last executing test programs: 7m20.191049495s ago: executing program 1 (id=1580): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/trace_clock\x00', 0x1, 0x0) write(r0, 0x0, 0x3f) 7m19.96896817s ago: executing program 1 (id=1583): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv4/fib_multipath_hash_policy\x00', 0x1, 0x0) write$P9_RGETATTR(r0, &(0x7f0000000380)={0xa0, 0x19, 0x2, {0x0, {0x4, 0x4, 0x1}, 0x50, 0x0, 0x0, 0x12, 0x0, 0xa, 0x8, 0x9, 0x3, 0x3, 0x9, 0x5, 0x8, 0x7f, 0x1, 0x9, 0x3f1, 0x2}}, 0xa0) 7m19.759514895s ago: executing program 1 (id=1585): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012"], 0x68}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="120000001c000001"], 0x22) 7m19.468244162s ago: executing program 1 (id=1590): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f00000060c0)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, '\x00', 0xa}, 0xa}, 0x1c, &(0x7f0000000280)=[{&(0x7f00000022c0)='t', 0x1}], 0x1}}, {{&(0x7f0000000000)={0xa, 0x4e23, 0x5, @private2, 0x4}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000100)="87", 0x1}], 0x1}}], 0x2, 0x48081) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x81, &(0x7f0000002300)=""/4113, &(0x7f00000000c0)=0x1011) 7m19.223521488s ago: executing program 1 (id=1593): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 7m19.061994512s ago: executing program 1 (id=1596): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='ns\x00') lseek(r0, 0x4, 0x1) getdents64(r0, 0xffffffffffffffff, 0x43) 7m4.008311624s ago: executing program 32 (id=1596): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='ns\x00') lseek(r0, 0x4, 0x1) getdents64(r0, 0xffffffffffffffff, 0x43) 6m24.20322084s ago: executing program 0 (id=2230): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000005c0)={0x1f, 0x0, @none, 0x4}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x0, @any, 0x4, 0x2}, 0xe) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, 0x0, 0x27) 6m24.028600034s ago: executing program 0 (id=2223): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000080)='./file1\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="6c617a7974696d652c6e6f696e6c696e655f78617474722c6c617a7974696d652c6e6f626172726965722c6163746976655f6c6f67733d342c757365725f78617474722c6d6f64653d6c66732c616c6c6f635f6d6f64653d64656661756c742c00be9ee044c45511e65887f6fac9eba6d787c3684a836f23dbf8ad3dd5931c08b4d8bde7e8acbbf3bf3326f2faa5952a332ad2ced40c98a2affa2dad4d623f9ff3ffa81e45095548ab6200f069d0f63d20fd71d3043b0dd5c4cf9785f3f531abc19bc1678f5e0b33006bd1049ca45fd8500d67a5aa6e1c23d900000000007867738729e703bb122283fb2fae9813a0cfefcdf3dc968af1cf80e96649d943198a96d9b1af9c91506b30922be8537f54e65cf60c6b6a5798955796aea325770d6ccc93a95fad93b2c7bad114fcbc55036a301c23b07073c71555791db8919235222bb0ee4294211ab9b43f3fbedecd223722d937aa22b31e2e9c97e5ea94e4ab83d4e5811c7556813c334aec856a24cedd963c93ba5aa906c6e2268a0c6cbbb13f496d87c608604eb02b2c031d5ae40c75474939c664ff1849f8fbc403959f9c2de4b235261aba126be33a1762054cf2fad7dfc679c611c046f5764cfd3b84268cf21e9b8cd374866e2d55c4bfdd180a43e4fae7f5ddab3469cda8da12808566a285524ac700c24595dcd5c7784b30a4baafe80e10cecfe2393ecc927520408071c6901003dd15417429bfa90a54f501dd193865ebbb27e85c50605c45115595b04c410c2b2d6ef11e53872cba8091c88311d00c175bcf0a780265fe60228a640a746847d0138dc9f673fac8658d57ebaab4212bdcb1625a73bbda3c4a6e4282480077305b6afa3ebbcd525e588bf55760e556f1211a02cfe2e533ce915d86d62374332773744fcc8fdaf51812edd747c93b23bbe70d"], 0x1, 0x553a, &(0x7f0000006040)="$eJzs3EtvG1UUAODrpOmbEiEW7DpShZRItVWnSQW7AK14iFQRjwUr6tiO5db2RLHjhKxYsEQs+CcIJFYs+Q0sWLNDLEDskIo89wY1PCpQHJsk3ydNz8yd6zPnjqpEZyZyAM6s+ezXn0vhWrgUQpgNIVwNodgvpa2wGsMLIYTrIYSZJ7ZSGv9j4HwI4XII4dooecxZSqc+vzm8sfLTW798892Fc1e++Pr76a0amLYXQwjdrbi/240xb8X4MI3Xhu0idpeHKcYT3UfpOI9xt7lRZNitHcyrFfF2K87Pt3b6o7jZqdVHsdXeLMa3evGC/WHrIE/xgYe17eK40dwoYrufF7G1H+va248/2/b7g5inkfJ9VKQPg8FBjOPNvWZcz9ajItZ7gzQe8+aN5t4oDlNMlwv1vNMo6tg4yp3+f3u73dvZy4bN7X4772UrlepLleqdcnU7bzQHzeVyrdu4s5wttDqjaeVBs9ZdbeV5q9Os1PPuYrbQqtfL1Wq2cLe50a71smq1crtyq7yymPZuZq/ffz/rNLKFUXy13dsZtDv9bDPfzuInFrOlyu2XF7Mb1ezdtfVs/Z1799bW3/vw7gf3X1l787U06S9lZQtLt5aWytVb5aXq4sld/+h3/X9a/yep6DGuH46k9LSTDyZXB8AJov8HpmGi/f9cGHv/H/T/Y6H/P7Prf5wc7QZytj21/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4DT7Ye7LN4qd+Xh8JY0/k4aeS8elEMJMCOHx35gN5w/lnE155v5h/tyfavi2FIoMo2tcSNvlEMJq2n579rjvAgAAAJxeX318/bPYrcd/5qddEJMUH9rMXH0wpnylEMLc/I9jyBLSw6bw/NGrikb/v8+FvTFlKx5gXRxTsvjI7dy4sv0rs4fCxSdCKYaZg5nnJ1oXAABwnA53ApPtQgAAAJikT6ddANNRvGlNf4ufXvNdiCG9ELx06AgAAAA4gUrTLgAAAAA4dkX/7/v/AAAA4HSL3/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL+zcze5aQNRAICfDS609AdV3bdH6Q6O0SN02WXFVTgCvUL3FWegu267iyDCnkQhMiHExoTo+yR7MmPr5RnB4o1HAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACc0t9iMf318/OwaZz1ppl2ngYAAACosyoW0/KPcdUfpfF3aehj6mcRkUdEXe3ei1c7MXspTrHn/uJeDr8jygjb/zFIx5uI+JqOqw+n/hQAAADg5VrO5pOqWq9O43MnRJeqSZv87beW4mURUYz/tRQt354+PerWzeH5oe33ux8/9lzNjkutnNiKxktmbpRTbv22oh3WSz/322Z4p8mqJu8uHQAAoCu7lUCHVQgAAAAd+37uBDiP8q1nWoufFvAPqia9EHy90wMAAAAu0LGrngEAAIDnaPTg1bL+v4D9/97/t/8fAAAAPFm1/x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACntCoW0+VsPmkaZ72p8edLRN14jXaeBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArtmfdxSGYTAIg5tEeXVCF/D9b2kW7NatmxkQfPxbCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK48jpfnGa/GTLbR60zy7nkl+XRqfDs1fp0b/yRj3f0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADY2Z+XFAiBIIiCOeN/J33/w0qCnkGECGh4VFGLBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCLfvfL/4mpcSaZO20sHY8ka1eNravG3oPG0YPx9m8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC42Ll/37ipOADgX5/vrrSACAFlCEJUYoCFptfS0pUBFDHwJyBF6bUErvxoM9CqAmVhQ5m7IBgRQgKFrf9D51bqUrYONxSJqQPIPrt5PYo4qGJfk89Hen5fW47f9zlRlK+fcwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG389m6cF5uFSdypjt28d3W96G9N9YXr27eXi1bE2T9c/6u9Snz+vZzuZEvtJQIAAMDBkdf1fUQ/ejurRdBZKOv/Xn1OUfN/9+wkruv56bq/7uvav2i//nL3xQcDLUzGKS56bmM0PP73VLr5Hs5znj33r2d0yztfPnvJy29I572tF8a98n5m39y48U6/DA81kS0A8H8cq/sqqP8eKvpBm4kBcGB0q1a4U9X/+UK7OQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0ob8VT9dxFhHL3d24cOve1fWyn9q/vn17uW6nr13bTq9ZXKIXEec2RsPjTU3kCXDp8pWP10aj4cXmg1cior3Rq+CDGc6JaDNDweMGnepnfbavOhoR7efcftDyLyYAAPadXtWKuv5Ob2e1OJYtRvz5/cP1/2tJHGn9P9Wn9f/dD0/fTMdK6/9BYzOcfyubFz5buXT5yhsbF9bOD88PP3nzxOCtwckzp06dWSmflax4YgIAAMDj6Vctrf87ixHjqfX/I0kcM9b/n387+DIdK1f/P9Luol/bmQAAABxszx/94/fsEcezfj++WNvcvDiYbLP71f6JybaFVP+zQ1VL6/98se2sAAAAgCaMt7KH1v/PJnHMuP7/zA8v/ZReM4+Iw9X6/7H1T0dnm5tOS+7PdFYT/06851MFAABgrh2uWrr+3yvf/+88eOWhExGvvzqJq48BnKn+z9/9+sd0rPT9/5PNTXEudZYm96PslyK6S21nBAAAwH72VNWKYv+33s7qRz8feb/v/X8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACApv0VAAD//+NPQpo=") setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) listxattr(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) 6m21.906772255s ago: executing program 0 (id=2249): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv4/fib_multipath_hash_policy\x00', 0x1, 0x0) write$P9_RGETATTR(r0, &(0x7f0000000380)={0xa0, 0x19, 0x2, {0x0, {0x4, 0x4, 0x1}, 0x50, 0x0, 0x0, 0x12, 0x0, 0xa, 0x8, 0x9, 0x3, 0x3, 0x9, 0x5, 0x8, 0x7f, 0x1, 0x9, 0x3f1, 0x2}}, 0xa0) 6m21.514562855s ago: executing program 0 (id=2261): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f00000004c0)="306663353a313232373a620afaf6379a24e27065", 0x14) 6m21.357197778s ago: executing program 0 (id=2263): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 6m21.106133274s ago: executing program 0 (id=2255): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x0, 0xf0, 0x6}, 0xfe}, 0x18) sendmsg(r0, &(0x7f0000003d00)={&(0x7f00000005c0)=@hci={0x1d, 0x1, 0x4}, 0x80, 0x0}, 0x48004) 6m5.582296787s ago: executing program 33 (id=2255): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x0, 0xf0, 0x6}, 0xfe}, 0x18) sendmsg(r0, &(0x7f0000003d00)={&(0x7f00000005c0)=@hci={0x1d, 0x1, 0x4}, 0x80, 0x0}, 0x48004) 5m4.159029393s ago: executing program 2 (id=3102): r0 = syz_usb_connect$uac2(0x5, 0xa8, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x1d, 0x7}, [@source_unit={0x8, 0x24, 0xa, 0x0, 0x1, 0xff, 0x23}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="000304000000ff03"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5m2.025406184s ago: executing program 2 (id=3119): r0 = memfd_create(&(0x7f0000000480)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1md\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\x9fc\xda\xa9\x83r\xd8\x98\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9', 0x0) write$binfmt_script(r0, &(0x7f0000001180)={'#! ', './proc/thread-self/fail-nth'}, 0x1f) pwrite64(r0, &(0x7f0000000100)="12", 0x1, 0x2) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 5m1.865806298s ago: executing program 2 (id=3122): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) 5m1.673026212s ago: executing program 2 (id=3126): r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f40)=@ipv6_newaddr={0x48, 0x14, 0x101, 0x70bd26, 0x25dffbf8, {0xa, 0x38, 0x78, 0xff, r1}, [@IFA_ADDRESS={0x14, 0x1, @mcast2}, @IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_RT_PRIORITY={0x8, 0x9, 0x9}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004051}, 0x4) 5m1.497921356s ago: executing program 2 (id=3129): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@nogrpid}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100), 0x800) 5m1.264035202s ago: executing program 2 (id=3134): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000044402, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r1, 0xc0844123, &(0x7f0000002fc0)) 4m46.209925424s ago: executing program 34 (id=3134): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000044402, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r1, 0xc0844123, &(0x7f0000002fc0)) 3m4.653010213s ago: executing program 4 (id=4252): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)={{0x14}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x24, 0x3, "d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452"}, @NFTA_MATCH_NAME={0xe, 0x1, 'connlimit\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa8}}, 0x4048010) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 3m4.589855635s ago: executing program 4 (id=4253): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0) 3m4.464138378s ago: executing program 4 (id=4255): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000000)) 3m3.529322781s ago: executing program 4 (id=4266): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@hyper}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 3m2.667997261s ago: executing program 4 (id=4268): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x74, 0x8, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r1, 0xffffffffffffffff}, &(0x7f0000001d80), &(0x7f0000001d40)=r0}, 0x20) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x3, 0x5, 0x0, 0x70bd2c, 0x25dfdbfc, [@sadb_address={0x3, 0x6, 0x33, 0xa0, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010102}}]}, 0x28}, 0x1, 0x7}, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r2, &(0x7f0000000340), 0x0}, 0x20) 3m2.570044173s ago: executing program 4 (id=4270): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='3', 0x1) 2m47.29442453s ago: executing program 35 (id=4270): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='3', 0x1) 2m32.538628195s ago: executing program 7 (id=4464): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20000002}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2m32.017315397s ago: executing program 7 (id=4465): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000007c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="756e695f786c61746500002c696f636861727365743d69736f383835392d352c73686f72746e616d653d77696e6e742c6e6f6e756d7461696c3d302c756e695f786c6174653d312c757466383d302c696f636861727365743d6d616363726f617469616e2c696f636861727365743d6d61636761656c69632c616c6c6f775f7574696d653d30303030303030303030303030303030303030303532372c6e66732c6e6f6e756d7461696c3d307e90edd5ec81691b65743d63703836352c7569643d", @ANYBLOB="dbebdeb902116c2475eb082b1f12bc070da3a5fe7e5a", @ANYRES32=0x0], 0xf9, 0x238, &(0x7f0000000500)="$eJzs3c9qE10YB+B3krRf+rlIFq5EcEAXrkrbK2iRCmJXShbqQottQZJQsBBoFWNXXoGX5cY78AKE7nRRGJlM0rSQaov5U+rzbHJgzm/Oe5ITspo3r263m1u7ezuH779FtZpEaTVWk6OIepRi4GMAANfJzyyLo6xwuWSlNKmaAIDJuuDv/8IUSwIAJuzps+eP1zY21p+kaTWi/anTSKJ4La6v7cSbaMV2LEUtjiOyE8X44aON9aikuXrca3c7jTzZfvmlf/+17xG9/HLUoj46v5wWTuW7ncZc/N9ffzXPr0Qtbo7Or4zIR2M+7t89Vf9i1OLr69iNVmxFnh3mPyyn6YPs8493L/KK83zS7TT+680byspT/3AAAAAAAAAAAAAAAAAAAAAAALi2FtM0Tfsddbpn+u+Uj3vXF9OB+tn+PEX+vP5A3VP9dZbyJZJi/jBfiVuVqMxy7wAAAAAAAAAAAAAAAAAAAHBV7O0fNDdbre23Yx0MHusf/53/dhDlfmmtJOIK1NMbLOT1TGetOzHhtaK0f9AcnK7mZhJ/SFUndEiyEcevfG5qfkyrz98Y7y6SiJg7eTN/N7kac2P+pgAAAAAAAAAAAAAAAAAAAFM2fOh3xMXDGRQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADMw/P//Swy6/fAFUzPeIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP+AXwEAAP//QBx8JQ==") openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x101042, 0x57) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x4) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0x2000775) 2m31.257826085s ago: executing program 7 (id=4469): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000240)={@val={0x0, 0xf5}, @void, @ipv6=@generic={0x3, 0x6, "14f75a", 0x0, 0x3b, 0x1, @rand_addr=' \x01\x00', @mcast2}}, 0x2c) 2m30.595580612s ago: executing program 7 (id=4473): r0 = socket(0xa, 0x3, 0xff) syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c4000000000000000010000000000000000000000000000fe8000000000000000000000000000aaff"], 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000080)=0x408002, 0x4) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0x5, 0x4) recvmmsg(r0, &(0x7f00000042c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/19, 0x13}, 0x9}], 0x1, 0x20, 0x0) 2m30.23646293s ago: executing program 7 (id=4477): syz_mount_image$ext4(&(0x7f0000000280)='ext2\x00', &(0x7f0000000240)='./file0\x00', 0x10040, &(0x7f0000000200), 0xfe, 0x26f, &(0x7f00000002c0)="$eJzs3T9oJFUcB/Df7O4YN1kkaiOIf0BENBBiJ9jERiEgIYgIKkRErCQRYoJd1srGQmuVgGATxM5oKTbBRhGscncpcs3BXbjiwhV3xR67s3u3m+xxd/v32Pl8YJk3ee/NexPm+yYEZjaA3JqNiMWIKEbEXESkEZG0N3g++8w2d3fK+6sRtdo7V5NGu2w/0+o3ExHViHgtotSq29r74Oj6wVsvfbOZvvjz3vvlUZ1fu+Ojw7dPflz++relV7f+/f/ychKLUWnWtZ/HICVdflZKIp4YxmAPiaQ07hlwP1a+/PVcPfdPRsQLjfynUWhG9tuNR/5K45Uf7tb3uyv/PT3KuQKDV6ul9XtgtQbkTiEiKpEU5iMiKxcK8/PZ3/Dni9OFz9Y3vpj7dH1z7ZNxr1TAoKSRHL75x9TvM6fyf6mY5R+YXJWIw3dXdi/UyyfFcc8GGJr2/7Y/k23q+Z/7aPvlkH/IHfmH/JJ/yC/5hwnQY3blH/Krn/w/OqQ5AaPh/g8TLG0Vql2r5R/yS/5hQv3U7anTTvIP+dWefwAgX2pT434CGRiXca8/AAAAAAAAAAAAAAAAAADAWTvl/dXWZ1Rj/v19xPEbEVHqNn6x8X3ErbeNT19L6s1uS7JuffnwuT4P0KdfBvb0dbmnXo9dHNT4vfnn2eEc96vO3c5fztSd4vZaRLXeeKFUOnv9Jc3rr3eP36M+/bjPAR7Q6bcCvv7eaMc/7ebueMdfOoj4s77+LHRbfwrxVGObrT9LSed6U2l/xXKPPr/R5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYmVsBAAD//6iAbTQ=") openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181341, 0x84) symlinkat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x28541, 0x140) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x380407b, 0x0, 0x1, 0x0, &(0x7f0000000140)) 2m28.55803104s ago: executing program 7 (id=4486): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='-2 -3 -4.0 +4.1 +4.2\n', 0x15) close(r0) 2m13.392751765s ago: executing program 36 (id=4486): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='-2 -3 -4.0 +4.1 +4.2\n', 0x15) close(r0) 9.311984795s ago: executing program 6 (id=5116): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000080)={{0x2, 0x4e21, @multicast1}, {0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x10, {0x2, 0x4e22, @multicast1}, 'syzkaller0\x00'}) 8.776021208s ago: executing program 3 (id=5120): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000100)={0x18, 0x0, {0x4, @multicast, 'ip_vti0\x00'}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x40084) connect$pppoe(r1, &(0x7f0000000740)={0x18, 0x0, {0x103, @empty, 'bond0\x00'}}, 0x1e) 8.775775988s ago: executing program 6 (id=5121): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./my_debugfs\x00', 0x4) mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_debugfs/usb/devices\x00', 0x2, 0xb0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 8.203213142s ago: executing program 6 (id=5123): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) mlockall(0x7) 7.109476779s ago: executing program 3 (id=5127): syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) unshare(0x22020400) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x573, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x3, 0x7, 0x5, 0x8, 0x4c74, 0x10000, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x100003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x401, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000004, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x10000, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3eb, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x3, 0x20b9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x6, 0x5, 0x0, 0x30b1d694, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 5.935985297s ago: executing program 5 (id=5133): r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendmsg(r0, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000002c0)="51bb", 0x2}], 0x1}, 