] vlan2: left promiscuous mode [ 880.972724][ T3467] bond0: left promiscuous mode [ 880.996228][ T3467] bond_slave_0: left promiscuous mode [ 881.059112][ T3467] bond_slave_1: left promiscuous mode [ 881.077919][ T3467] bridge0: port 3(vlan2) entered disabled state [ 881.375269][ T3467] bridge_slave_1: left allmulticast mode [ 881.471331][ T3467] bridge_slave_1: left promiscuous mode [ 881.559362][ T3467] bridge0: port 2(bridge_slave_1) entered disabled state [ 881.758044][ T3467] bridge_slave_0: left allmulticast mode [ 881.769151][ T3467] bridge0: port 1(bridge_slave_0) entered disabled state [ 881.889367][ T3467] geneve1: left promiscuous mode [ 881.906106][ T3467] veth1_macvtap: left promiscuous mode [ 881.913550][ T3467] veth0_macvtap: left promiscuous mode [ 881.919181][ T3467] veth1_vlan: left promiscuous mode [ 881.925352][ T3467] veth0_vlan: left promiscuous mode [ 882.385617][ T3467] team0 (unregistering): Port device macvlan2 removed [ 882.519301][ T3467] bond1 (unregistering): Released all slaves [ 882.546538][ T3467] pim6reg (unregistering): left allmulticast mode [ 882.569693][ T3467] pimreg (unregistering): left allmulticast mode [ 883.294825][ T3467] team0 (unregistering): Port device team_slave_1 removed [ 883.358933][ T3467] team0 (unregistering): Port device team_slave_0 removed [ 883.422471][ T3467] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 883.431430][ T3467] bond_slave_1 (unregistering): left allmulticast mode [ 883.494385][ T3467] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 883.508720][ T3467] bond_slave_0 (unregistering): left allmulticast mode [ 884.028534][ T3467] bond0 (unregistering): Released all slaves [ 884.167512][ T3467] lo (unregistering): left allmulticast mode [ 884.277443][T14737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 884.353444][T14737] 8021q: adding VLAN 0 to HW filter on device team0 [ 884.370671][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.377858][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 884.429284][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.436551][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 884.713284][ T3467] IPVS: stop unused estimator thread 0... [ 884.817648][T14732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 885.114732][T14737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 885.411493][T14732] veth0_vlan: entered promiscuous mode [ 885.436881][T14732] veth1_vlan: entered promiscuous mode [ 885.496747][T14732] veth0_macvtap: entered promiscuous mode [ 885.526541][T14732] veth1_macvtap: entered promiscuous mode [ 885.574506][T14732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 885.604860][T14732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 885.631892][T14732] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.645208][T14732] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.654614][T14732] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.664887][T14732] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.847300][T14737] veth0_vlan: entered promiscuous mode [ 885.850830][ T3467] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 885.868980][ T3467] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 885.878210][T14737] veth1_vlan: entered promiscuous mode [ 886.009504][T14737] veth0_macvtap: entered promiscuous mode [ 886.031480][ T2941] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 886.039358][ T2941] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 886.045826][T14737] veth1_macvtap: entered promiscuous mode [ 886.102464][T14737] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 886.126323][T14737] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 886.162300][T14737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 886.200661][T14737] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 886.237288][T14737] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 886.271603][T14737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 886.293897][T14737] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 886.318396][T14737] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 886.342087][T14737] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 886.360367][T14737] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 886.566019][ T2941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 886.612763][ T2941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 886.640835][T14951] binder: BINDER_SET_CONTEXT_MGR already set [ 889.160200][T14951] binder: 14949:14951 ioctl 4018620d 200000004a80 returned -16 [ 889.246550][ T2982] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 889.272281][ T2982] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 893.044181][T15000] syzkaller0: entered promiscuous mode [ 893.062154][T15000] syzkaller0: entered allmulticast mode [ 895.134004][T15026] loop6: detected capacity change from 0 to 512 [ 895.276740][T15026] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 895.454371][T15034] netlink: 232 bytes leftover after parsing attributes in process `syz.7.2534'. [ 895.690279][T15026] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 896.010513][T15026] EXT4-fs error (device loop6): ext4_read_block_bitmap_nowait:478: comm syz.6.2536: Invalid block bitmap block 0 in block_group 0 [ 897.135277][T15026] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 897.227795][T15026] EXT4-fs error (device loop6): ext4_clear_blocks:883: inode #11: comm syz.6.2536: attempt to clear invalid blocks 983261 len 1 [ 897.310200][T15026] EXT4-fs error (device loop6): __ext4_get_inode_loc:4497: comm syz.6.2536: Invalid inode table block 0 in block_group 0 [ 897.376560][T15026] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 897.430461][T15026] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 897.504256][T15026] EXT4-fs error (device loop6): __ext4_get_inode_loc:4497: comm syz.6.2536: Invalid inode table block 0 in block_group 0 [ 898.681070][T15026] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 898.786816][T15026] EXT4-fs error (device loop6): ext4_truncate:4302: inode #11: comm syz.6.2536: mark_inode_dirty error [ 899.138415][T15026] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 899.186692][T15026] EXT4-fs error (device loop6): __ext4_get_inode_loc:4497: comm syz.6.2536: Invalid inode table block 0 in block_group 0 [ 899.247564][T15026] EXT4-fs (loop6): 1 truncate cleaned up [ 899.303760][T15026] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 899.492727][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 900.793315][T15071] tc action pedit offset 132 out of bounds [ 900.799974][T15071] tc action pedit offset 132 out of bounds [ 900.805823][T15071] tc action pedit offset 132 out of bounds [ 900.811710][T15071] tc action pedit offset 132 out of bounds [ 900.817560][T15071] tc action pedit offset 132 out of bounds [ 900.823518][T15071] tc action pedit offset 132 out of bounds [ 900.829361][T15071] tc action pedit offset 132 out of bounds [ 900.835289][T15071] tc action pedit offset 132 out of bounds [ 900.841165][T15071] tc action pedit offset 132 out of bounds [ 900.847009][T15071] tc action pedit offset 132 out of bounds [ 900.852918][T15071] 0: reclassify loop, rule prio 0, protocol 800 [ 904.560316][T14215] Bluetooth: hci5: command tx timeout [ 905.017482][T15108] CIFS: Unable to determine destination address [ 905.622173][T15109] loop6: detected capacity change from 0 to 64 [ 905.997353][T15111] syzkaller0: entered promiscuous mode [ 906.021574][T15111] syzkaller0: entered allmulticast mode [ 907.567202][T15111] simple: bas](0ƒèa½ÀÞ£ª9oÏ‚>âüÑQ/ic_0 [ 907.568037][T15118] tipc: Enabling of bearer rejected, failed to enable media [ 908.490289][T15137] input: syz0 as /devices/virtual/input/input13 [ 909.248060][T15142] loop6: detected capacity change from 0 to 32768 [ 909.357937][T15142] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 910.382330][T15142] XFS (loop6): Ending clean mount [ 910.397189][T15142] XFS (loop6): Quotacheck needed: Please wait. [ 912.252402][T15142] XFS (loop6): Quotacheck: Done. [ 912.349435][T12243] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 922.103421][T15214] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2568'. [ 929.173753][T15251] loop7: detected capacity change from 0 to 512 [ 929.237034][T15251] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 929.358226][T15251] EXT4-fs error (device loop7): ext4_free_branches:1030: inode #11: comm syz.7.2574: invalid indirect mapped block 256 (level 2) [ 929.477136][T15251] EXT4-fs (loop7): 2 truncates cleaned up [ 929.484484][T15251] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 