0x20008045) syz_emit_ethernet(0x46, &(0x7f00000000c0)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, '\x00', 0x10, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x2, 0xe15, 0x0, 0xfffffff6}}}}}}, 0x0) sendto$inet6(r0, &(0x7f0000000040), 0x3000, 0x0, 0x0, 0x0) 5.705969522s ago: executing program 8 (id=5134): syz_mount_image$udf(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x18410, &(0x7f0000000180)=ANY=[@ANYRES8=0x0, @ANYRES64=0x0], 0x1, 0x4b9, &(0x7f0000001040)="$eJzs20tslNUbx/HfM+90mA79/x0uFjAEmmhiBYFesEBqYrjYaMJFC9VIvKTSKVZ6IZ2ilICwVHcuWLp068KVcWtIXBoXBmNYmCAbN7MSd5jzznuboXRmbDtD6fdD4LyX5x3OOc+8c86ZvCMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAdefVwT6+1uhYAAKCZTp4e7ul/aPxPt6YyAACgKc6w/gcAAFhLTJ5+l2nPhZKd8PfLsscnpi9dHjk2tPBl7SZTSp4f7/5me/v69780cOBgWC5+/XLbplOnzxzuOjozdXG2UCwWxrpGpifOzYwV6n6FpV5fbZffAV1TFy6NjY8Xu/r29lecvpy/t259Z35w4L2jmTB25NjQ0OlETLrtP//vD3nUDD8jTy/I9PH339pJSSktvS9qvHdWWrvfiF1+I0aODfkNmZwYnZ5zJy0VRKUq+yQT9lETcrEkKcnVyzLLs2Zrk6cfZDqyr2SnJHlhP+z2vxiuqz6tkHZLV0ndWgU5e4ytk6cPZLq1L683gn7185+Rrra6clhx6eD+n7GSvel/Hrj7yX1sHn+r6/Xp8ZlErKWCO2q1jw/N9Jh/NmXl6ZR/x5dsWDuTp9a1rlZolnZ5mpIp89Un/rxC/rz0qcEDO3YeSs4wttR4HRe7N7i56hmT24Kpg6Xcn+VvF+qTNU9/ynT/t6y/3x2OAdKNB4td+EdTqoeVZp4mZfrnWsmsal3qJdb3kdU+9q9s/duzR2cuzs9OnP9obsHzuezhD4tzs6PnFj5dXrt6ySO11rHVUo0tyXJWXvF9/mkpui5YA/yvvBfX5pur8Xuhu6oMJd8/9WzXvYptYB7l6mTm6a5M4+9vLY8zyjXcN2uBy/+QTMXSzxZmOsh/8AxYIv8vx/2Xtcoy4uf2/+XvtcK5xLazmx91fCXy7+rk8v+OTEf+3hp8p1HOv1cV6+I6ZXr35vYgLpVxceEDcPnyK45PTBZ6XOwDmTb+FMbKj80FsZvi2F4XW5Tpi1uVseuD2M1xbJ+LvS3TnV8Xjn06ju13sfMuX3e6wtici90RxHbGsXvPzUyO1epWl/8+md6+/pqFbX5k/hP3/42qMvJQzhffXq785xPHbgR5PRvkP10j/1/KNP/X9rDdft+Hb6sN/r9x/t1c+bublbHhgnJjHNtbb7NazeV/g0z3XrkdtTloW7AbZyiZ/2fSlWXUry3K/4bEsXxQr0yDfbEWFeevXBidnCzMssEGG2xEG63+ZEIzuPF/2I3qA56F85hg/O8o78UzpvufxeP/YFUZadH4vzFxbDCYtbSlpezc1MW2LVK2OH9lz8TU6PnC+cJ0//6Bnr5D+3v6D7ZlwsldvFV33z0JXP53y3Ttx1+idUzl/G/h+X+uqoy0KP+bkm2qmNfU3RVrkst/h0wDd29H683F5v/h+r/72coyuv9alP/NiWP5oF4dDfYFAAAAAAAAAAAAAAAAAKwmOfP0nEyXh1+08DdE9Tz/N1ZVRpb/+a/yD5NrPP/VmTg21qTfNTTU0QAAAAAAAAAAAE2SkqevZXpeJbvuDnRIJ5Ilnmj/BgAA//9+z0gL") unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x4808, 0x0, 0x0, 0x0, &(0x7f0000000180)) syz_mount_image$ext4(0x0, &(0x7f00000000c0)='./bus/file0\x00', 0x890, 0x0, 0xfc, 0x0, &(0x7f0000000000)) renameat2(0xffffffffffffff9c, &(0x7f0000001c00)='./bus/file0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) 4.743676576s ago: executing program 5 (id=5137): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x60002005}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000c40)={0x2800001d}) 4.708355126s ago: executing program 3 (id=5138): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 4.380930714s ago: executing program 8 (id=5139): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x1400c, &(0x7f0000000340)={[{@test_dummy_encryption}, {@nodioread_nolock}, {@norecovery}]}, 0x3, 0x470, &(0x7f0000000dc0)="$eJzs3M1vG0UbAPBn13H65k0hoZSvlo9AQVQIkqYt0AMHQCBxKBISHOBoJaEqTQtqgkSrSKQcygkhJO6II/8CJ7ggxAmJK9xRpQr1QsvJaL27iZ3YTtPYcYt/P8ntM/vhmce7Y8/u2AlgaE1l/yQReyPi94iYyIutG0zl/12/tjJ349rKXBL1+tt/JY3t/r62MlduWu433lyIJA62qXfpwsUztcXFhfNFeWb57EczSxcuPnf6bO3UwqmFc0dPnDh+bPbFF44+35M8xyMtojfe++rNk1+05L8hjx6Z6rbyqXq9x9UN1l1N8cgA28H2VIrjVW30/4moNB29iXj9s7XCpwNqINA39Xq9Pt559Wod+A9LorWsy8OwKD/oy+vfdtfBL/dt9DF4V1/JL4CyvK8Xj3zNyNodg+qG69temoqId1f/+SZ7RH/uQwAAtPghG/88m412Vuayscf6+CON+5u2u7uYG5qMiHsiYl9E3BvnYn9E3BfR2PaBiHhwm/U3TZI0hpmbxz/plVtO7iZk47+Xirmt1vFfOfqLyUqjdCEvRDV5//TiwpHiNTkc1T1ZebZLHT++9tuXndY1j/+yR1Z/ORYs2nFlZE/rPvO15dqtZ9zq6qWIAyPt8k/WZgKSiHgoIg60e4J06zpOP/Pdw53WbZ1/Fz2YaKp/G/F0fvxXY0P+paT7/OTM/2Jx4chMeVZs9suvl9/qVP+O8u+B7Pj/v+35v5b/ZNI8X7u0/Tou//F5x2uaqWoRbOP8X60t10aTdxrxaLHsk9ry8vnZiNHkZN7o5uVH1/cty+X2Wf6HD7Xv//ti/ZU4GBHZSfxIRDwaEY8Vx+7xiHgiIg51yf/nV5/8YOOysTL/2+D4z2/r+K8Ho9G6JG2zTRZUzvz0fUulk+thkf+N7u9/xxvR4WLJzbz/bW5F+2Cnrx8AAADcCdKI2BtJOr0Wp+n0dP4d/v351Hfm43Pz+W8EJqOalne6Jpruh84Wl/V5+VJE5F8tKNcfi7Rx3/jrylijPD334eL8QDMHxjv0/8yflUG3Dug7P9iC4aX/w/Dq2v+ru9cOYPdt6v9d+/yevrYF2F1tPv/HBtEOYPe1G//7ez8wHDb0f9N+METc/4fhpf/D8NL/YSgtjcXWP5LvGpTPdIu7bxVMROy0hYMJonpbNKNvQaR9r2K0v6dW34LkDmzzpmBw70kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC99G8AAAD//1KFzjw=") syz_mount_image$exfat(0x0, &(0x7f0000000300)='./bus\x00', 0x448c, 0x0, 0x0, 0x0, &(0x7f0000000300)) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) lseek(r0, 0xffffffffffffffff, 0x2) getdents64(r0, 0x0, 0x0) 4.105599271s ago: executing program 3 (id=5140): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xc) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) close_range(r0, r0, 0x2) 3.791978849s ago: executing program 9 (id=5141): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000280)='./control\x00', 0x210000, &(0x7f0000000340)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@nolazytime}, {@bh}, {@noinit_itable}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x8}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x200000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000680)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000300)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x20863, 0x0) 3.551413195s ago: executing program 5 (id=5142): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x24, r1, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_4ADDR={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40895}, 0x200480c0) 3.014609067s ago: executing program 6 (id=5143): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c4a616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.619958777s ago: executing program 5 (id=5144): r0 = fanotify_init(0x40, 0x80000) syz_mount_image$vfat(&(0x7f0000001800), &(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8, &(0x7f0000000980)=ANY=[], 0x4, 0x2b8, &(0x7f0000000440)="$eJzs281OE10cx/Ef5eXh5YH2eVAUjPFEN7qZQL0BGwKJsYkGqfElMRlkqk1LSzoNpsYIrty6ceEtEJfuTIw3wMYrcOGOjUsWxjHMDNDWgYAIU/X72cwhZ34zZ/I/h5wmM+u3Xy4U866Vt2tKdBh1ST3akFJKqFOBjvCY8Ns9arSiS8PZT2dv3rl7LZPNTs0YM52ZvZw2xgyde//46ZvzH2oDt94OvftHa6n761/Sn9dG1kbXv80+Krim4JpypWZsM1ep1Oy5kmPmC27RMuZGybFdxxTKrlP1+5UK+vOlyuJi3djl+cH+xarjusYu103RqZtaxdSqdWM/tAtlY1mWGewX9tYd9wBwLKrVjD0paeyHntxqLAMCAACxitj/r8Sy/78SXjBy/7/1+4D9/6+VW52ZsTNxjwJHa3P/fy9cv83Y/wMAAAAAAAAAAAAAAAAAAAAA8DvY8Lyk53nJrWO35H/h44V/90nql7Qcnj8oaUhSUlJK0n+S/pc0LOmEpJOSRiSdknRa0mjDtRpu2xHT46LFbvXvbKn/gKR/D1D/V6/3rD/axIa39T3f3uu/uf7P/cQh1j/aROv6177qf+j//2gTDR/u9koLL5ZyS7ngGPRn8iqoJEfjSuqrX8tQ0J6+mp0aN76Uziwsh/nlpVxnc35Cyc0JE5WfCPKmOZ/w5912Pq3k5gSLyqcj8726eKEhbympjw9UUUnz/pzcyT+bMGbyerYlP+af96ezzLbI+lnWbv1Bfh/zwxuPrE+XxrrifXZIbv1J0S6VnOoxNvriuCmNn2yoPYZB47jrjr/ATtHjHgkAAAAAAAAAAAAAAAAA4CCO6OVBTxJvlgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2tb3AAAA//8ru1Qg") r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0xb0) fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0) getdents64(r1, 0x0, 0x0) 2.537822189s ago: executing program 8 (id=5145): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='select ', 0x7) write(r0, &(0x7f0000000100)='file read /etc/passwd task.uid=0 exec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) 2.174790538s ago: executing program 9 (id=5146): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040800}, 0x20008000) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300010025bd70000000000007000000", @ANYRES32=r1, @ANYBLOB="000000000000000024001a80200004801c000a80080002"], 0x44}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000040) 2.10313199s ago: executing program 8 (id=5147): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$inet(r1, &(0x7f0000002840)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)="1268a3db5ba40fe82ecf3465af3b9884890941251ee0", 0x16}, {&(0x7f00000004c0)="6059337673465062eacefc40e1b438cebc348d134fc35955cd0faaf679", 0x1d}, {&(0x7f0000000080)="421451baa0a0db86bb45108b5682e3b12e9794b15c70cc3e977a8947cae6d3aa6848e99cb81065b51dfeec1e4840e7bb1bc00edd0383c417e982751646e5283fd826d05e84997307306efa6b05790ecd79a37677bec13ec3ff01dc48010732df37e1554ca7d9c777512b", 0x6a}], 0x3}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="56a8c6ad830a8f74a318", 0xa}, {&(0x7f0000000840)="18c01ab5a41c262306d7d5661e70c1f60d254a68318c81aad7e16dd36ba3358d2385a2616333ebb179d83c74ce920187e2d2a1a5c6507cfefcd91f2900bdfb8a75f58a01a375754dd9756703ca8e7387d78db3c315da549d3a18dece16b7951c6983eeb2c377114769295d6498e328acb507395066e37e087d26f4f438", 0x7d}, {&(0x7f00000002c0)="9efd4a0669f614ebcbf2ed60f79e6487adb09b6e4e2bd1ace92b8175750a4733e86c63ca84f7215e0b2e942d54e5624a3c9afb69a841d02646c5e9", 0x3b}], 0x3}}], 0x2, 0x44008090) 2.036013431s ago: executing program 5 (id=5148): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x9, 0x7, 0x7fc00002}]}) getpid() prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000400)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000100)={r1, 0x2, r0, 0x0, 0x80000}) 1.580393493s ago: executing program 8 (id=5149): r0 = socket$inet6(0xa, 0x5, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x200, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x4}, 0x1c) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) 1.477271295s ago: executing program 9 (id=5150): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0xfffffffa) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "00769a7d8200010000001495595915303d6000"}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x100000) 1.183982012s ago: executing program 8 (id=5151): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) ioctl$HIDIOCGRDESC(r1, 0x90044802, &(0x7f0000000100)) 1.120909624s ago: executing program 9 (id=5152): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={r2, 0x1}, 0x8) 846.3199ms ago: executing program 3 (id=5153): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x10, 0x25, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r2 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r1, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2, r0, 0x4, r0}, 0x10) 656.001955ms ago: executing program 5 (id=5154): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) mlockall(0x7) 605.023806ms ago: executing program 9 (id=5155): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xf0, 0x6}}, 0x18) sendmmsg(r0, &(0x7f0000005800)=[{{&(0x7f00000017c0)=@can={0x1d, r2}, 0x80, &(0x7f00000013c0)=[{&(0x7f0000000100)="0a7aab37d5f95ed84a016028ea92060409df749a66bdd0ee63e7fc261ebd361048d641abdb147b1399ce9950617717224d28682f8c8b1c6e3db0c04d6710fba422897a58dcc5addaf6a3f634", 0x4c}, {&(0x7f0000000380)="1aed6f917ff9b8bb185f7802df7c7c514e6b34afe583007d4d511a4273c292f9c3e434e1b321b6f8102befec79efa5ebd400df8a0f141a099a75cc3d125e1ae56db6bf4d38fb94cd615ea3527a3458cb28bdd3d176dd21ae98c6d4a364e1a6c2d776897ac97d9a7e62c02ddee4294255a67c20d88bde10758fbec62972e892144dc25ac1391df9aa5cd00bf2440739c729600bda468eeb3d9e60f4a425cf559da807228a455a0bb24b56397b53cc734bd1c0b67c8d8138a58c5457ed690d62f2288a4c754cd71c9a631e6d010e8fffcf117ee6e89dd45227ab9a99ad150a885f015e1313fcd9030a2cf376edb3cca31013897ffa280ddd137c0fef205ca2034a5d7578a829aff2fc398e78c254d1bd3efe9cfa299a079f43cf50ddf9966c7a5081f1aff49d23283fc5ebbcd8e4b973479e05041faee2e6d970465bab20dadb961c230a593646ea146773bfce9d3a49aceb71bf9ec1d361529d4fc18a4ea15216013805a91322b83529ac5fa23db5431dd9fac4b1e3f80a269ad0fddd9e329052504a9faa53e3bbd52369b46920a7f1d6d07f8caeb9cfce62b3c78264f7bfe57c48beeaf479eb4c13477768f1b4ac69d221f7724e5362a062e64581334ca57ed62acd5e1268e0db21f0dff6f15a7d8dd4d0ebd4ae5d2d48dfaa43bb9174b195016e0cd5af1cc06c9a99299074b08fcac658653e3bdefadf273606629c4367eaa6de75d0393d8d127169d71b85dbaf90ac41edc24f476a097fed68e2af0555304d261643881d338d5279740c992dd58892d46f2e857e03b7e14156f16a3c97e043dac74ff06121be702f9c9f6ba8eefb60ddcdbe2049a1712eac1ffc880eecf7639a5b033e977a8e79b21652a106caf2a18135e7eb2d149f068744eed364d0af06010edc77d399f11a5189bd76cd441d65532fd5aebe6dec554befa7c7c83a8c5f8c8fcdc5a94e9c2fc15619fc984f8a0e3a1b9061d19a99e4d91b1bcdd25a6e4149aa713bcbeee003221324655c8efa25524aa5e9f178556ae0b60869d9ec92db972aad0dcc57d7a4b0b6360098ad79be627ae71b3d08fe0afb8dceb544052c73cd7bef8395e9ac2b7e7081b569b6b3bc6795f25ebb76339fc5c0c485933da1b9368e630e2664046c9d5b6af13e042442cb0dffe05d705b38ed132221a3b6358af0e7832a5e810de3d4b743a537dfa8f3cd5ac178fd3f353a7f1ebdfc0dac3958d65675e7cf3c9eaabd24e25059cb2bf60095849d4637be5ec98f0fe90e811b7492302a840e555465f1431cd38cd8174e0c062d8b5aba736160ad35dd50a9da3a885e890bf5a98254c80bbe450112e777d04c2d8e980ba03a7f82e1689eeb668b4740c5a4838ad0c39039be58821577483b0d5c5434d5157bd420f0c298ede14b6ff2f5f9cdac4e78d495202910cbc2635a24d867dd9ab98a6c331b2dbf7e2ac17d4d6e6007891b4682637e8262aed84d6b3fc943e6364b9271ffa3ce5be78cdd89c5a85a3e9698247ebcb21e02201271a40a3dc03b6f44afb059ecdea3d406934ea0bc1ba1c90af4627d88d3b06e7c8def2e2361243ea844e93653860c228686699e93ff0510b09f119ba398ab9e587a4698a5bd52d8bb8c139fd4e7a68918510d431ea2d0d38a38d2d6283dbf9614efe3c1b6a888c53695bbe3ae596a6d1cf2155bf78fac182aa2fe0018decc4c0ab808467ed3ad66d72e73c493cc32f97581d2d48bc50926855250d124e833908ce7c02f2bf2b8239058077f0c2329321c795618852fee25f066049196be06b652347b45a1b367ba0299687c5ce8639c2a4ff227e982b67ac97be18630b37d498c64dd0eaf40fba16ef4629d3051dcd1ef22f8dc7b9531c7396ea59565005d550ddf282faf99d3940178da87258c0a95fcaa9c521709171214f466e659858b1c92680d35bcfa23a0d305813033cdd8dde24a08dfb2b94bd06926b46becbd3dbfdeed1c5cfc4f7639af7560d52037d54c578e09aaa7cc21564558e87d9113eccacbe45f0c237b122c0c774cf5f7ccf4f42004d766eb142995a90b4cff88e5391261e94cd6d4f4cee253aac0bbfc268a05a4e10e7e2e4d0f4c1095535615ec975def76165771d1fcc7844ee260ba32694e041f18ebb439480c88819b245299fc4180288084a3dfe9628750133a6fe767e1f0da920551965de90ecba526c15efa4a14fb9b20b6828e56b448fec2eece9ee3d5d4a4a3b233cbcb64ff2e20f6b36754192b305431af6b46420d8e9658fded3ea17dd21d287c46210cd60efbb13557cdf857ce74baf4a3d19d802881131803b6de10b67c96c4843fe6556900b2957bb12b4d89d22299ef9763db26583a47a5ca9d68b2c4b63ae60e5d2e3212f42358e8bdfc99466ae33b6605f6b2d45b34e7f25d19851b27c4451d206ef4d4c8a83b70", 0x6ae}], 0x2}}], 0x1, 0x4005) 409.02013ms ago: executing program 6 (id=5156): openat$kvm(0xffffffffffffff9c, 0x0, 0x80600, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000400)={0x3, 0x3ff, 0x0, 0x0, 0x0, 0x80}) r0 = syz_open_dev$loop(&(0x7f00000000c0), 0x7c3, 0x200) ioctl$BLKROSET(r0, 0x125d, 0x0) 256.025845ms ago: executing program 3 (id=5157): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x881, &(0x7f0000000200)={0x11, 0x8100, r2, 0x1, 0x87, 0x6, @broadcast}, 0x14) 178.051216ms ago: executing program 9 (id=5158): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f00000008c0), 0x1, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB(r0, 0xc01c64ad, &(0x7f0000000080)={r2}) 0s ago: executing program 6 (id=5159): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="030300000000fcffffff0c00000008000300", @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r0) kernel console output (not intermixed with test programs): x is 0 [ 490.672822][T12402] usb 7-1: Using ep0 maxpacket: 32 [ 490.682102][ T14] usb 9-1: config 1 has no interface number 0 [ 490.704188][T12402] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 490.743843][ T14] usb 9-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 490.774210][T12402] usb 7-1: config 0 has no interface number 0 [ 490.806534][ T14] usb 9-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 490.828944][T12402] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 490.866556][ T14] usb 9-1: config 1 interface 105 has no altsetting 0 [ 490.880154][T12402] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.917217][ T14] usb 9-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 490.937013][T12402] usb 7-1: Product: syz [ 490.954872][T12402] usb 7-1: Manufacturer: syz [ 490.969886][ T14] usb 9-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 490.989403][T12402] usb 7-1: SerialNumber: syz [ 491.015819][T12402] usb 7-1: config 0 descriptor?? [ 491.025365][ T14] usb 9-1: Product: syz [ 491.036797][ T14] usb 9-1: Manufacturer: syz [ 491.045173][ T14] usb 9-1: SerialNumber: syz [ 491.055118][T12402] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 491.094725][T15273] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 491.146523][T15273] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 491.278783][T12402] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 491.345770][T12402] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 491.658955][T15273] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 491.703615][T15273] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 491.797624][ C0] usb 7-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 491.816982][T12402] usb 7-1: USB disconnect, device number 19 [ 491.866249][T12402] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 491.982868][T12402] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 492.071183][T12402] quatech2 7-1:0.51: device disconnected [ 492.349545][ T14] aqc111 9-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 492.449568][ T14] aqc111 9-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 492.606727][ T14] aqc111 9-1:1.105 eth9: register 'aqc111' at usb-dummy_hcd.8-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, e2:da:27:c1:7f:3d [ 492.735729][ T14] usb 9-1: USB disconnect, device number 2 [ 492.812086][ T14] aqc111 9-1:1.105 eth9: unregister 'aqc111' usb-dummy_hcd.8-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 