930.357857][ T1088] EXT4-fs error (device loop7): ext4_validate_block_bitmap:430: comm kworker/u4:6: bg 0: block 5: invalid block bitmap [ 930.464956][ T1088] EXT4-fs (loop7): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 6 with error 28 [ 930.560081][ T1088] EXT4-fs (loop7): This should not happen!! Data will be lost [ 930.560081][ T1088] [ 930.602196][ T1088] EXT4-fs (loop7): Total free blocks count 0 [ 930.608259][ T1088] EXT4-fs (loop7): Free/Dirty block details [ 930.690443][ T1088] EXT4-fs (loop7): free_blocks=0 [ 930.695735][ T1088] EXT4-fs (loop7): dirty_blocks=16002 [ 930.771221][ T1088] EXT4-fs (loop7): Block reservation details [ 930.796790][ T1088] EXT4-fs (loop7): i_reserved_data_blocks=16002 [ 930.869349][T15265] loop8: detected capacity change from 0 to 128 [ 931.624634][T15257] EXT4-fs (loop7): Delayed block allocation failed for inode 18 at logical offset 8 with max blocks 2048 with error 28 [ 931.741805][T15265] EXT4-fs (loop8): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 931.757251][T15265] ext4 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 931.772395][T15265] EXT4-fs (loop8): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 931.909325][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.919633][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 934.756567][T14732] EXT4-fs: 7 callbacks suppressed [ 934.756584][T14732] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 935.851122][T15314] syzkaller0: entered promiscuous mode [ 935.856692][T15314] syzkaller0: entered allmulticast mode [ 936.379059][T15331] loop6: detected capacity change from 0 to 1024 [ 937.130686][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.172979][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.250823][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.291645][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.411404][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.440094][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.496162][T15310] loop8: detected capacity change from 0 to 40427 [ 937.515750][T15310] F2FS-fs (loop8): Corrupted extension count (64 + 1 > 64) [ 937.517252][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 937.528136][T15310] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 937.813680][T15310] F2FS-fs (loop8): Image doesn't support compression [ 938.811617][T15310] F2FS-fs (loop8): Image doesn't support compression [ 938.818426][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 938.856130][T15310] F2FS-fs (loop8): invalid crc value [ 938.910500][T15343] hfsplus: request for non-existent node 33423360 in B*Tree [ 938.973627][T15343] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.088066][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.149096][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.310453][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.312628][T15310] F2FS-fs (loop8): Start checkpoint disabled! [ 939.350568][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.370550][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.412296][T15310] F2FS-fs (loop8): Try to recover 1th superblock, ret: 0 [ 939.424994][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.433947][T15310] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e6 [ 939.814331][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 939.943151][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.095319][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.118359][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.156860][T15343] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.181062][T15343] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.220339][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.227707][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.265294][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.280871][T15331] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.341469][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 940.359923][T15334] hfsplus: request for non-existent node 33423360 in B*Tree [ 941.420436][ T51] Bluetooth: hci5: command 0x0405 tx timeout [ 942.274324][T15372] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2600'. [ 942.358406][T15372] 8021q: adding VLAN 0 to HW filter on