493.031343][ T14] aqc111 9-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 493.129589][ T14] aqc111 9-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 493.171014][T12402] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 493.262198][ T14] aqc111 9-1:1.105 eth9 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 493.397203][T12402] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 493.491937][T12402] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 493.601753][T12402] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 493.720965][T12402] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 493.858404][T12402] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 493.954160][T12402] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 494.019061][T12402] usb 7-1: Manufacturer: syz [ 494.077368][T12402] usb 7-1: config 0 descriptor?? [ 494.091167][T15324] loop8: detected capacity change from 0 to 8 [ 494.178923][T15324] SQUASHFS error: Unable to read inode 0x11f [ 494.539332][T12402] appleir 0003:05AC:8243.001C: unknown main item tag 0x0 [ 494.589679][T12402] appleir 0003:05AC:8243.001C: No inputs registered, leaving [ 494.681976][T12402] appleir 0003:05AC:8243.001C: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 494.896557][T12402] usb 7-1: USB disconnect, device number 20 [ 495.354758][T15337] fido_id[15337]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 497.079386][T15377] loop6: detected capacity change from 0 to 2048 [ 497.280130][T15377] UDF-fs: error (device loop6): udf_process_sequence: Primary Volume Descriptor not found! [ 497.414821][T15377] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 499.174090][T15405] loop8: detected capacity change from 0 to 8192 [ 499.296470][T15405] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 501.227451][T15447] device syz_tun entered promiscuous mode [ 501.320285][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.329165][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.351947][T15451] bridge0: port 3(syz_tun) entered blocking state [ 501.408500][T15451] bridge0: port 3(syz_tun) entered disabled state [ 501.547388][T15451] bridge0: port 3(syz_tun) entered blocking state [ 501.555641][T15451] bridge0: port 3(syz_tun) entered forwarding state [ 501.949259][T15459] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4548'. [ 502.135782][T15459] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4548'. [ 502.153517][T15461] loop8: detected capacity change from 0 to 1024 [ 502.256541][T15461] EXT4-fs (loop8): warning: mounting unchecked fs, running e2fsck is recommended [ 502.370074][T15461] EXT4-fs (loop8): Errors on filesystem, clearing orphan list. [ 502.424447][T15461] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 502.436395][ T5027] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 502.642693][ T5027] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 502.716618][ T5027] usb 6-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 502.801942][ T5027] usb 6-1: config 0 interface 0 has no altsetting 0 [ 502.860888][ T5027] usb 6-1: New USB device found, idVendor=046d, idProduct=0a07, bcdDevice= 0.00 [ 502.922698][ T5027] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.987053][ T5027] usb 6-1: config 0 descriptor?? [ 503.041373][T15074] EXT4-fs (loop8): unmounting filesystem. [ 503.452735][ T5027] lg-g15 0003:046D:0A07.001D: ignoring exceeding usage max [ 503.534730][ T5027] lg-g15 0003:046D:0A07.001D: hidraw0: USB HID v11.06 Device [HID 046d:0a07] on usb-dummy_hcd.5-1/input0 [ 503.765837][T15479] loop8: detected capacity change from 0 to 2048 [ 503.906918][T15467] loop6: detected capacity change from 0 to 40427 [ 503.945649][T15479] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 504.047124][T15467] F2FS-fs (loop6): invalid crc value [ 504.152262][T15467] F2FS-fs (loop6): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 504.326018][T15074] EXT4-fs (loop8): unmounting filesystem. [ 504.601947][T15467] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 505.258672][ T5027] usb 6-1: USB disconnect, device number 18 [ 505.662047][T15498] loop8: detected capacity change from 0 to 128 [ 505.763808][T15498] FAT-fs (loop8): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 505.896354][T15500] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4562'. [ 505.953992][T15498] FAT-fs (loop8): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 505.982632][ T9848] syz-executor: attempt to access beyond end of device [ 505.982632][ T9848] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 506.372126][ T4298] FAT-fs (loop8): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 506.696506][T15509] loop8: detected capacity change from 0 to 64 [ 506.721074][ T5027] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 506.833515][T15509] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only. [ 506.961154][ T5027] usb 4-1: Using ep0 maxpacket: 16 [ 507.006830][ T5027] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 507.083407][ T4286] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 507.102777][ T4286] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 507.113394][ T4286] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 507.122263][ T4286] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 507.133244][ T4286] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 507.141505][ T4286] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 507.214376][ T5027] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 507.298562][ T5027] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 507.404157][ T5027] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 507.475718][ T5027] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.578586][ T5027] usb 4-1: config 0 descriptor?? [ 507.595904][T15515] loop6: detected capacity change from 0 to 4096 [ 507.707517][T15515] EXT4-fs: Ignoring removed nobh option [ 507.879274][T15515] EXT4-fs: Ignoring removed bh option [ 507.909482][T15512] chnl_net:caif_netlink_parms(): no params data found [ 507.947916][T15515] EXT4-fs (loop6): Test dummy encryption mode enabled [ 508.068942][T15515] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 508.100891][ T5027] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.001E/input/input41 [ 508.275583][ T5027] microsoft 0003:045E:07DA.001E: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 508.329806][T15512] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.351564][ T5019] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 508.452166][ T5027] usb 4-1: USB disconnect, device number 26 [ 508.479106][T15512] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.563641][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 508.602634][T15512] device bridge_slave_0 entered promiscuous mode [ 508.627252][ T5019] usb 9-1: config index 0 descriptor too short (expected 50, got 32) [ 508.703801][ T5019] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 508.727910][T15512] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.796897][ T5019] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 508.836519][T15512] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.894577][T15512] device bridge_slave_1 entered promiscuous mode [ 508.924598][ T5019] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 508.938304][T15528] UBIFS error (pid: 15528): cannot open "./dir0", error -22 [ 508.944253][T15523] fido_id[15523]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 508.998616][ T5019] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 509.071172][T15512] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.122487][ T5019] usb 9-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 509.177110][T15512] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.197964][ T5019] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.231060][ T4282] Bluetooth: hci6: command 0x0409 tx timeout [ 509.256851][ T5019] usb 9-1: Product: syz [ 509.282106][ T5019] usb 9-1: Manufacturer: syz [ 509.315562][ T5019] usb 9-1: SerialNumber: syz [ 509.382870][ T5019] usb_debug 9-1:1.0: debug converter detected [ 509.399396][T15512] team0: Port device team_slave_0 added [ 509.427832][ T5019] usb 9-1: debug converter now attached to ttyUSB0 [ 509.442895][T15512] team0: Port device team_slave_1 added [ 509.490414][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.501557][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.512115][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.522629][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.533097][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.543566][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.554040][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.564489][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.574972][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.585510][T15527] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 509.724644][T15518] debug ttyUSB0: usb_serial_generic_write_start - error submitting urb: -90 [ 509.747824][T15512] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.785545][T15512] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 509.923134][T15512] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 510.172313][T15512] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 510.237135][T15512] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 510.451046][T15512] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 510.525666][T15542] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4576'. [ 510.675869][T15512] device hsr_slave_0 entered promiscuous mode [ 510.762414][T15512] device hsr_slave_1 entered promiscuous mode [ 510.811267][T15512] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 510.881567][T15512] Cannot create hsr debugfs directory [ 510.956508][ T5019] usb 9-1: USB disconnect, device number 3 [ 510.984087][T15550] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input42 [ 511.026001][ T5019] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 511.138237][ T5019] usb_debug 9-1:1.0: device disconnected [ 511.310898][ T4282] Bluetooth: hci6: command 0x041b tx timeout [ 512.423871][T15512] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 512.558181][T15512] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 512.641919][T15512] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 512.792253][T15512] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 513.379180][T15512] 8021q: adding VLAN 0 to HW filter on device bond0 [ 513.390970][ T4282] Bluetooth: hci6: command 0x040f tx timeout [ 513.573895][T15590] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input43 [ 513.607838][T15512] 8021q: adding VLAN 0 to HW filter on device team0 [ 513.714447][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 513.787123][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 514.000456][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 514.069269][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 514.170057][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.178328][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 514.321445][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 514.441780][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 514.511940][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.520182][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 514.629244][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 514.702910][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 514.771826][T15606] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4600'. [ 514.826853][T15606] bond0: Unable to set up delay as MII monitoring is disabled [ 514.850860][ T5025] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 514.912974][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 514.976105][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 515.072030][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 515.083797][ T5025] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 515.158694][ T5025] usb 7-1: New USB device found, idVendor=0a99, idProduct=0001, bcdDevice= 0.00 [ 515.189986][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 515.247169][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 515.257137][ T5025] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 515.310094][ T5025] usb 7-1: Product: syz [ 515.326647][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 515.345287][ T5025] usb 7-1: Manufacturer: syz [ 515.386781][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 515.404369][ T5025] navman 7-1:1.0: navman converter detected [ 515.448053][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 515.457414][ T5025] usb 7-1: navman converter now attached to ttyUSB0 [ 515.470951][ T4282] Bluetooth: hci6: command 0x0419 tx timeout [ 515.540129][T15512] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 515.656960][ T5025] usb 7-1: USB disconnect, device number 21 [ 515.664389][ T14] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 515.678997][T15512] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 515.724942][ T5025] navman ttyUSB0: navman converter now disconnected from ttyUSB0 [ 515.750664][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 515.776758][ T5025] navman 7-1:1.0: device disconnected [ 515.789135][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 515.890696][ T14] usb 9-1: Using ep0 maxpacket: 32 [ 515.899186][ T14] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 515.916247][ T14] usb 9-1: config 0 has no interface number 0 [ 515.970359][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 515.990582][ T14] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 516.036413][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 516.071179][ T14] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.118700][T15512] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 516.141147][ T14] usb 9-1: Product: syz [ 516.146004][ T14] usb 9-1: Manufacturer: syz [ 516.212356][ T14] usb 9-1: SerialNumber: syz [ 516.234731][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 516.281702][ T14] usb 9-1: config 0 descriptor?? [ 516.297291][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 516.356005][ T14] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 516.449109][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 516.529796][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 516.552422][ T14] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 516.649856][T15512] device veth0_vlan entered promiscuous mode [ 516.674207][ T14] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 516.707387][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 516.757205][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 516.883860][T15633] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4612'. [ 516.941635][T15633] (unnamed net_device) (uninitialized): Invalid ad_actor_system MAC address. [ 517.044810][ C0] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 517.056218][ T5027] usb 9-1: USB disconnect, device number 4 [ 517.071846][T15633] (unnamed net_device) (uninitialized): option ad_actor_system: invalid value (149) [ 517.102068][ T5027] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 517.171508][T15512] device veth1_vlan entered promiscuous mode [ 517.228647][ T5027] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 517.253449][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 517.329553][ T5027] quatech2 9-1:0.51: device disconnected [ 517.527741][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 517.578133][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 517.710447][T15512] device veth0_macvtap entered promiscuous mode [ 517.812033][T15512] device veth1_macvtap entered promiscuous mode [ 517.963914][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 518.000912][ T5027] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 518.072650][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 518.144187][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 518.216571][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 518.232650][ T5027] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 518.286599][ T5027] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 518.308194][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 518.350557][ T5027] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 518.374613][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 518.416558][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 518.432455][ T5027] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 518.455057][T15655] FAULT_INJECTION: forcing a failure. [ 518.455057][T15655] name failslab, interval 1, probability 0, space 0, times 0 [ 518.479383][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 518.502605][T15655] CPU: 0 PID: 15655 Comm: syz.5.4623 Not tainted syzkaller #0 [ 518.510088][T15655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 518.520133][T15655] Call Trace: [ 518.523412][T15655] [ 518.526339][T15655] dump_stack_lvl+0x188/0x24e [ 518.531041][T15655] ? show_regs_print_info+0x12/0x12 [ 518.536223][T15655] ? load_image+0x410/0x410 [ 