device bond2 [ 942.362748][T15369] 8021q: adding VLAN 0 to HW filter on device team0 [ 942.364860][T15369] bond2: (slave team0): Enslaving as an active interface with an up link [ 942.404055][T15369] bond2: entered promiscuous mode [ 942.404082][T15369] team0: entered promiscuous mode [ 942.404288][T15369] bond2: entered allmulticast mode [ 942.404303][T15369] team0: entered allmulticast mode [ 952.230975][T15424] 0: reclassify loop, rule prio 0, protocol 700 [ 954.008436][T15451] loop6: detected capacity change from 0 to 32768 [ 954.027421][T15451] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.2612 (15451) [ 954.045143][T15451] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 954.055365][T15451] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 954.064064][T15451] BTRFS info (device loop6): metadata ratio 0 [ 954.070195][T15451] BTRFS info (device loop6): turning on sync discard [ 954.076919][T15451] BTRFS info (device loop6): using free space tree [ 954.850335][T15451] BTRFS info (device loop6): enabling ssd optimizations [ 956.319929][T14215] Bluetooth: hci5: command 0x0405 tx timeout [ 957.736400][T12243] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 960.396936][T15526] loop6: detected capacity change from 0 to 512 [ 960.425719][T15526] EXT4-fs: Ignoring removed orlov option [ 960.510780][T15526] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 960.657241][T15526] EXT4-fs error (device loop6): ext4_ext_check_inode:532: inode #16: comm syz.6.2622: pblk 0 bad header/extent: invalid magic - magic 0, entries 0, max 28(0), depth 0(0) [ 960.745594][T15532] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 961.054373][T15526] EXT4-fs error (device loop6): ext4_orphan_get:1409: comm syz.6.2622: couldn't read orphan inode 16 (err -117) [ 961.516395][T15526] EXT4-fs (loop6): 1 orphan inode deleted [ 961.881351][T15526] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 965.278971][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 971.569064][T15606] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 972.473908][T15621] loop6: detected capacity change from 0 to 512 [ 973.322740][T15621] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 973.444617][T15621] ext4 filesystem being mounted at /195/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 974.307181][T12243] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 981.350834][T15697] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 983.285493][T15708] loop8: detected capacity change from 0 to 128 [ 983.634711][T15708] FAT-fs (loop8): Directory bread(block 32) failed [ 983.659872][T15708] FAT-fs (loop8): Directory bread(block 33) failed [ 983.677806][T15708] FAT-fs (loop8): Directory bread(block 34) failed [ 983.767460][T15708] FAT-fs (loop8): Directory bread(block 35) failed [ 983.999689][T15708] FAT-fs (loop8): Directory bread(block 36) failed [ 984.300547][T15708] FAT-fs (loop8): Directory bread(block 37) failed [ 984.307262][T15708] FAT-fs (loop8): Directory bread(block 38) failed [ 984.339232][T15708] FAT-fs (loop8): Directory bread(block 39) failed [ 984.376577][T15708] FAT-fs (loop8): Directory bread(block 40) failed [ 984.424983][T15708] FAT-fs (loop8): Directory bread(block 41) failed [ 985.980643][T15705] Bluetooth: hci4: command 0x0406 tx timeout [ 985.986854][T15705] Bluetooth: hci5: command 0x0405 tx timeout [ 993.421413][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.427885][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 996.727499][T15778] overlayfs: failed to clone lowerpath [ 996.889010][T15782] loop7: detected capacity change from 0 to 2048 [ 998.547121][T15782] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 999.623374][T14732] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 999.721928][T15795] loop8: detected capacity change from 0 to 256 [ 999.849647][T15795] exFAT-fs (loop8): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 1010.250033][T15834] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2677'. [ 1011.098107][T15842] loop7: detected capacity change from 0 to 128 [ 1011.211505][T15842] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1011.258017][T15842] ext4 filesystem being mounted at /33/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1013.947483][T15842] syz.7.2680 (pid 15842) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 1014.275225][T15852] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 1014.703970][T15857] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 1015.628055][T14732] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1017.791805][T15870] loop7: detected capacity change from 0 to 256 [ 1031.961309][T15924] syzkaller0: entered promiscuous mode [ 1031.970353][T15924] syzkaller0: entered allmulticast mode [ 1032.186637][T15924] tipc: Started in network mode [ 1032.760487][T15924] tipc: Node identity 9276f264c142, cluster identity 4711 [ 1032.785159][T15924] tipc: Enabled bearer , priority 0 [ 1032.890872][T15922] tipc: Resetting bearer [ 1033.910510][T15922] tipc: Disabling bearer [ 1034.195766][ T9] tipc: Node number set to 1395978852 [ 1035.858505][T15940] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1041.397656][T15969] syzkaller0: entered promiscuous mode [ 1041.403500][T15969] syzkaller0: entered allmulticast mode [ 1041.427584][T15969] tipc: Started in network mode [ 1041.447624][T15969] tipc: Node identity 2a90fafee0b2, cluster identity 4711 [ 1041.519237][T15969] tipc: Enabled bearer , priority 0 [ 1041.574741][T15969] tipc: Resetting bearer [ 1041.705036][T15968] tipc: Resetting bearer [ 1042.207963][T15968] tipc: Disabling bearer [ 1042.429091][T15978] xt_CT: No such helper "pptp" [ 1048.719144][T16009] syzkaller0: entered promiscuous mode [ 1048.737595][T16009] syzkaller0: entered allmulticast mode [ 1048.790691][T16009] tipc: Enabled bearer , priority 0 [ 1048.857706][T16009] tipc: Resetting bearer [ 1048.884452][T16008] tipc: Resetting bearer [ 1048.937019][T16008] tipc: Disabling bearer [ 1049.900346][T16017] xt_CT: No such helper "pptp" [ 1052.433315][T16037] loop7: detected capacity change from 0 to 32768 [ 1052.466559][T16037] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz.7.2724 (16037) [ 1052.558289][T16037] BTRFS info (device loop7): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1052.568851][T16037] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm [ 1052.577663][T16037] BTRFS info (device loop7): setting nodatacow, compression disabled [ 1052.585846][T16037] BTRFS info (device loop7): max_inline at 0 [ 1052.591862][T16037] BTRFS info (device loop7): using free space tree [ 1053.231820][T16037] BTRFS info (device loop7): auto enabling async discard [ 1055.306725][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1055.324759][T14215] Bluetooth: hci4: command 0x0406 tx timeout [ 1055.338933][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.698864][T14732] BTRFS info (device loop7): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1061.460375][T16088] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1062.645805][T16092] 9pnet_fd: Insufficient options for proto=fd [ 1065.578182][T16106] wlan0 speed is unknown, defaulting to 1000 [ 1079.695114][T16167] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2753'. [ 1082.513401][T16173] loop8: detected capacity change from 0 to 32768 [ 1083.581145][T16173] XFS (loop8): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1084.066156][T16173] XFS (loop8): Ending clean mount [ 1084.085930][T16173] XFS (loop8): Quotacheck needed: Please wait. [ 1084.633917][T16173] XFS (loop8): Quotacheck: Done. [ 1085.275335][T14737] XFS (loop8): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1087.568424][T16206] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2760'. [ 1089.583713][T16218] loop6: detected capacity change from 0 to 64 [ 1091.147624][T16218] syz.6.2769: attempt to access beyond end of device [ 1091.147624][T16218] loop6: rw=0, sector=1024, nr_sectors = 2 limit=64 [ 1091.161416][T16218] Buffer I/O error on dev loop6, logical block 512, async page read [ 1091.169479][T16218] syz.6.2769: attempt to access beyond end of device [ 1091.169479][T16218] loop6: rw=0, sector=113152, nr_sectors = 2 limit=64 [ 1091.182838][T16218] Buffer I/O error on dev loop6, logical block 56576, async page read [ 1091.943515][T16242] xt_SECMARK: invalid mode: 2 [ 1096.503148][T16258] loop7: detected capacity change from 0 to 32768 [ 1096.586275][T16258] XFS (loop7): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1096.773868][T16258] XFS (loop7): Ending clean mount [ 1096.829985][T16258] XFS (loop7): Quotacheck needed: Please wait. [ 1097.607040][T16258] XFS (loop7): Quotacheck: Done. [ 1098.222884][T14732] XFS (loop7): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1098.342724][T16283] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2767'. [ 1099.659949][T14215] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 1099.667048][ T51] Bluetooth: hci0: command 0x1003 tx timeout [ 1099.825818][T16290] loop7: detected capacity change from 0 to 1024 [ 1105.044162][T16312] loop7: detected capacity change from 0 to 1024 [ 1109.733860][T16346] loop6: detected capacity change from 0 to 2048 [ 1109.839444][T16346] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1113.751505][T16365] loop6: detected capacity change from 0 to 131072 [ 1113.793392][T16365] F2FS-fs (loop6): invalid crc value [ 1113.815944][T16365] F2FS-fs (loop6): Found nat_bits in checkpoint [ 1113.882498][T16377] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2780'. [ 1114.443994][T16365] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 1114.787355][T16383] loop8: detected capacity change from 0 to 512 [ 1115.093795][T16383] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 1115.104995][T16387] F2FS-fs (loop6): sanity_check_inode: inode (ino=4) has corrupted i_extra_isize: 65535, max: 36 [ 1116.392877][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.399334][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.506821][T16383] EXT4-fs (loop8): 1 truncate cleaned up [ 1116.561237][T16383] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1118.668465][T14737] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1122.429176][T16453] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1122.439107][T16453] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1122.878221][T16455] loop8: detected capacity change from 0 to 4096 [ 1123.321583][T16450] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2790'. [ 1123.515006][T16455] ntfs3: loop8: failed to replay log file. Can't mount rw! [ 1127.082948][T16468] can: request_module (can-proto-3) failed. [ 1128.225383][T16488] fuse: Unknown parameter '0xffffffffffffffff' [ 1134.312513][T16515] loop8: detected capacity change from 0 to 2048 [ 1140.771459][T16535] loop6: detected capacity change from 0 to 8 [ 1140.778327][T16535] squashfs: Unknown parameter 'fowner' [ 1140.843867][T16437] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1144.261145][T14215] Bluetooth: hci5: unexpected event for opcode 0x0c26 [ 1146.242447][T16557] netlink: 'syz.7.2816': attribute type 21 has an invalid length. [ 1146.250806][T16557] netlink: 132 bytes leftover after parsing attributes in process `syz.7.2816'. [ 1146.800049][ T9] IPVS: starting estimator thread 0... [ 1148.443286][T16558] IPVS: using max 16 ests per chain, 38400 per kthread [ 1152.551338][T14215] Bluetooth: hci5: command 0x0405 tx timeout [ 1156.516544][T16622] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2836'. [ 1157.399865][T16622] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1158.266507][T16615] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1159.079536][T16633] netlink: 'syz.6.2838': attribute type 10 has an invalid length. [ 1159.106142][T16633] netdevsim netdevsim6 netdevsim0: entered promiscuous mode [ 1159.117534][T16633] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 1159.128233][T16633] team0: Port device netdevsim0 added [ 1159.138770][T16637] netlink: 'syz.6.2838': attribute type 10 has an invalid length. [ 1159.149145][T16637] netdevsim netdevsim6 netdevsim0: left promiscuous mode [ 1159.156994][T16637] netdevsim netdevsim6 netdevsim0: left allmulticast mode [ 1159.206693][T16637] team0: Port device netdevsim0 removed [ 1159.243434][T16637] netdevsim netdevsim6 netdevsim0: entered promiscuous mode [ 1159.256741][T16637] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1159.512778][ T5863] IPVS: starting estimator thread 0... [ 1159.619986][T16640] IPVS: using max 14 ests per chain, 33600 per kthread [ 1164.539718][T16666] loop8: detected capacity change from 0 to 2048 [ 1164.547487][T16666] FAT-fs (loop8): Unrecognized mount option "mask=^MAY_APPEND" or missing value [ 1167.974036][T16693] loop7: detected capacity change from 0 to 1024 [ 1167.981358][T16693] EXT4-fs: Ignoring removed i_version option [ 