518.540720][T15655] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 518.546704][T15655] ? __might_sleep+0xd0/0xd0 [ 518.551360][T15655] ? lock_chain_count+0x20/0x20 [ 518.556195][T15655] should_fail_ex+0x390/0x4c0 [ 518.560860][T15655] should_failslab+0x5/0x20 [ 518.565388][T15655] slab_pre_alloc_hook+0x59/0x300 [ 518.570425][T15655] kmem_cache_alloc+0x56/0x2f0 [ 518.575167][T15655] ? zswap_frontswap_store+0x414/0x1680 [ 518.580728][T15655] zswap_frontswap_store+0x414/0x1680 [ 518.586107][T15655] ? zswap_frontswap_init+0x100/0x100 [ 518.591576][T15655] ? __lock_acquire+0x7ea0/0x7ea0 [ 518.596621][T15655] ? do_raw_spin_lock+0x128/0x2f0 [ 518.602118][T15655] ? __rwlock_init+0x140/0x140 [ 518.606867][T15655] ? do_raw_spin_unlock+0x11d/0x230 [ 518.612062][T15655] __frontswap_store+0x2d9/0x5b0 [ 518.617044][T15655] swap_writepage+0xc8/0x1a0 [ 518.621627][T15655] shrink_folio_list+0x2f81/0x8050 [ 518.626776][T15655] ? reclaim_clean_pages_from_list+0xb80/0xb80 [ 518.632915][T15655] ? __lock_acquire+0x142d/0x7ea0 [ 518.637943][T15655] ? verify_lock_unused+0x140/0x140 [ 518.643134][T15655] ? mark_lock+0x94/0x320 [ 518.647447][T15655] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 518.653439][T15655] reclaim_folio_list+0x85/0x2e0 [ 518.658376][T15655] reclaim_pages+0x575/0x690 [ 518.662974][T15655] ? folio_isolate_lru+0xf10/0xf10 [ 518.668078][T15655] ? do_raw_spin_unlock+0x11d/0x230 [ 518.673264][T15655] madvise_cold_or_pageout_pte_range+0x1936/0x1f30 [ 518.679769][T15655] ? folio_put+0xd0/0xd0 [ 518.684037][T15655] walk_pgd_range+0xb28/0x1370 [ 518.688869][T15655] __walk_page_range+0x136/0x590 [ 518.693800][T15655] walk_page_range+0x3b9/0x590 [ 518.698549][T15655] ? page_mapped_in_vma+0x800/0x800 [ 518.703767][T15655] ? mlock_page_drain_local+0x75/0x490 [ 518.709234][T15655] ? mlock_page_drain_local+0x75/0x490 [ 518.714688][T15655] do_madvise+0x1cb1/0x3520 [ 518.719186][T15655] ? plist_add+0x3d7/0x490 [ 518.723616][T15655] ? madvise_set_anon_name+0x420/0x420 [ 518.729064][T15655] ? schedule+0xd0/0x180 [ 518.733289][T15655] ? futex_wait_queue+0x23/0x1b0 [ 518.738214][T15655] ? futex_wait_queue+0x134/0x1b0 [ 518.743219][T15655] ? futex_unqueue+0xc7/0xf0 [ 518.747787][T15655] ? futex_wait+0x4a3/0x5c0 [ 518.752295][T15655] ? futex_wait_setup+0x270/0x270 [ 518.757320][T15655] ? file_end_write+0x156/0x250 [ 518.762231][T15655] ? vfs_write+0x777/0x9a0 [ 518.766634][T15655] ? do_futex+0x310/0x320 [ 518.770947][T15655] ? __ia32_sys_get_robust_list+0x100/0x100 [ 518.776828][T15655] ? lock_chain_count+0x20/0x20 [ 518.781667][T15655] __x64_sys_madvise+0xa2/0xb0 [ 518.786415][T15655] do_syscall_64+0x4c/0xa0 [ 518.790811][T15655] ? clear_bhb_loop+0x60/0xb0 [ 518.795474][T15655] ? clear_bhb_loop+0x60/0xb0 [ 518.800133][T15655] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 518.806103][T15655] RIP: 0033:0x7fd9bf19e199 [ 518.810500][T15655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 518.830084][T15655] RSP: 002b:00007fd9c00d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 518.838477][T15655] RAX: ffffffffffffffda RBX: 00007fd9bf425fa0 RCX: 00007fd9bf19e199 [ 518.846425][T15655] RDX: 0000000000000015 RSI: 7fffffffffffffff RDI: 0000200000000000 [ 518.854390][T15655] RBP: 00007fd9bf2358e0 R08: 0000000000000000 R09: 0000000000000000 [ 518.862339][T15655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 518.870287][T15655] R13: 00007fd9bf426038 R14: 00007fd9bf425fa0 R15: 00007ffe56d29808 [ 518.878249][T15655] [ 518.964541][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 518.974971][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 518.984757][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 518.995140][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 519.021770][ T5027] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 519.047700][ T5027] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 519.066369][T15512] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 519.079413][ T5027] usb 7-1: Manufacturer: syz [ 519.105791][ T5027] usb 7-1: config 0 descriptor?? [ 519.121354][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 519.149777][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 519.208527][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 519.252337][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 519.319247][T15653] net_ratelimit: 54 callbacks suppressed [ 519.319375][T15653] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 519.456950][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 519.530283][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 519.587326][ T5027] appleir 0003:05AC:8243.001F: unknown main item tag 0x0 [ 519.623516][ T5027] appleir 0003:05AC:8243.001F: No inputs registered, leaving [ 519.642451][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 519.694617][ T5027] appleir 0003:05AC:8243.001F: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 519.723814][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 519.800960][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 519.862553][T15664] FAULT_INJECTION: forcing a failure. [ 519.862553][T15664] name failslab, interval 1, probability 0, space 0, times 0 [ 519.889815][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 519.965721][ T14] usb 7-1: USB disconnect, device number 22 [ 519.988061][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 520.005726][T15664] CPU: 0 PID: 15664 Comm: syz.3.4627 Not tainted syzkaller #0 [ 520.013208][T15664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 520.023250][T15664] Call Trace: [ 520.026519][T15664] [ 520.029436][T15664] dump_stack_lvl+0x188/0x24e [ 520.034104][T15664] ? show_regs_print_info+0x12/0x12 [ 520.039288][T15664] ? load_image+0x410/0x410 [ 520.043787][T15664] ? __lock_acquire+0x7ea0/0x7ea0 [ 520.048805][T15664] should_fail_ex+0x390/0x4c0 [ 520.053476][T15664] should_failslab+0x5/0x20 [ 520.057976][T15664] slab_pre_alloc_hook+0x59/0x300 [ 520.062990][T15664] ? sk_prot_alloc+0xe7/0x210 [ 520.067736][T15664] __kmem_cache_alloc_node+0x4f/0x270 [ 520.073096][T15664] ? sk_prot_alloc+0xe7/0x210 [ 520.077762][T15664] __kmalloc+0xa3/0x240 [ 520.081903][T15664] sk_prot_alloc+0xe7/0x210 [ 520.086394][T15664] ? sk_alloc+0x20/0x330 [ 520.090622][T15664] sk_alloc+0x36/0x330 [ 520.094693][T15664] alg_create+0xa0/0x130 [ 520.098995][T15664] __sock_create+0x49a/0x940 [ 520.103573][T15664] __sys_socket+0xc4/0x190 [ 520.107991][T15664] __x64_sys_socket+0x76/0x80 [ 520.112684][T15664] do_syscall_64+0x4c/0xa0 [ 520.117097][T15664] ? clear_bhb_loop+0x60/0xb0 [ 520.121778][T15664] ? clear_bhb_loop+0x60/0xb0 [ 520.126447][T15664] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 520.132340][T15664] RIP: 0033:0x7f8b80d9e199 [ 520.136769][T15664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.156389][T15664] RSP: 002b:00007f8b81d05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 520.164811][T15664] RAX: ffffffffffffffda RBX: 00007f8b81025fa0 RCX: 00007f8b80d9e199 [ 520.172784][T15664] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 520.180753][T15664] RBP: 00007f8b80e358e0 R08: 0000000000000000 R09: 0000000000000000 [ 520.188707][T15664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 520.196677][T15664] R13: 00007f8b81026038 R14: 00007f8b81025fa0 R15: 00007ffd6592d058 [ 520.204745][T15664] [ 520.266479][T15663] fido_id[15663]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 520.297830][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 520.322659][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 520.389720][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 520.407343][T15512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 520.419698][T15512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 520.442857][T15512] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.475207][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 520.493354][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 520.519272][T15512] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.559980][T15512] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.614698][T15512] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.659559][T15512] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.048101][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.107846][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.131659][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.192258][T14291] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 521.202191][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.249108][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 521.883228][T15682] loop6: detected capacity change from 0 to 22 [ 521.967247][T15682] MTD: Attempt to mount non-MTD device "/dev/loop6" [ 522.134398][T15682] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 522.394194][T15688] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 523.034034][T15701] loop6: detected capacity change from 0 to 164 [ 523.648163][T15678] loop9: detected capacity change from 0 to 40427 [ 523.675025][T15707] loop6: detected capacity change from 0 to 1024 [ 523.765468][T15707] EXT4-fs: Ignoring removed nomblk_io_submit option [ 523.853356][T15678] F2FS-fs (loop9): invalid crc value [ 523.901794][T15707] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 523.948726][T15678] F2FS-fs (loop9): Found nat_bits in checkpoint [ 524.143527][T15707] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 524.333592][T15678] F2FS-fs (loop9): Start checkpoint disabled! [ 524.371761][ T26] audit: type=1800 audit(1791252429.185:178): pid=15707 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.6.4646" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 524.559337][T15678] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e6 [ 524.770993][ T5027] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 524.987465][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 525.031248][ T5027] usb 6-1: Using ep0 maxpacket: 16 [ 525.063954][ T5027] usb 6-1: config 0 has an invalid interface number: 105 but max is 0 [ 525.184904][ T5027] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 525.292088][ T5027] usb 6-1: config 0 has no interface number 0 [ 525.335533][T15727] loop6: detected capacity change from 0 to 256 [ 525.383635][ T5027] usb 6-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 525.454784][ T5027] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.525851][T15705] loop8: detected capacity change from 0 to 40427 [ 525.549679][ T5027] usb 6-1: Product: syz [ 525.588127][ T5027] usb 6-1: Manufacturer: syz [ 525.638622][T15705] F2FS-fs (loop8): invalid crc value [ 525.645141][ T5027] usb 6-1: SerialNumber: syz [ 525.704642][ T5027] usb 6-1: config 0 descriptor?? [ 525.725449][T15705] F2FS-fs (loop8): Found nat_bits in checkpoint [ 525.968106][ T5027] usb 6-1: Found UVC 0.00 device syz (046d:08f3) [ 526.020377][ T5027] usb 6-1: No valid video chain found. [ 526.064800][T15733] bond0: (slave dummy0): Error: Slave does not support XDP [ 526.105602][T15705] F2FS-fs (loop8): Cannot turn on quotas: -2 on 0 [ 526.135325][ T5027] usb 6-1: USB disconnect, device number 19 [ 526.873683][T15744] vhci_hcd vhci_hcd.0: failed to lookup sock [ 527.030084][T15737] nvme nvme0: failed to connect socket: -512 [ 527.600176][T15754] loop6: detected capacity change from 0 to 1024 [ 527.720496][T15754] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 527.911280][T15754] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 527.941652][T15759] netlink: 48 bytes leftover after parsing attributes in process `syz.9.4666'. [ 527.991753][T15763] loop8: detected capacity change from 0 to 512 [ 528.089865][T15763] EXT4-fs: inline encryption not supported [ 528.203081][T15763] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 528.353128][T15763] EXT4-fs (loop8): 1 truncate cleaned up [ 528.359726][T15763] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 528.393795][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 528.631410][T15763] EXT4-fs error (device loop8): __ext4_expand_extra_isize:5972: inode #12: comm syz.8.4667: bad extra_isize 62 (inode size 256) [ 528.710242][T15774] netlink: 88 bytes leftover after parsing attributes in process `syz.5.4671'. [ 528.790462][T15774] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4671'. [ 528.809678][T15763] EXT4-fs (loop8): Remounting filesystem read-only [ 528.886613][T15776] EXT4-fs error (device loop8): __ext4_expand_extra_isize:5972: inode #12: comm syz.8.4667: bad extra_isize 62 (inode size 256) [ 529.123078][T15776] EXT4-fs (loop8): Remounting filesystem read-only [ 529.353868][T15074] EXT4-fs (loop8): unmounting filesystem. [ 529.477138][T12401] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 529.713340][T12401] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 529.785790][T12401] usb 6-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 529.871097][T12401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 529.928341][T12401] usb 6-1: Product: syz [ 529.954948][T12401] usb 6-1: Manufacturer: syz [ 530.041954][T12401] usb 6-1: selecting invalid altsetting 1 [ 530.093337][T12401] dvb_ttusb_budget: ttusb_init_controller: error [ 530.127346][T12401] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 530.238832][T12401] DVB: Unable to find symbol cx22700_attach() [ 530.288206][T12401] DVB: Unable to find symbol tda10046_attach() [ 530.318494][T12401] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 530.387827][T12401] usb 6-1: USB disconnect, device number 20 [ 530.888664][T12401] hid-generic 0005:0B57:0002.0020: unknown main item tag 0x0 [ 531.162555][T12401] hid-generic 0005:0B57:0002.0020: hidraw0: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 531.252141][T15808] loop9: detected capacity change from 0 to 512 [ 531.413357][T15808] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 531.569318][T15808] EXT4-fs (loop9): 1 truncate cleaned up [ 531.661039][T15808] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 532.061296][T15512] EXT4-fs (loop9): unmounting filesystem. [ 532.071134][ T5025] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 532.291081][ T5025] usb 4-1: Using ep0 maxpacket: 16 [ 532.319103][ T5025] usb 4-1: unable to get BOS descriptor or descriptor too short [ 532.399250][T15825] loop9: detected capacity change from 0 to 512 [ 532.419854][ T5025] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8F has invalid maxpacket 8 [ 532.443391][T15797] loop6: detected capacity change from 0 to 32768 [ 532.487635][T15825] EXT4-fs (loop9): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 [ 532.592419][ T5025] usb 4-1: New USB device found, idVendor=0582, idProduct=0060, bcdDevice= 0.40 [ 532.638070][T15825] EXT4-fs (loop9): feature flags set on rev 0 fs, running e2fsck is recommended [ 532.652785][T15797] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 532.708614][ T5025] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.787595][T15825] EXT4-fs (loop9): The Hurd can't support 64-bit file systems [ 532.837011][ T5025] usb 4-1: Product: syz [ 532.885274][ T5025] usb 4-1: Manufacturer: syz [ 532.945576][ T5025] usb 4-1: SerialNumber: syz [ 533.012667][T15817] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 533.139634][T15825] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4692'. [ 533.429418][ T9848] ocfs2: Unmounting device (7,6) on (node local) [ 533.984419][ T5025] usb 4-1: MIDIStreaming interface descriptor not found [ 534.201941][ T5025] usb 4-1: USB disconnect, device number 27 [ 534.458093][T15849] netlink: 'syz.6.4699': attribute type 34 has an invalid length. [ 535.104817][T15859] FAULT_INJECTION: forcing a failure. [ 535.104817][T15859] name failslab, interval 1, probability 0, space 0, times 0 [ 535.181174][ T5025] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 535.252776][T15859] CPU: 0 PID: 15859 Comm: syz.3.4707 Not tainted syzkaller #0 [ 535.260267][T15859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 535.270316][T15859] Call Trace: [ 535.273587][T15859] [ 535.276511][T15859] dump_stack_lvl+0x188/0x24e [ 535.281196][T15859] ? show_regs_print_info+0x12/0x12 [ 535.286380][T15859] ? load_image+0x410/0x410 [ 535.290869][T15859] ? __might_sleep+0xd0/0xd0 [ 535.295454][T15859] ? __lock_acquire+0x7ea0/0x7ea0 [ 535.300468][T15859] should_fail_ex+0x390/0x4c0 [ 535.305131][T15859] should_failslab+0x5/0x20 [ 535.309611][T15859] slab_pre_alloc_hook+0x59/0x300 [ 535.314616][T15859] ? sock_update_netprioidx+0x4e/0x390 [ 535.320058][T15859] kmem_cache_alloc+0x56/0x2f0 [ 535.324812][T15859] ? kcm_create+0x117/0x540 [ 535.329393][T15859] kcm_create+0x117/0x540 [ 535.333708][T15859] __sock_create+0x49a/0x940 [ 535.338281][T15859] __sys_socket+0xc4/0x190 [ 535.342680][T15859] __x64_sys_socket+0x76/0x80 [ 535.347345][T15859] do_syscall_64+0x4c/0xa0 [ 535.351770][T15859] ? clear_bhb_loop+0x60/0xb0 [ 535.356440][T15859] ? clear_bhb_loop+0x60/0xb0 [ 535.361099][T15859] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 535.366978][T15859] RIP: 0033:0x7f8b80d9e199 [ 535.371399][T15859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.390989][T15859] RSP: 002b:00007f8b81d05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 535.399404][T15859] RAX: ffffffffffffffda RBX: 00007f8b81025fa0 RCX: 00007f8b80d9e199 [ 535.407355][T15859] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000029 [ 535.415303][T15859] RBP: 00007f8b80e358e0 R08: 0000000000000000 R09: 0000000000000000 [ 535.423258][T15859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 535.431223][T15859] R13: 00007f8b81026038 R14: 00007f8b81025fa0 R15: 00007ffd6592d058 [ 535.439210][T15859] [ 535.543819][T15838] loop8: detected capacity change from 0 to 32768 [ 535.562934][ T5025] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 535.642727][ T5025] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59136, setting to 1024 [ 535.780974][ T5025] usb 7-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice= 1.00 [ 535.868105][ T5025] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.960953][ T5025] usb 7-1: Product: syz [ 535.965854][ T5025] usb 7-1: Manufacturer: syz [ 536.037853][ T5025] usb 7-1: SerialNumber: syz [ 536.097460][T15856] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 536.107168][T15838] XFS (loop8): Mounting V5 Filesystem [ 536.163315][ T5025] symbolserial 7-1:1.0: symbol converter detected [ 536.222442][ T5025] usb 7-1: symbol converter now attached to ttyUSB0 [ 536.330279][T15838] XFS (loop8): Ending clean mount [ 536.516571][T12401] usb 7-1: USB disconnect, device number 23 [ 536.574339][T12401] symbol ttyUSB0: symbol converter now disconnected from ttyUSB0 [ 536.648890][T12401] symbolserial 7-1:1.0: device disconnected [ 536.713566][T15074] XFS (loop8): Unmounting Filesystem [ 538.497778][T15883] loop6: detected capacity change from 0 to 131072 [ 538.562247][T15883] F2FS-fs (loop6): invalid crc value [ 538.615949][T15883] F2FS-fs (loop6): Found nat_bits in checkpoint [ 538.651604][T15883] F2FS-fs (loop6): Cannot turn on quotas: -2 on 2 [ 538.689844][T15883] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 539.013400][T15889] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4712'. [ 539.158413][T15889] netlink: 'syz.8.4712': attribute type 30 has an invalid length. [ 539.241222][T15889] netlink: 'syz.8.4712': attribute type 29 has an invalid length. [ 539.361213][T15889] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4712'. [ 539.905995][T15902] ip_tables: iptables: counters copy to user failed while replacing table [ 541.213361][T15924] ieee802154 phy0 wpan0: encryption failed: -22 [ 541.572403][T15928] loop8: detected capacity change from 0 to 4096 [ 541.667245][T15928] EXT4-fs: inline encryption not supported [ 541.762558][T15928] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 541.898187][T15928] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=8842c019, mo2=0003] [ 542.052774][T15928] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 542.226760][T15938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4736'. [ 542.347530][T15928] EXT4-fs (loop8): shut down requested (2) [ 542.364526][T15938] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 542.780996][T15074] EXT4-fs (loop8): unmounting filesystem. [ 543.398416][T15938] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 544.511126][ T5027] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 544.751488][ T5027] usb 7-1: Using ep0 maxpacket: 8 [ 544.789597][ T5027] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 544.870038][ T5027] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 544.967534][ T5027] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 545.038702][T15948] loop9: detected capacity change from 0 to 32768 [ 545.069180][ T5027] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 545.172249][ T5027] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 545.205769][T15948] JBD2: Ignoring recovery information on journal [ 545.308920][ T5027] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 545.414306][T15948] ocfs2: Mounting device (7,9) on (node local, slot 0) with ordered data mode. [ 545.440122][ T5027] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.727799][ T5027] usb 7-1: GET_CAPABILITIES returned 0 [ 545.771914][ T5027] usbtmc 7-1:16.0: can't read capabilities [ 546.062571][ T5027] usb 7-1: USB disconnect, device number 24 [ 546.544309][T15972] FAULT_INJECTION: forcing a failure. [ 546.544309][T15972] name failslab, interval 1, probability 0, space 0, times 0 [ 546.681654][T15972] CPU: 0 PID: 15972 Comm: syz.3.4748 Not tainted syzkaller #0 [ 546.689220][T15972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 546.699274][T15972] Call Trace: [ 546.702541][T15972] [ 546.705463][T15972] dump_stack_lvl+0x188/0x24e [ 546.710129][T15972] ? show_regs_print_info+0x12/0x12 [ 546.715313][T15972] ? load_image+0x410/0x410 [ 546.719803][T15972] ? __lock_acquire+0x7ea0/0x7ea0 [ 546.724818][T15972] should_fail_ex+0x390/0x4c0 [ 546.729510][T15972] should_failslab+0x5/0x20 [ 546.734088][T15972] slab_pre_alloc_hook+0x59/0x300 [ 546.739117][T15972] ? security_prepare_creds+0x47/0x130 [ 546.744721][T15972] __kmem_cache_alloc_node+0x4f/0x270 [ 546.750079][T15972] ? security_prepare_creds+0x47/0x130 [ 546.755537][T15972] __kmalloc+0xa3/0x240 [ 546.759691][T15972] security_prepare_creds+0x47/0x130 [ 546.764977][T15972] prepare_creds+0x450/0x610 [ 546.769647][T15972] join_session_keyring+0x17/0x440 [ 546.774783][T15972] lookup_user_key+0x516/0x1110 [ 546.779624][T15972] ? lookup_user_key_possessed+0x40/0x40 [ 546.785239][T15972] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 546.791206][T15972] ? __might_fault+0xc2/0x120 [ 546.795863][T15972] ? __might_fault+0xa6/0x120 [ 546.800523][T15972] __se_sys_add_key+0x311/0x410 [ 546.805357][T15972] ? __x64_sys_add_key+0xc0/0xc0 [ 546.810276][T15972] ? lockdep_hardirqs_on+0x94/0x140 [ 546.815456][T15972] ? __x64_sys_add_key+0x1c/0xc0 [ 546.820378][T15972] do_syscall_64+0x4c/0xa0 [ 546.824799][T15972] ? clear_bhb_loop+0x60/0xb0 [ 546.829457][T15972] ? clear_bhb_loop+0x60/0xb0 [ 546.834112][T15972] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 546.839984][T15972] RIP: 0033:0x7f8b80d9e199 [ 546.844379][T15972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 546.863967][T15972] RSP: 002b:00007f8b81d05028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 546.872363][T15972] RAX: ffffffffffffffda RBX: 00007f8b81025fa0 RCX: 00007f8b80d9e199 [ 546.880313][T15972] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000040 [ 546.888262][T15972] RBP: 00007f8b80e358e0 R08: fffffffffffffffd R09: 0000000000000000 [ 546.896213][T15972] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 546.904162][T15972] R13: 00007f8b81026038 R14: 00007f8b81025fa0 R15: 00007ffd6592d058 [ 546.912125][T15972] [ 547.012341][T15512] ocfs2: Unmounting device (7,9) on (node local) [ 547.220041][T15979] loop8: detected capacity change from 0 to 256 [ 547.292589][T15979] exfat: Deprecated parameter 'utf8' [ 547.314417][T15981] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 547.396011][T15979] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0x1a991031, utbl_chksum : 0xe619d30d) [ 547.469873][T15982] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 547.528800][ T5025] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 547.600974][ T26] audit: type=1800 audit(1791252452.405:179): pid=15979 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.8.4753" name="file1" dev="loop8" ino=1048824 res=0 errno=0 [ 547.753285][ T5025] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 547.828004][ T5025] usb 6-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 547.910051][ T5025] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.990370][ T5025] usb 6-1: Product: syz [ 548.012106][ T5025] usb 6-1: Manufacturer: syz [ 548.047850][ T5025] usb 6-1: SerialNumber: syz [ 548.099915][ T5025] usb 6-1: config 0 descriptor?? [ 548.170348][ T5025] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 548.976222][ T5025] input: gspca_pac7302 as /devices/platform/dummy_hcd.5/usb6/6-1/input/input45 [ 548.986908][ T14] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 549.079814][T15985] loop9: detected capacity change from 0 to 32768 [ 549.214890][ T14] usb 9-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 549.276457][T15985] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop9 scanned by syz.9.4750 (15985) [ 549.320994][ T14] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.384493][ T14] usb 9-1: Product: syz [ 549.389352][ T14] usb 9-1: Manufacturer: syz [ 549.465898][ T14] usb 9-1: SerialNumber: syz [ 549.537521][ T14] usb 9-1: config 0 descriptor?? [ 549.603649][ T5027] usb 6-1: USB disconnect, device number 21 [ 549.675186][T15985] BTRFS info (device loop9): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 549.831014][T15985] BTRFS info (device loop9): using crc32c (crc32c-intel) checksum algorithm [ 549.922926][T15997] loop6: detected capacity change from 0 to 512 [ 549.982535][T15985] BTRFS info (device loop9): setting nodatasum [ 550.035624][ T14] usb 9-1: Firmware version (0.0) predates our first public release. [ 550.047209][T15997] FAT-fs (loop6): Unrecognized mount option "ÿÿÿÿÿ01777777777777777777777" or missing value [ 550.081229][T15985] BTRFS info (device loop9): force zlib compression, level 3 [ 550.090334][T15985] BTRFS info (device loop9): setting incompat feature flag for COMPRESS_LZO (0x8) [ 550.127345][ T14] usb 9-1: Please update to version 0.2 or newer [ 550.189431][ T14] usb 9-1: Firmware: build [ 550.309009][T15985] BTRFS info (device loop9): use lzo compression, level 0 [ 550.331427][ T5027] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 550.388711][T15985] BTRFS info (device loop9): turning on flush-on-commit [ 550.438409][ T14] usb 9-1: USB disconnect, device number 5 [ 550.487337][T15985] BTRFS info (device loop9): enabling auto defrag [ 550.563305][T15985] BTRFS info (device loop9): max_inline at 4096 [ 550.610574][ T5027] usb 4-1: config index 0 descriptor too short (expected 50, got 32) [ 550.661447][T15985] BTRFS info (device loop9): using free space tree [ 550.693646][ T5027] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 550.792578][ T5027] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 550.881610][ T5027] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 551.037267][ T5027] usb 4-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 551.109396][ T5027] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.179806][ T5027] usb 4-1: Product: syz [ 551.230212][ T5027] usb 4-1: Manufacturer: syz [ 551.290869][ T5027] usb 4-1: SerialNumber: syz [ 551.341150][T16001] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 551.362564][ T5027] usb_debug 4-1:1.0: debug converter detected [ 551.434857][ T5027] usb 4-1: debug converter now attached to ttyUSB0 [ 551.656046][T16027] loop6: detected capacity change from 0 to 256 [ 551.735148][ C0] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 551.781247][ C0] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 551.790536][ C0] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 551.806579][ C0] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 552.379310][T15985] BTRFS error (device loop9): open_ctree failed: -12 [ 552.451772][ T5275] usb 4-1: USB disconnect, device number 28 [ 552.494115][ T5275] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 552.553427][ T5275] usb_debug 4-1:1.0: device disconnected [ 553.201361][ T5275] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 553.431197][ T5275] usb 4-1: Using ep0 maxpacket: 8 [ 553.469385][ T5275] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 553.568176][ T5275] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 553.652370][ T5275] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 553.731104][ T5275] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 553.823320][ T5275] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 553.936691][ T5275] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 554.014229][ T5275] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.315403][ T5275] usb 4-1: usb_control_msg returned -32 [ 554.351296][ T5275] usbtmc 4-1:16.0: can't read capabilities [ 554.975873][ T5275] usb 4-1: USB disconnect, device number 29 [ 554.992869][T16058] loop6: detected capacity change from 0 to 8 [ 555.145451][T16058] SQUASHFS error: lzo decompression failed, data probably corrupt [ 555.212496][T16058] SQUASHFS error: Failed to read block 0x144: -5 [ 555.263870][T16058] SQUASHFS error: Unable to read metadata cache entry [142] [ 555.323675][T16058] SQUASHFS error: Unable to read inode 0x11f [ 557.308864][T16098] loop9: detected capacity change from 0 to 512 [ 557.351809][ T14] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 557.386326][T16098] EXT4-fs: Ignoring removed i_version option [ 557.447903][T16098] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 557.591162][ T14] usb 6-1: Using ep0 maxpacket: 8 [ 557.614593][ T14] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 557.661460][T16098] EXT4-fs error (device loop9): ext4_get_branch:178: inode #11: block 4294967295: comm syz.9.4792: invalid block [ 557.698782][ T14] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 557.736100][ T14] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 557.748640][T16098] EXT4-fs error (device loop9): ext4_free_branches:1030: inode #11: comm syz.9.4792: invalid indirect mapped block 4294967295 (level 1) [ 557.774873][ T14] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 557.808617][T16098] EXT4-fs error (device loop9): ext4_free_branches:1030: inode #11: comm syz.9.4792: invalid indirect mapped block 4294967295 (level 1) [ 557.830566][ T14] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 557.852266][ T14] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 557.868611][T16098] EXT4-fs (loop9): 2 truncates cleaned up [ 557.879521][T16098] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 557.897777][ T14] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.070479][T15512] EXT4-fs (loop9): unmounting filesystem. [ 558.148149][ T14] usb 6-1: usb_control_msg returned -32 [ 558.198375][ T14] usbtmc 6-1:16.0: can't read capabilities [ 558.210947][ T5030] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 558.445805][ T5030] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.502543][T16116] loop8: detected capacity change from 0 to 128 [ 558.523050][ T5030] usb 4-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 558.615523][T16116] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 558.638782][ T5030] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.708455][T16116] ext4 filesystem being mounted at /77/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 558.740366][ C0] vkms_vblank_simulate: vblank timer overrun [ 558.756464][ T5030] usb 4-1: Product: syz [ 558.798531][ T5030] usb 4-1: Manufacturer: syz [ 558.844602][ T5030] usb 4-1: SerialNumber: syz [ 558.890483][ T5030] usb 4-1: config 0 descriptor?? [ 558.916073][ T14] usb 6-1: USB disconnect, device number 22 [ 558.934820][ T5030] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 559.243628][T15074] EXT4-fs (loop8): unmounting filesystem. [ 559.733427][ T5030] input: gspca_pac7302 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input46 [ 560.004694][ T5030] usb 4-1: USB disconnect, device number 30 [ 560.511206][ T14] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 560.762842][ T14] usb 7-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 560.859903][ T14] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.590620][ T14] cxacru 7-1:1.0: wrong cm 0xa0 in response to cm 0x91 [ 561.681678][ T14] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -5 [ 561.690639][ T14] ATM dev 0: usbatm_atm_init: atm_start failed: -5! [ 561.895706][ T14] cxacru: probe of 7-1:1.0 failed with error -5 [ 562.022408][ T14] usb 7-1: USB disconnect, device number 25 [ 562.301082][ T5275] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 562.561001][ T5275] usb 6-1: Using ep0 maxpacket: 16 [ 562.607281][ T5275] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 562.720982][ T5275] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 562.754871][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.762307][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.876055][ T5275] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 562.967478][ T5275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.024759][ T5275] usb 6-1: Product: syz [ 563.060014][ T5275] usb 6-1: Manufacturer: syz [ 563.090192][ T5275] usb 6-1: SerialNumber: syz [ 563.133309][T16178] loop8: detected capacity change from 0 to 64 [ 563.336782][ T5275] usb 6-1: 0:2 : does not exist [ 563.354571][ T26] audit: type=1800 audit(1791252468.165:180): pid=16178 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.8.4822" name="file1" dev="loop8" ino=21 res=0 errno=0 [ 563.428373][ T5275] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 563.568729][ T5275] usb 6-1: USB disconnect, device number 23 [ 563.663903][T11664] udevd[11664]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 563.840991][ T14] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 563.905421][T16187] FAULT_INJECTION: forcing a failure. [ 563.905421][T16187] name failslab, interval 1, probability 0, space 0, times 0 [ 