1168.427396][T16693] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1170.935756][T16713] hub 1-0:1.0: USB hub found [ 1170.947527][T16713] hub 1-0:1.0: 1 port detected [ 1172.345567][T16723] trusted_key: encrypted_key: hex blob is missing [ 1173.057864][T16721] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1173.144525][T16721] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1173.148671][T14732] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1173.267296][T16721] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1173.296665][T16721] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1173.382324][T16721] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1173.402355][T16721] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1174.011569][T16738] loop6: detected capacity change from 0 to 128 [ 1174.254300][T16738] UDF-fs: error (device loop6): udf_read_tagged: read failed, block=256, location=256 [ 1174.277731][T16738] UDF-fs: warning (device loop6): udf_fill_super: No fileset found [ 1174.655913][T14215] Bluetooth: hci1: command 0x0406 tx timeout [ 1174.879283][T16745] [ 1174.881682][T16745] ====================================================== [ 1174.888720][T16745] WARNING: possible circular locking dependency detected [ 1174.895844][T16745] syzkaller #0 Not tainted [ 1174.900282][T16745] ------------------------------------------------------ [ 1174.907312][T16745] syz.6.2866/16745 is trying to acquire lock: [ 1174.913397][T16745] ffff888020011ab0 (&sb->s_type->i_mutex_key#23){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x430 [ 1174.924979][T16745] [ 1174.924979][T16745] but task is already holding lock: [ 1174.932365][T16745] ffff88805dae0520 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x148/0x580 [ 1174.941570][T16745] [ 1174.941570][T16745] which lock already depends on the new lock. [ 1174.941570][T16745] [ 1174.951999][T16745] [ 1174.951999][T16745] the existing dependency chain (in reverse order) is: [ 1174.961661][T16745] [ 1174.961661][T16745] -> #2 (&opts->dep_lock){+.+.}-{3:3}: [ 1174.969362][T16745] __mutex_lock+0x135/0xc80 [ 1174.974431][T16745] tcm_set_name+0x2a/0x90 [ 1174.979308][T16745] function_make+0x199/0x350 [ 1174.984486][T16745] configfs_mkdir+0x515/0x9e0 [ 1174.989724][T16745] vfs_mkdir+0x2a5/0x470 [ 1174.994547][T16745] do_mkdirat+0x1dc/0x450 [ 1174.999401][T16745] __x64_sys_mkdirat+0x89/0xa0 [ 1175.005084][T16745] do_syscall_64+0x55/0xb0 [ 1175.010026][T16745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1175.016440][T16745] [ 1175.016440][T16745] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 1175.024728][T16745] __mutex_lock+0x135/0xc80 [ 1175.029784][T16745] configfs_rmdir+0x63c/0x980 [ 1175.035010][T16745] vfs_rmdir+0x352/0x4b0 [ 1175.039789][T16745] do_rmdir+0x29f/0x590 [ 1175.044508][T16745] __x64_sys_rmdir+0x49/0x50 [ 1175.049637][T16745] do_syscall_64+0x55/0xb0 [ 1175.054599][T16745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1175.061024][T16745] [ 1175.061024][T16745] -> #0 (&sb->s_type->i_mutex_key#23){++++}-{3:3}: [ 1175.069758][T16745] __lock_acquire+0x37ef/0x7d80 [ 1175.075151][T16745] lock_acquire+0x19e/0x420 [ 1175.080241][T16745] down_write+0x97/0x200 [ 1175.085035][T16745] configfs_depend_item_unlocked+0x157/0x430 [ 1175.091563][T16745] usbg_make_tpg+0x1f7/0x580 [ 1175.096736][T16745] target_fabric_make_tpg+0xa4/0x6d0 [ 1175.102578][T16745] configfs_mkdir+0x515/0x9e0 [ 1175.107777][T16745] vfs_mkdir+0x2a5/0x470 [ 1175.112537][T16745] do_mkdirat+0x1dc/0x450 [ 1175.117386][T16745] __x64_sys_mkdir+0x6e/0x80 [ 1175.122503][T16745] do_syscall_64+0x55/0xb0 [ 1175.127461][T16745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1175.133892][T16745] [ 1175.133892][T16745] other info that might help us debug this: [ 1175.133892][T16745] [ 1175.144116][T16745] Chain exists of: [ 1175.144116][T16745] &sb->s_type->i_mutex_key#23 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 1175.144116][T16745] [ 1175.158815][T16745] Possible unsafe locking scenario: [ 1175.158815][T16745] [ 1175.166262][T16745] CPU0 CPU1 [ 1175.171623][T16745] ---- ---- [ 1175.176981][T16745] lock(&opts->dep_lock); [ 1175.181397][T16745] lock(gadget_subsys.su_mutex); [ 1175.188937][T16745] lock(&opts->dep_lock); [ 1175.195870][T16745] lock(&sb->s_type->i_mutex_key#23); [ 1175.201348][T16745] [ 1175.201348][T16745] *** DEADLOCK *** [ 1175.201348][T16745] [ 1175.209508][T16745] 5 locks held by syz.6.2866/16745: [ 1175.214699][T16745] #0: ffff888019322418 (sb_writers#20){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 1175.223953][T16745] #1: ffff888076d429e0 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 1175.234741][T16745] #2: ffffffff8db2b450 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 1175.244480][T16745] #3: ffffffff8de58aa8 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf8/0x580 [ 1175.254172][T16745] #4: ffff88805dae0520 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x148/0x580 [ 1175.263656][T16745] [ 1175.263656][T16745] stack backtrace: [ 1175.269538][T16745] CPU: 0 PID: 16745 Comm: syz.6.2866 Not tainted syzkaller #0 [ 1175.276998][T16745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1175.287051][T16745] Call Trace: [ 1175.290350][T16745] [ 1175.293296][T16745] dump_stack_lvl+0x18c/0x250 [ 1175.297976][T16745] ? load_image+0x420/0x420 [ 1175.302485][T16745] ? show_regs_print_info+0x20/0x20 [ 1175.307684][T16745] ? print_circular_bug+0x12b/0x1a0 [ 1175.312896][T16745] check_noncircular+0x2fc/0x400 [ 1175.317863][T16745] ? print_deadlock_bug+0x5d0/0x5d0 [ 1175.323064][T16745] ? lockdep_lock+0xf5/0x230 [ 1175.327661][T16745] ? __lock_acquire+0x357f/0x7d80 [ 1175.332698][T16745] ? _find_first_zero_bit+0xd6/0x100 [ 1175.338020][T16745] __lock_acquire+0x37ef/0x7d80 [ 1175.340095][T14215] Bluetooth: hci4: command 0x0406 tx timeout [ 1175.342876][T16745] ? is_bpf_text_address+0x28f/0x2a0 [ 1175.354197][T16745] ? verify_lock_unused+0x140/0x140 [ 1175.359443][T16745] lock_acquire+0x19e/0x420 [ 1175.363955][T16745] ? configfs_depend_item_unlocked+0x157/0x430 [ 1175.370124][T16745] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1175.376302][T16745] ? __might_sleep+0xe0/0xe0 [ 1175.380918][T16745] ? rcu_is_watching+0x15/0xb0 [ 1175.385696][T16745] ? read_lock_is_recursive+0x20/0x20 [ 1175.391079][T16745] ? trace_contention_end+0x39/0xe0 [ 1175.396287][T16745] ? __mutex_lock+0x30d/0xc80 [ 1175.400973][T16745] ? do_syscall_64+0x55/0xb0 [ 1175.405587][T16745] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1175.411668][T16745] down_write+0x97/0x200 [ 1175.415927][T16745] ? configfs_depend_item_unlocked+0x157/0x430 [ 1175.419907][T14215] Bluetooth: hci5: command 0x0405 tx timeout [ 1175.422103][T16745] ? down_read_killable+0x340/0x340 [ 1175.422137][T16745] configfs_depend_item_unlocked+0x157/0x430 [ 1175.439337][T16745] usbg_make_tpg+0x1f7/0x580 [ 1175.443940][T16745] ? usbg_drop_tport+0x20/0x20 [ 1175.448733][T16745] ? vscnprintf+0x80/0x80 [ 1175.453094][T16745] target_fabric_make_tpg+0xa4/0x6d0 [ 1175.458380][T16745] ? target_fabric_release_wwn+0xb0/0xb0 [ 1175.464015][T16745] configfs_mkdir+0x515/0x9e0 [ 1175.468695][T16745] vfs_mkdir+0x2a5/0x470 [ 1175.472958][T16745] do_mkdirat+0x1dc/0x450 [ 1175.477295][T16745] ? vfs_mkdir+0x470/0x470 [ 1175.481735][T16745] ? getname_flags+0x20a/0x500 [ 1175.486503][T16745] __x64_sys_mkdir+0x6e/0x80 [ 1175.491098][T16745] do_syscall_64+0x55/0xb0 [ 1175.495529][T16745] ? clear_bhb_loop+0x40/0x90 [ 1175.500200][T16745] ? clear_bhb_loop+0x40/0x90 [ 1175.504875][T16745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1175.510776][T16745] RIP: 0033:0x7fd919b9de99 [ 1175.515208][T16745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1175.534817][T16745] RSP: 002b:00007fd91aaae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 1175.543245][T16745] RAX: ffffffffffffffda RBX: 00007fd919e25fa0 RCX: 00007fd919b9de99 [ 1175.551240][T16745] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000c00 [ 1175.559208][T16745] RBP: 00007fd919c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 1175.567178][T16745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1175.575146][T16745] R13: 00007fd919e26038 R14: 00007fd919e25fa0 R15: 00007ffd185cf608 [ 1175.583118][T16745] [ 1175.822691][T16753] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2858'. [ 1177.042424][T14215] Bluetooth: hci1: command 0x0406 tx timeout [ 1177.420057][T14215] Bluetooth: hci4: command 0x0406 tx timeout [ 1177.499763][T14215] Bluetooth: hci5: command 0x0405 tx timeout [ 1177.663289][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.669740][ T1294] ieee802154 phy1 wpan1: encryption failed: -22