564.743001][T16191] loop8: detected capacity change from 0 to 131072 [ 564.796793][ T14] usb 7-1: Using ep0 maxpacket: 16 [ 564.818189][T16191] F2FS-fs (loop8): invalid crc value [ 564.848637][ T14] usb 7-1: config 0 has an invalid interface number: 34 but max is 0 [ 564.870936][T16191] F2FS-fs (loop8): Found nat_bits in checkpoint [ 564.904443][T16191] F2FS-fs (loop8): Cannot turn on quotas: -2 on 2 [ 564.935506][T16191] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e4 [ 564.970969][T16187] CPU: 0 PID: 16187 Comm: syz.9.4826 Not tainted syzkaller #0 [ 564.978461][T16187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 564.988517][T16187] Call Trace: [ 564.991792][T16187] [ 564.994716][T16187] dump_stack_lvl+0x188/0x24e [ 564.999480][T16187] ? show_regs_print_info+0x12/0x12 [ 565.004672][T16187] ? load_image+0x410/0x410 [ 565.009431][T16187] ? __might_sleep+0xd0/0xd0 [ 565.014011][T16187] ? __lock_acquire+0x7ea0/0x7ea0 [ 565.019051][T16187] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 565.025051][T16187] should_fail_ex+0x390/0x4c0 [ 565.029718][T16187] should_failslab+0x5/0x20 [ 565.034213][T16187] slab_pre_alloc_hook+0x59/0x300 [ 565.039225][T16187] kmem_cache_alloc_lru+0x49/0x2e0 [ 565.044321][T16187] ? __d_alloc+0x2e/0x6e0 [ 565.048678][T16187] __d_alloc+0x2e/0x6e0 [ 565.053112][T16187] ? d_alloc_pseudo+0xe/0x70 [ 565.057692][T16187] d_alloc_pseudo+0x19/0x70 [ 565.062205][T16187] alloc_file_pseudo+0xe0/0x200 [ 565.067072][T16187] ? alloc_empty_file_noaccount+0x80/0x80 [ 565.072801][T16187] ? alloc_fd+0x590/0x640 [ 565.077120][T16187] sock_alloc_file+0xb3/0x240 [ 565.081858][T16187] __sys_socket+0x12d/0x190 [ 565.086348][T16187] __x64_sys_socket+0x76/0x80 [ 565.091012][T16187] do_syscall_64+0x4c/0xa0 [ 565.095415][T16187] ? clear_bhb_loop+0x60/0xb0 [ 565.100083][T16187] ? clear_bhb_loop+0x60/0xb0 [ 565.104746][T16187] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 565.110628][T16187] RIP: 0033:0x7f8d9fb9e199 [ 565.115055][T16187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.134654][T16187] RSP: 002b:00007f8da0b5a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 565.143075][T16187] RAX: ffffffffffffffda RBX: 00007f8d9fe25fa0 RCX: 00007f8d9fb9e199 [ 565.151040][T16187] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000001d [ 565.159019][T16187] RBP: 00007f8d9fc358e0 R08: 0000000000000000 R09: 0000000000000000 [ 565.166980][T16187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 565.174944][T16187] R13: 00007f8d9fe26038 R14: 00007f8d9fe25fa0 R15: 00007ffec70ea778 [ 565.182913][T16187] [ 565.186033][ C0] vkms_vblank_simulate: vblank timer overrun [ 565.219764][ C0] vkms_vblank_simulate: vblank timer overrun [ 565.336516][ T14] usb 7-1: config 0 has no interface number 0 [ 565.381106][ T14] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 565.441240][ T14] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 565.544945][ T14] usb 7-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 565.639233][ T14] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.732875][ T14] usb 7-1: Product: syz [ 565.760956][ T14] usb 7-1: Manufacturer: syz [ 565.790515][ T14] usb 7-1: SerialNumber: syz [ 565.848551][ T14] usb 7-1: config 0 descriptor?? [ 565.902115][T16182] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 566.015755][T16182] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 566.264825][T16182] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 566.335773][T16182] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 566.615947][ T14] asix 7-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 566.671097][ T14] asix: probe of 7-1:0.34 failed with error -61 [ 566.682294][ T5275] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 566.902924][ T5275] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 566.961193][ T5275] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 567.036525][ T5275] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 567.106489][ T5275] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 567.179470][ T5275] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 567.277406][ T5275] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 567.336140][ T5275] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.400796][ T5275] usb 4-1: Product: syz [ 567.405679][ T5275] usb 4-1: Manufacturer: syz [ 567.468846][ T5275] usb 4-1: SerialNumber: syz [ 567.531825][ T5275] cdc_mbim 4-1:1.0: skipping garbage [ 567.824041][T16219] input: syz0 as /devices/virtual/input/input47 [ 568.013105][ T14] usb 7-1: USB disconnect, device number 26 [ 568.251446][T16224] input: syz1 as /devices/virtual/input/input48 [ 568.503111][T16227] nvmet: adding nsid 1 to subsystem testnqn [ 568.538075][ T5275] cdc_mbim 4-1:1.0: bind() failure [ 568.597209][ T26] audit: type=1800 audit(1791252473.405:181): pid=16228 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="syz.9.4840" name="buffered_io" dev="configfs" ino=79749 res=0 errno=0 [ 568.628180][ T5275] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 568.702906][ T5275] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 568.772037][ T5275] usbtest: probe of 4-1:1.1 failed with error -71 [ 568.852418][ T5275] usb 4-1: USB disconnect, device number 31 [ 569.023534][T16230] x86: Booting SMP configuration: [ 569.081485][T16230] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 569.803804][T16249] loop6: detected capacity change from 0 to 128 [ 569.953751][T16249] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a80ec018, mo2=0002] [ 570.053078][T16249] System zones: 1-3, 19-19, 35-36 [ 570.115144][T16249] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 570.219752][T16249] ext4 filesystem being mounted at /456/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 570.460925][ T5031] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 570.681627][ T5031] usb 10-1: Using ep0 maxpacket: 16 [ 570.693253][ T5031] usb 10-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 570.775967][ T5031] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.825583][ T5031] usb 10-1: Product: syz [ 570.871264][ T5031] usb 10-1: Manufacturer: syz [ 570.908773][ T5031] usb 10-1: SerialNumber: syz [ 570.957213][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 571.382876][ T5031] snd-usb-audio: probe of 10-1:1.0 failed with error -71 [ 571.404639][T16244] loop8: detected capacity change from 0 to 32768 [ 571.444979][ T5031] usb 10-1: USB disconnect, device number 2 [ 571.537707][T16244] (syz.8.4846,16244,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 571.732168][T16244] (syz.8.4846,16244,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 572.007135][T16244] JBD2: Ignoring recovery information on journal [ 572.381907][T16244] ocfs2: Mounting device (7,8) on (node local, slot 0) with ordered data mode. [ 572.620930][ T5031] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 572.800620][T15074] ocfs2: Unmounting device (7,8) on (node local) [ 572.821794][ T5031] usb 7-1: Using ep0 maxpacket: 16 [ 572.830382][ T5031] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 572.910999][ T5275] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 572.925241][ T5031] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 573.016172][ T5031] usb 7-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 573.080936][ T5031] usb 7-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 573.125048][ T5275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 573.150901][ T5031] usb 7-1: Manufacturer: syz [ 573.188678][ T5275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 573.219945][ T5031] usb 7-1: config 0 descriptor?? [ 573.277519][ T5275] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 573.416093][ T5275] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 573.508267][ T5275] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.624767][ T5275] usb 6-1: config 0 descriptor?? [ 573.932499][ T5031] letsketch 0003:6161:4D15.0021: Device info: а [ 574.121701][ T5275] plantronics 0003:047F:FFFF.0022: No inputs registered, leaving [ 574.133595][ T5031] letsketch 0003:6161:4D15.0021: Device info: ï“¿ [ 574.195675][ T5275] plantronics 0003:047F:FFFF.0022: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 574.377609][ T5031] usb 7-1: Max retries (5) exceeded reading string descriptor 202 [ 574.440849][ T5031] letsketch: probe of 0003:6161:4D15.0021 failed with error -71 [ 574.559207][ T5031] usb 7-1: USB disconnect, device number 27 [ 575.571869][ T26] audit: type=1326 audit(1791252480.375:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.607845][ T26] audit: type=1326 audit(1791252480.415:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.642798][ T26] audit: type=1326 audit(1791252480.415:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.674693][ T26] audit: type=1326 audit(1791252480.475:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.709792][ T26] audit: type=1326 audit(1791252480.475:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.745287][ T26] audit: type=1326 audit(1791252480.475:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.779373][ T26] audit: type=1326 audit(1791252480.475:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.815889][ T26] audit: type=1326 audit(1791252480.475:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.847521][ T26] audit: type=1326 audit(1791252480.525:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.884690][ T26] audit: type=1326 audit(1791252480.525:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16319 comm="syz.3.4878" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8b80d9e199 code=0x7ffc0000 [ 575.931214][ T5027] usb 6-1: reset high-speed USB device number 24 using dummy_hcd [ 576.781084][ T5030] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 576.910019][ T14] usb 6-1: USB disconnect, device number 24 [ 577.020917][ T5030] usb 4-1: Using ep0 maxpacket: 8 [ 577.028650][ T5030] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 577.094219][ T5030] usb 4-1: config 0 has no interface number 0 [ 577.157259][ T5030] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 577.217892][ T5030] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 577.263802][ T5030] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 577.351519][ T5030] usb 4-1: config 0 descriptor?? [ 577.459894][ T5030] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 578.660554][ T4343] Bluetooth: hci7: Frame reassembly failed (-84) [ 578.669117][ T4343] Bluetooth: hci7: Frame reassembly failed (-84) [ 578.678144][ T5030] usb 4-1: USB disconnect, device number 32 [ 578.729154][T16367] loop9: detected capacity change from 0 to 1024 [ 578.794310][T16367] EXT4-fs: inline encryption not supported [ 578.873513][T16367] EXT4-fs: inline encryption not supported [ 578.931811][T16367] EXT4-fs: Ignoring removed nomblk_io_submit option [ 578.983584][T16367] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 579.018452][T16373] FAULT_INJECTION: forcing a failure. [ 579.018452][T16373] name failslab, interval 1, probability 0, space 0, times 0 [ 579.034177][T16373] CPU: 0 PID: 16373 Comm: syz.5.4897 Not tainted syzkaller #0 [ 579.041669][T16373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 579.051749][T16373] Call Trace: [ 579.055030][T16373] [ 579.057946][T16373] dump_stack_lvl+0x188/0x24e [ 579.062616][T16373] ? show_regs_print_info+0x12/0x12 [ 579.067797][T16373] ? load_image+0x410/0x410 [ 579.072309][T16373] ? __might_sleep+0xd0/0xd0 [ 579.076924][T16373] ? __lock_acquire+0x7ea0/0x7ea0 [ 579.081949][T16373] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 579.087928][T16373] should_fail_ex+0x390/0x4c0 [ 579.092623][T16373] should_failslab+0x5/0x20 [ 579.097150][T16373] slab_pre_alloc_hook+0x59/0x300 [ 579.102204][T16373] kmem_cache_alloc_lru+0x49/0x2e0 [ 579.107330][T16373] ? __d_alloc+0x2e/0x6e0 [ 579.111652][T16373] __d_alloc+0x2e/0x6e0 [ 579.115793][T16373] ? d_alloc_pseudo+0xe/0x70 [ 579.120372][T16373] d_alloc_pseudo+0x19/0x70 [ 579.124862][T16373] alloc_file_pseudo+0xe0/0x200 [ 579.129703][T16373] ? alloc_empty_file_noaccount+0x80/0x80 [ 579.135423][T16373] ? alloc_fd+0x590/0x640 [ 579.139745][T16373] sock_alloc_file+0xb3/0x240 [ 579.144430][T16373] __sys_socket+0x12d/0x190 [ 579.148935][T16373] __x64_sys_socket+0x76/0x80 [ 579.153606][T16373] do_syscall_64+0x4c/0xa0 [ 579.158018][T16373] ? clear_bhb_loop+0x60/0xb0 [ 579.162694][T16373] ? clear_bhb_loop+0x60/0xb0 [ 579.167371][T16373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 579.173262][T16373] RIP: 0033:0x7fd9bf19e199 [ 579.177671][T16373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.197277][T16373] RSP: 002b:00007fd9c00d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 579.205725][T16373] RAX: ffffffffffffffda RBX: 00007fd9bf425fa0 RCX: 00007fd9bf19e199 [ 579.213692][T16373] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000001d [ 579.221654][T16373] RBP: 00007fd9bf2358e0 R08: 0000000000000000 R09: 0000000000000000 [ 579.229617][T16373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 579.237583][T16373] R13: 00007fd9bf426038 R14: 00007fd9bf425fa0 R15: 00007ffe56d29808 [ 579.245565][T16373] [ 579.248594][ C0] vkms_vblank_simulate: vblank timer overrun [ 579.297035][ C0] vkms_vblank_simulate: vblank timer overrun [ 579.352091][T16375] loop6: detected capacity change from 0 to 256 [ 579.381511][ C0] vkms_vblank_simulate: vblank timer overrun [ 579.417469][ C0] vkms_vblank_simulate: vblank timer overrun [ 579.431489][T16367] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 579.503164][T16367] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 579.710817][ T4286] Bluetooth: hci0: command 0x1407 tx timeout [ 579.710874][ T4282] Bluetooth: hci0: Opcode 0x1407 failed: -110 [ 579.720812][T16367] EXT4-fs error (device loop9): ext4_map_blocks:747: inode #15: comm syz.9.4895: lblock 0 mapped to illegal pblock 0 (length 1) [ 579.918911][T16367] EXT4-fs (loop9): Remounting filesystem read-only [ 580.163854][T15512] EXT4-fs (loop9): unmounting filesystem. [ 580.670998][ T4287] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 580.678047][ T4282] Bluetooth: hci7: command 0x1003 tx timeout [ 581.194998][T16400] overlayfs: failed to decode file handle (len=2, type=248, flags=0, err=-22) [ 581.362142][T16404] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4909'. [ 581.931315][ T14] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 582.160965][ T14] usb 9-1: Using ep0 maxpacket: 16 [ 582.169666][ T14] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 582.186413][T16393] loop6: detected capacity change from 0 to 32768 [ 582.211456][T16412] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(3) [ 582.218565][T16412] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 582.273362][T16393] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop6 scanned by syz.6.4905 (16393) [ 582.293136][ T14] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 582.338202][T16412] vhci_hcd vhci_hcd.0: Device attached [ 582.396509][ T14] usb 9-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 582.458795][ T14] usb 9-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 582.532500][ T14] usb 9-1: Manufacturer: syz [ 582.583026][T16393] BTRFS info (device loop6): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 582.616349][ T14] usb 9-1: config 0 descriptor?? [ 582.634406][T16393] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm [ 582.740972][ T5031] usb 51-1: new low-speed USB device number 2 using vhci_hcd [ 582.771381][T16393] BTRFS info (device loop6): using free space tree [ 582.821621][ T5030] usb 10-1: new low-speed USB device number 3 using dummy_hcd [ 582.926136][ T5027] smpboot: CPU 1 is now offline [ 583.033784][T16424] x86: Booting SMP configuration: [ 583.064521][ T5030] usb 10-1: config 0 has no interfaces? [ 583.109693][ T5030] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 583.131182][T16424] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 583.228644][ T5030] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 583.292576][ T14] letsketch 0003:6161:4D15.0023: Device info: а [ 583.369681][T16393] BTRFS info (device loop6): enabling ssd optimizations [ 583.393522][ T5030] usb 10-1: config 0 descriptor?? [ 583.494565][ T14] letsketch 0003:6161:4D15.0023: Device info: ï“¿ [ 583.597803][ T9848] BTRFS info (device loop6): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 583.728976][ T14] usb 9-1: Max retries (5) exceeded reading string descriptor 202 [ 583.739612][T16413] usb 51-1: recv xbuf, 0 [ 583.766108][ T33] vhci_hcd: stop threads [ 583.774535][ T33] vhci_hcd: release socket [ 583.787902][ T33] vhci_hcd: disconnect device [ 583.789776][ T14] letsketch: probe of 0003:6161:4D15.0023 failed with error -71 [ 583.821007][ T5031] vhci_hcd: vhci_device speed not set [ 583.902567][ T14] usb 9-1: USB disconnect, device number 6 [ 583.967682][ T5030] usb 10-1: USB disconnect, device number 3 [ 584.767999][T16454] loop8: detected capacity change from 0 to 1024 [ 586.025630][T16476] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 586.060440][T16479] loop9: detected capacity change from 0 to 7 [ 586.133287][T16479] Dev loop9: unable to read RDB block 7 [ 586.182149][T16479] loop9: unable to read partition table [ 586.222909][T16479] loop9: partition table beyond EOD, truncated [ 586.272086][T16479] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 586.381405][ T5031] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 586.593781][ T5031] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 586.644251][ T5031] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 586.693140][T16486] device-mapper: ioctl: Invalid ioctl structure: name m, dev f800 [ 586.744348][ T5031] usb 7-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 586.809884][T16489] FAULT_INJECTION: forcing a failure. [ 586.809884][T16489] name fail_futex, interval 1, probability 0, space 0, times 1 [ 586.840918][ T5031] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.900996][ T5031] usb 7-1: Product: syz [ 586.922985][T16489] CPU: 0 PID: 16489 Comm: syz.8.4939 Not tainted syzkaller #0 [ 586.930514][T16489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 586.940591][T16489] Call Trace: [ 586.943898][T16489] [ 586.946831][T16489] dump_stack_lvl+0x188/0x24e [ 586.951522][T16489] ? show_regs_print_info+0x12/0x12 [ 586.956777][T16489] ? load_image+0x410/0x410 [ 586.961315][T16489] ? get_user_pages_fast_only+0x40/0x40 [ 586.966880][T16489] should_fail_ex+0x390/0x4c0 [ 586.971574][T16489] get_futex_key+0x1b1/0x1000 [ 586.976257][T16489] ? futex_setup_timer+0xc0/0xc0 [ 586.981191][T16489] ? memset+0x1e/0x40 [ 586.985247][T16489] futex_requeue+0x286/0x13a0 [ 586.989927][T16489] ? futex_unqueue+0xc7/0xf0 [ 586.994518][T16489] ? put_task_struct+0x80/0x80 [ 586.999289][T16489] ? futex_wait_setup+0x270/0x270 [ 587.004320][T16489] ? file_end_write+0x156/0x250 [ 587.009175][T16489] ? vfs_write+0x777/0x9a0 [ 587.013588][T16489] do_futex+0x23d/0x320 [ 587.017758][T16489] ? __ia32_sys_get_robust_list+0x100/0x100 [ 587.023687][T16489] __se_sys_futex+0x381/0x410 [ 587.028365][T16489] ? __x64_sys_futex+0xf0/0xf0 [ 587.033135][T16489] ? __x64_sys_futex+0x1d/0xf0 [ 587.037933][T16489] do_syscall_64+0x4c/0xa0 [ 587.042437][T16489] ? clear_bhb_loop+0x60/0xb0 [ 587.047113][T16489] ? clear_bhb_loop+0x60/0xb0 [ 587.051785][T16489] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 587.057675][T16489] RIP: 0033:0x7f0af359e199 [ 587.062081][T16489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 587.081685][T16489] RSP: 002b:00007f0af43df028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 587.090092][T16489] RAX: ffffffffffffffda RBX: 00007f0af3825fa0 RCX: 00007f0af359e199 [ 587.098060][T16489] RDX: 0000000000000001 RSI: 000000000000000c RDI: 000020000000cffc [ 587.106030][T16489] RBP: 00007f0af36358e0 R08: 0000000000000000 R09: 0000000000000000 [ 587.113996][T16489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 587.121962][T16489] R13: 00007f0af3826038 R14: 00007f0af3825fa0 R15: 00007ffeaaefa3f8 [ 587.129939][T16489] [ 587.217456][T16473] loop9: detected capacity change from 0 to 32768 [ 587.225750][ T5031] usb 7-1: Manufacturer: syz [ 587.230382][ T5031] usb 7-1: SerialNumber: syz [ 587.259179][ T5031] usb 7-1: config 0 descriptor?? [ 587.272792][T16473] (syz.9.4932,16473,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 587.297824][T16481] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 587.305225][T16481] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 587.491692][T16473] (syz.9.4932,16473,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 587.549328][T16481] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 587.611594][T16481] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 587.661427][T16473] JBD2: Ignoring recovery information on journal [ 587.782219][T16498] device-mapper: ioctl: populate_table: no targets specified [ 587.907728][T16473] ocfs2: Mounting device (7,9) on (node local, slot 0) with ordered data mode. [ 588.521943][ T5031] dm9601 7-1:0.0 (unnamed net_device) (uninitialized): MDIO read error: -71 [ 588.578535][ T5031] dm9601 7-1:0.0 eth9: register 'dm9601' at usb-dummy_hcd.6-1, Davicom DM96xx USB 10/100 Ethernet, 28:da:91:db:87:5c [ 588.691593][ T5031] usb 7-1: USB disconnect, device number 28 [ 588.774593][ T5031] dm9601 7-1:0.0 eth9: unregister 'dm9601' usb-dummy_hcd.6-1, Davicom DM96xx USB 10/100 Ethernet [ 588.964262][T15512] ocfs2: Unmounting device (7,9) on (node local) [ 590.432618][ T4287] Bluetooth: hci1: command 0x0406 tx timeout [ 591.400901][ T5031] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 591.467189][T16564] loop9: detected capacity change from 0 to 128 [ 591.584960][T16564] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 591.620286][ T5031] usb 9-1: config 0 has no interfaces? [ 591.688700][ T5031] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 591.715666][T16564] ext4 filesystem being mounted at /64/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 591.756335][ T5031] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 591.830960][ T5031] usb 9-1: Product: syz [ 591.836811][ T5031] usb 9-1: Manufacturer: syz [ 591.913858][ T5031] usb 9-1: SerialNumber: syz [ 591.959871][T16572] loop6: detected capacity change from 0 to 128 [ 591.969508][ T5031] usb 9-1: config 0 descriptor?? [ 592.078432][T16572] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 592.159654][T16572] ext4 filesystem being mounted at /474/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 592.232610][T15512] EXT4-fs (loop9): unmounting filesystem. [ 592.269998][T16558] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 592.414995][ T4276] usb 9-1: USB disconnect, device number 7 [ 592.609316][T16580] device-mapper: ioctl: populate_table: no targets specified [ 592.708022][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 593.810192][T16606] loop6: detected capacity change from 0 to 1024 [ 593.870068][T16609] FAULT_INJECTION: forcing a failure. [ 593.870068][T16609] name failslab, interval 1, probability 0, space 0, times 0 [ 593.998723][T16609] CPU: 0 PID: 16609 Comm: syz.9.4973 Not tainted syzkaller #0 [ 594.006243][T16609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 594.016321][T16609] Call Trace: [ 594.019611][T16609] [ 594.022555][T16609] dump_stack_lvl+0x188/0x24e [ 594.027260][T16609] ? show_regs_print_info+0x12/0x12 [ 594.032476][T16609] ? load_image+0x410/0x410 [ 594.036993][T16609] ? __might_sleep+0xd0/0xd0 [ 594.041593][T16609] ? __lock_acquire+0x7ea0/0x7ea0 [ 594.046647][T16609] should_fail_ex+0x390/0x4c0 [ 594.051349][T16609] should_failslab+0x5/0x20 [ 594.055858][T16609] slab_pre_alloc_hook+0x59/0x300 [ 594.060902][T16609] kmem_cache_alloc+0x56/0x2f0 [ 594.065683][T16609] ? copy_fs_struct+0x4b/0x270 [ 594.070529][T16609] copy_fs_struct+0x4b/0x270 [ 594.075106][T16609] ksys_unshare+0x397/0x8e0 [ 594.079664][T16609] ? sighand_ctor+0x40/0x40 [ 594.084149][T16609] ? lock_chain_count+0x20/0x20 [ 594.088990][T16609] ? syscall_enter_from_user_mode+0x21/0x80 [ 594.094881][T16609] __x64_sys_unshare+0x34/0x40 [ 594.099649][T16609] do_syscall_64+0x4c/0xa0 [ 594.104070][T16609] ? clear_bhb_loop+0x60/0xb0 [ 594.108741][T16609] ? clear_bhb_loop+0x60/0xb0 [ 594.113411][T16609] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 594.119300][T16609] RIP: 0033:0x7f8d9fb9e199 [ 594.123713][T16609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.143312][T16609] RSP: 002b:00007f8da0b5a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 594.151723][T16609] RAX: ffffffffffffffda RBX: 00007f8d9fe25fa0 RCX: 00007f8d9fb9e199 [ 594.159694][T16609] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062020600 [ 594.167657][T16609] RBP: 00007f8d9fc358e0 R08: 0000000000000000 R09: 0000000000000000 [ 594.175616][T16609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 594.183579][T16609] R13: 00007f8d9fe26038 R14: 00007f8d9fe25fa0 R15: 00007ffec70ea778 [ 594.191561][T16609] [ 595.551068][ T4287] Bluetooth: hci3: command 0x0406 tx timeout [ 595.979707][T16620] device-mapper: ioctl: populate_table: no targets specified [ 596.792370][ T4276] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 596.996621][ T4276] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 597.030634][ T4276] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 597.125343][ T4276] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 597.140056][T16632] loop8: detected capacity change from 0 to 64 [ 597.218577][ T4276] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.345488][ T4276] usb 4-1: config 0 descriptor?? [ 597.689265][T16636] loop9: detected capacity change from 0 to 256 [ 597.698375][T16624] loop6: detected capacity change from 0 to 40427 [ 597.786786][T16624] F2FS-fs (loop6): Corrupted extension count (33554469 + 1 > 64) [ 597.828572][ T4276] hid-steam 0003:28DE:1142.0024: unknown main item tag 0x0 [ 597.947616][T16624] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 597.969507][ T4276] hid-steam 0003:28DE:1142.0024: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 598.061456][T16624] F2FS-fs (loop6): invalid crc value [ 598.137927][ T4276] hid-steam 0003:28DE:1142.0025: unknown main item tag 0x0 [ 598.158866][T16624] F2FS-fs (loop6): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 598.271766][ T4276] hid-steam 0003:28DE:1142.0025: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 598.421813][ T4276] hid-steam 0003:28DE:1142.0024: Steam wireless receiver connected [ 598.457231][ T4276] hid-steam 0003:28DE:1142.0024: No HID_FEATURE_REPORT submitted - nothing to read [ 598.489211][T16624] F2FS-fs (loop6): recover fsync data on readonly fs [ 598.653853][T16624] F2FS-fs (loop6): Try to recover 2th superblock, ret: -30 [ 598.667923][T16646] loop9: detected capacity change from 0 to 128 [ 598.712412][T16624] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 598.738955][T16646] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 598.796327][T16646] hpfs: filesystem error: improperly stopped [ 598.835129][T16646] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 598.886055][T16646] hpfs: You really don't want any checks? You are crazy... [ 598.924622][T16624] F2FS-fs (loop6): f2fs_check_nid_range: out-of-range nid=470000, run fsck to fix. [ 598.939504][T16646] hpfs: Code page index out of array [ 598.957823][T16646] hpfs: code page support is disabled [ 598.985104][T16646] hpfs: hpfs_map_4sectors(): unaligned read [ 599.040364][T16646] hpfs: hpfs_map_4sectors(): unaligned read [ 599.084171][T16646] hpfs: filesystem error: unable to find root dir [ 599.610998][ T5031] usb 4-1: reset high-speed USB device number 33 using dummy_hcd [ 600.571237][ T4276] usb 4-1: USB disconnect, device number 33 [ 600.648045][ T4276] hid-steam 0003:28DE:1142.0024: Steam wireless receiver disconnected [ 600.870938][ T5027] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 601.074626][ T5027] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 601.137744][ T5027] usb 7-1: New USB device found, idVendor=08ca, idProduct=0001, bcdDevice= 1.00 [ 601.188692][T16668] loop8: detected capacity change from 0 to 1024 [ 601.226743][ T5027] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.273014][T16668] hfsplus: unable to parse mount options [ 602.551425][ T4276] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 602.678738][T16663] loop9: detected capacity change from 0 to 40427 [ 602.722383][ T5027] aiptek 7-1:1.0: Aiptek using 400 ms programming speed [ 602.765378][ T4276] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 602.780649][T16663] F2FS-fs (loop9): Invalid log_blocksize (268), supports only 12 [ 602.812836][ T5027] input: Aiptek as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/input/input50 [ 602.831175][ T4276] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1983, setting to 1024 [ 602.857158][T16663] F2FS-fs (loop9): Can't find valid F2FS filesystem in 1th superblock [ 602.894634][ T4276] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 603.018716][T16663] F2FS-fs (loop9): invalid crc_offset: 33558524 [ 603.054302][ T5027] usb 7-1: USB disconnect, device number 29 [ 603.054390][ C0] aiptek 7-1:1.0: aiptek_irq - usb_submit_urb failed with result -19 [ 603.115120][ T4276] usb 4-1: config 0 interface 0 has no altsetting 0 [ 603.138882][T16663] F2FS-fs (loop9): Found nat_bits in checkpoint [ 603.177220][ T4276] usb 4-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 603.249143][ T4276] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.334082][ T4276] usb 4-1: config 0 descriptor?? [ 603.382759][T16683] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 603.402279][T16663] F2FS-fs (loop9): Try to recover 1th superblock, ret: 0 [ 603.480043][T16663] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 603.858721][ T4276] dragonrise 0003:0079:0006.0026: hidraw0: USB HID v0.00 Device [HID 0079:0006] on usb-dummy_hcd.3-1/input0 [ 603.947776][ T4276] dragonrise 0003:0079:0006.0026: no inputs found [ 603.988222][ T4276] dragonrise 0003:0079:0006.0026: force feedback init failed [ 604.125264][ T4276] usb 4-1: USB disconnect, device number 34 [ 604.235619][T16703] fido_id[16703]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0079:0006.0026/report_descriptor': No such file or directory [ 604.981711][ T4276] usb 9-1: new full-speed USB device number 8 using dummy_hcd [ 605.196151][ T4276] usb 9-1: config 0 interface 0 has no altsetting 0 [ 605.215578][ T4276] usb 9-1: New USB device found, idVendor=1ea7, idProduct=0907, bcdDevice= 0.00 [ 605.325844][ T4276] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.414913][ T4276] usb 9-1: config 0 descriptor?? [ 605.911067][ T4276] semitek 0003:1EA7:0907.0027: unknown main item tag 0x4 [ 605.990661][T16718] loop9: detected capacity change from 0 to 256 [ 606.001579][ T4276] semitek 0003:1EA7:0907.0027: hidraw0: USB HID v90.01 Device [HID 1ea7:0907] on usb-dummy_hcd.8-1/input0 [ 606.051423][T16718] exfat: Deprecated parameter 'utf8' [ 606.152907][ T4276] usb 9-1: USB disconnect, device number 8 [ 606.230367][T16718] exFAT-fs (loop9): failed to load upcase table (idx : 0x00010000, chksum : 0xd67973f8, utbl_chksum : 0xe619d30d) [ 606.331834][T16719] fido_id[16719]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 606.972028][ T4276] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 607.192322][ T4276] usb 6-1: Using ep0 maxpacket: 16 [ 607.201745][ T4276] usb 6-1: config 0 has an invalid interface number: 98 but max is 0 [ 607.270819][ T4276] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 607.343733][ T4276] usb 6-1: config 0 has no interface number 0 [ 607.376758][ T4276] usb 6-1: config 0 interface 98 altsetting 2 bulk endpoint 0x8 has invalid maxpacket 16 [ 607.446057][T16735] loop6: detected capacity change from 0 to 8192 [ 607.460116][ T4276] usb 6-1: config 0 interface 98 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 607.550631][ T4276] usb 6-1: config 0 interface 98 has no altsetting 0 [ 607.569868][T16735] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 607.669028][ T4276] usb 6-1: New USB device found, idVendor=0846, idProduct=1040, bcdDevice=d0.c9 [ 607.773662][ T4276] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.869965][ T4276] usb 6-1: Product: syz [ 607.899386][ T4276] usb 6-1: Manufacturer: syz [ 607.933606][ T4276] usb 6-1: SerialNumber: syz [ 608.077560][ T4276] usb 6-1: config 0 descriptor?? [ 608.118097][T16724] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 608.191374][T16724] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 608.470592][T16724] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 608.535613][T16724] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 608.762271][ T5026] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 608.994111][ T5026] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 609.056039][ T5026] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.080612][T16752] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5028'. [ 609.125961][ T5026] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 609.212249][ T4276] asix 6-1:0.98 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 609.230992][ T5026] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 609.251348][ T4276] asix: probe of 6-1:0.98 failed with error -71 [ 609.296238][ T5026] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.317793][ T4276] usb 6-1: USB disconnect, device number 25 [ 609.382318][ T5026] usb 10-1: config 0 descriptor?? [ 609.539512][T16758] loop8: detected capacity change from 0 to 1024 [ 609.807137][ T5026] plantronics 0003:047F:FFFF.0028: No inputs registered, leaving [ 609.839655][ T26] kauditd_printk_skb: 15 callbacks suppressed [ 609.839742][ T26] audit: type=1800 audit(1791252514.645:207): pid=16758 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.8.5029" name="file1" dev="loop8" ino=20 res=0 errno=0 [ 609.876269][ T26] audit: type=1800 audit(1791252514.665:208): pid=16758 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.8.5029" name="file1" dev="loop8" ino=20 res=0 errno=0 [ 609.928503][ T5026] plantronics 0003:047F:FFFF.0028: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.9-1/input0 [ 609.964925][ T26] audit: type=1800 audit(1791252514.775:209): pid=16762 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.8.5029" name="file1" dev="loop8" ino=20 res=0 errno=0 [ 610.059559][T16764] loop6: detected capacity change from 0 to 256 [ 612.700903][ T5026] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 612.904625][ T5026] usb 9-1: config 0 has an invalid interface number: 255 but max is 0 [ 612.939582][ T5026] usb 9-1: config 0 has no interface number 0 [ 612.985728][ T5026] usb 9-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 613.059758][ T5026] usb 9-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 613.136918][ T5026] usb 9-1: config 0 interface 255 has no altsetting 0 [ 613.178382][ T5026] usb 9-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 613.190282][T16785] loop9: detected capacity change from 0 to 4096 [ 613.227213][ T5026] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 613.296643][ T4317] usb 10-1: USB disconnect, device number 4 [ 613.309559][ T5026] usb 9-1: config 0 descriptor?? [ 613.382959][T16785] ntfs3: loop9: Mark volume as dirty due to NTFS errors [ 613.394280][ T5026] cp210x 9-1:0.255: cp210x converter detected [ 613.428900][T16785] ntfs3: loop9: Failed to load $Extend. [ 613.541004][ T5027] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 613.798559][ T5027] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 613.814259][ T5026] cp210x 9-1:0.255: failed to get vendor val 0x000e size 3: -32 [ 613.886025][ T5027] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 613.989408][ T5027] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 614.049334][ T5026] cp210x 9-1:0.255: GPIO initialisation failed: -19 [ 614.074192][ T5026] usb 9-1: cp210x converter now attached to ttyUSB0 [ 614.092959][ T5027] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 614.102818][T16791] tipc: Started in network mode [ 614.139692][T16791] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 614.154183][ T5027] usb 4-1: SerialNumber: syz [ 614.189242][T16791] tipc: Enabled bearer , priority 10 [ 614.254372][ T5031] usb 9-1: USB disconnect, device number 9 [ 614.297936][ T5031] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 614.352530][ T5031] cp210x 9-1:0.255: device disconnected [ 614.400592][ T5027] usb 4-1: 0:2 : does not exist [ 614.421437][ T5027] usb 4-1: unit 5: unexpected type 0x03 [ 614.440965][ T5026] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 614.554780][ T5027] usb 4-1: USB disconnect, device number 35 [ 614.642723][ T5026] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 614.690638][ T5026] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 614.751191][ T5026] usb 10-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 614.809067][ T5026] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.914153][ T5026] usb 10-1: config 0 descriptor?? [ 615.301640][ T5027] tipc: Node number set to 8432298 [ 615.337693][ T5026] playstation 0003:054C:0DF2.0029: unknown main item tag 0x0 [ 615.386935][ T5026] playstation 0003:054C:0DF2.0029: unknown main item tag 0x0 [ 615.448871][ T5026] playstation 0003:054C:0DF2.0029: unknown main item tag 0x0 [ 615.489992][T16803] FAULT_INJECTION: forcing a failure. [ 615.489992][T16803] name failslab, interval 1, probability 0, space 0, times 0 [ 615.525233][ T5026] playstation 0003:054C:0DF2.0029: unknown main item tag 0x0 [ 615.571307][ T5026] playstation 0003:054C:0DF2.0029: unknown main item tag 0x0 [ 615.601618][T16803] CPU: 0 PID: 16803 Comm: syz.5.5061 Not tainted syzkaller #0 [ 615.609127][T16803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 615.619187][T16803] Call Trace: [ 615.622458][T16803] [ 615.625376][T16803] dump_stack_lvl+0x188/0x24e [ 615.630067][T16803] ? show_regs_print_info+0x12/0x12 [ 615.635264][T16803] ? load_image+0x410/0x410 [ 615.639761][T16803] ? __might_sleep+0xd0/0xd0 [ 615.644342][T16803] ? __lock_acquire+0x7ea0/0x7ea0 [ 615.649361][T16803] should_fail_ex+0x390/0x4c0 [ 615.654133][T16803] should_failslab+0x5/0x20 [ 615.658646][T16803] slab_pre_alloc_hook+0x59/0x300 [ 615.663676][T16803] ? __se_sys_futex_waitv+0x20d/0x6d0 [ 615.669047][T16803] __kmem_cache_alloc_node+0x4f/0x270 [ 615.674420][T16803] ? __se_sys_futex_waitv+0x20d/0x6d0 [ 615.679786][T16803] __kmalloc+0xa3/0x240 [ 615.683942][T16803] __se_sys_futex_waitv+0x20d/0x6d0 [ 615.689159][T16803] ? __x64_sys_futex_waitv+0xc0/0xc0 [ 615.694446][T16803] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 615.700789][T16803] ? syscall_enter_from_user_mode+0x2a/0x80 [ 615.706693][T16803] ? __x64_sys_futex_waitv+0x1c/0xc0 [ 615.711979][T16803] do_syscall_64+0x4c/0xa0 [ 615.716391][T16803] ? clear_bhb_loop+0x60/0xb0 [ 615.721063][T16803] ? clear_bhb_loop+0x60/0xb0 [ 615.725737][T16803] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 615.731628][T16803] RIP: 0033:0x7fd9bf19e199 [ 615.736038][T16803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 615.755728][T16803] RSP: 002b:00007fd9c00d2028 EFLAGS: 00000246 ORIG_RAX: 00000000000001c1 [ 615.764136][T16803] RAX: ffffffffffffffda RBX: 00007fd9bf425fa0 RCX: 00007fd9bf19e199 [ 615.772099][T16803] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000780 [ 615.780061][T16803] RBP: 00007fd9bf2358e0 R08: 0000000000000001 R09: 0000000000000000 [ 615.788024][T16803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 615.795986][T16803] R13: 00007fd9bf426038 R14: 00007fd9bf425fa0 R15: 00007ffe56d29808 [ 615.803969][T16803] [ 615.965086][ T5026] playstation 0003:054C:0DF2.0029: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.9-1/input0 [ 616.042283][ T5026] playstation 0003:054C:0DF2.0029: Failed to retrieve feature with reportID 9: -71 [ 616.073640][ T5026] playstation 0003:054C:0DF2.0029: Failed to retrieve DualSense pairing info: -71 [ 616.131158][ T5026] playstation 0003:054C:0DF2.0029: Failed to get MAC address from DualSense [ 616.194501][ T5026] playstation 0003:054C:0DF2.0029: Failed to create dualsense. [ 616.242212][ T5026] playstation: probe of 0003:054C:0DF2.0029 failed with error -71 [ 616.295724][ T5026] usb 10-1: USB disconnect, device number 5 [ 616.387287][ T5027] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 616.408289][T16814] fido_id[16814]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.9/usb10/report_descriptor': No such file or directory [ 616.623966][ T5027] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.676106][ T5027] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.738302][ T5027] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 616.805090][ T5027] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 616.847394][ T5027] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.892286][ T5027] usb 9-1: config 0 descriptor?? [ 617.112811][T16825] loop6: detected capacity change from 0 to 512 [ 617.218860][T16825] EXT4-fs error (device loop6): ext4_validate_block_bitmap:429: comm syz.6.5058: bg 0: block 5: invalid block bitmap [ 617.335652][T16825] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 617.349414][ T5027] plantronics 0003:047F:FFFF.002A: No inputs registered, leaving [ 617.389749][ T5027] plantronics 0003:047F:FFFF.002A: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 617.422543][T16825] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.5058: invalid indirect mapped block 3 (level 2) [ 617.576240][T16825] EXT4-fs (loop6): 1 orphan inode deleted [ 617.680448][T16825] EXT4-fs (loop6): 1 truncate cleaned up [ 617.711408][T16825] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 617.859162][ T26] audit: type=1800 audit(1791252522.665:210): pid=16825 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed(directio) comm="syz.6.5058" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 618.156874][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 618.941662][ T5026] usb 9-1: reset high-speed USB device number 10 using dummy_hcd [ 619.068579][T16843] loop6: detected capacity change from 0 to 8192 [ 619.214887][T16843] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 619.805355][ T5027] usb 9-1: USB disconnect, device number 10 [ 620.349371][T16864] loop8: detected capacity change from 0 to 512 [ 620.441721][T16864] EXT4-fs: Ignoring removed oldalloc option [ 620.605273][T16864] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 620.694578][T16864] ext4 filesystem being mounted at /124/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 621.105883][T16883] loop9: detected capacity change from 0 to 1024 [ 621.139017][T15074] EXT4-fs (loop8): unmounting filesystem. [ 621.180505][T16883] EXT4-fs: Ignoring removed bh option [ 621.280940][ T5027] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 621.352725][T16883] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 621.514349][ T5027] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 621.589349][ T5027] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 621.680948][ T5027] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 621.716033][T16889] loop6: detected capacity change from 0 to 1 [ 621.760973][ T5027] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 621.781286][T16889] Dev loop6: unable to read RDB block 1 [ 621.798676][T16889] loop6: unable to read partition table [ 621.821549][ T5027] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.842239][T16889] loop6: partition table beyond EOD, truncated [ 621.868944][T15512] EXT4-fs (loop9): unmounting filesystem. [ 621.897056][T16889] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 621.910834][ T5027] usb 7-1: config 0 descriptor?? [ 622.369527][ T5027] plantronics 0003:047F:FFFF.002B: No inputs registered, leaving [ 622.438368][ T5027] plantronics 0003:047F:FFFF.002B: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 622.493353][ T4317] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 622.711337][ T4317] usb 10-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 622.768547][ T4317] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.838672][ T4317] usb 10-1: config 0 descriptor?? [ 622.899657][ T4317] cp210x 10-1:0.0: cp210x converter detected [ 623.300845][ T4317] cp210x 10-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 623.526332][ T4317] usb 10-1: cp210x converter now attached to ttyUSB0 [ 623.727988][ T5031] usb 10-1: USB disconnect, device number 6 [ 623.757715][ T5031] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 623.825646][ T5031] cp210x 10-1:0.0: device disconnected [ 624.199397][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.207240][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.495043][ T5027] usb 7-1: USB disconnect, device number 30 [ 624.650904][ T4276] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 624.863805][ T4276] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 624.927372][ T4276] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 625.048675][ T4276] usb 9-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 625.110321][ T4276] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 625.172745][ T4276] usb 9-1: Product: syz [ 625.178554][ T4276] usb 9-1: Manufacturer: syz [ 625.268066][ T4276] mos7840 9-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 625.501456][ T5027] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 625.701533][ T5027] usb 7-1: Using ep0 maxpacket: 32 [ 625.710225][ T5027] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.838449][ T5027] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 625.905754][ T5027] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.955679][ T5031] Process accounting resumed [ 625.977877][ T5027] usb 7-1: config 0 descriptor?? [ 626.104357][T16941] Process accounting resumed [ 626.269921][ T5027] usb 7-1: USB disconnect, device number 31 [ 626.280079][ T4276] mos7840: probe of ttyUSB0 failed with error -71 [ 626.342012][ T4276] usb 9-1: USB disconnect, device number 11 [ 626.404045][ T4276] mos7840 9-1:1.0: device disconnected [ 627.159369][T16957] loop6: detected capacity change from 0 to 8 [ 627.256392][T16956] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 627.325008][T16957] SQUASHFS error: Unable to read inode 0x11f [ 627.514715][T16957] loop6: detected capacity change from 0 to 512 [ 627.610565][T16957] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 627.768106][T16957] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 627.851321][T16957] System zones: 1-12 [ 627.922589][T16957] EXT4-fs (loop6): 1 truncate cleaned up [ 627.979799][T16957] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 628.334658][ T9848] EXT4-fs (loop6): unmounting filesystem. [ 628.957829][T16980] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 629.208834][T16980] CIFS mount error: No usable UNC path provided in device string! [ 629.208834][T16980] [ 629.336338][T16980] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 630.082040][T16968] loop8: detected capacity change from 0 to 32768 [ 630.243324][T16968] XFS (loop8): Mounting V5 Filesystem [ 630.442298][T16968] XFS (loop8): Ending clean mount [ 630.560002][T16968] XFS (loop8): Quotacheck needed: Please wait. [ 630.645222][ T26] audit: type=1326 audit(1791252535.455:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.690167][ T26] audit: type=1326 audit(1791252535.455:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.725951][ T26] audit: type=1326 audit(1791252535.455:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.761124][T16968] XFS (loop8): Quotacheck: Done. [ 630.762798][ T26] audit: type=1326 audit(1791252535.455:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.800271][ T26] audit: type=1326 audit(1791252535.455:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.833109][ T26] audit: type=1326 audit(1791252535.455:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.868219][ T26] audit: type=1326 audit(1791252535.455:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.878613][T16995] tipc: Resetting bearer [ 630.900554][ T26] audit: type=1326 audit(1791252535.455:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.947513][ T26] audit: type=1326 audit(1791252535.455:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 630.981809][ T26] audit: type=1326 audit(1791252535.455:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=16987 comm="syz.9.5118" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9fb9e199 code=0x7fc00000 [ 631.202992][T16995] bridge0: port 2(bridge_slave_1) entered blocking state [ 631.211270][T16995] bridge0: port 2(bridge_slave_1) entered listening state [ 631.219671][T16995] bridge0: port 1(bridge_slave_0) entered blocking state [ 631.228111][T16995] bridge0: port 1(bridge_slave_0) entered listening state [ 631.252380][T15074] XFS (loop8): Unmounting Filesystem [ 632.151396][ T4276] usb 4-1: new low-speed USB device number 36 using dummy_hcd [ 632.355974][ T4276] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 632.390834][ T4276] usb 4-1: config 0 has no interface number 0 [ 632.449263][ T4276] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 632.565009][ T4276] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 632.620410][T17028] loop8: detected capacity change from 0 to 64 [ 632.663566][ T4276] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 632.751295][ T4276] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.894003][ T4276] usb 4-1: config 0 descriptor?? [ 632.965292][T17019] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 633.031379][ T4276] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 633.558823][T17035] loop8: detected capacity change from 0 to 128 [ 633.699142][T17035] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=256, location=256 [ 634.049137][ C0] iowarrior 4-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 634.061601][ T4276] usb 4-1: USB disconnect, device number 36 [ 634.767264][T17047] loop8: detected capacity change from 0 to 512 [ 634.931817][T17047] EXT4-fs (loop8): Test dummy encryption mode enabled [ 635.072520][T17049] FAULT_INJECTION: forcing a failure. [ 635.072520][T17049] name failslab, interval 1, probability 0, space 0, times 0 [ 635.098211][T17047] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 635.249396][T17047] EXT4-fs error (device loop8): ext4_orphan_get:1435: comm syz.8.5139: bad orphan inode 131083 [ 635.262111][T17049] CPU: 0 PID: 17049 Comm: syz.3.5140 Not tainted syzkaller #0 [ 635.269575][T17049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 635.279624][T17049] Call Trace: [ 635.282896][T17049] [ 635.285819][T17049] dump_stack_lvl+0x188/0x24e [ 635.290489][T17049] ? show_regs_print_info+0x12/0x12 [ 635.295675][T17049] ? load_image+0x410/0x410 [ 635.300173][T17049] ? __might_sleep+0xd0/0xd0 [ 635.304748][T17049] ? __lock_acquire+0x7ea0/0x7ea0 [ 635.309762][T17049] should_fail_ex+0x390/0x4c0 [ 635.314430][T17049] should_failslab+0x5/0x20 [ 635.318930][T17049] slab_pre_alloc_hook+0x59/0x300 [ 635.323959][T17049] kmem_cache_alloc+0x56/0x2f0 [ 635.328732][T17049] ? dup_fd+0x52/0xa20 [ 635.332805][T17049] dup_fd+0x52/0xa20 [ 635.336699][T17049] ? __ia32_sys_get_robust_list+0x100/0x100 [ 635.342588][T17049] ? lock_chain_count+0x20/0x20 [ 635.347432][T17049] ? rcu_is_watching+0x11/0xa0 [ 635.352285][T17049] __close_range+0x194/0x770 [ 635.356876][T17049] ? pick_file+0x1e0/0x1e0 [ 635.361295][T17049] __x64_sys_close_range+0x76/0x80 [ 635.366405][T17049] do_syscall_64+0x4c/0xa0 [ 635.370819][T17049] ? clear_bhb_loop+0x60/0xb0 [ 635.375496][T17049] ? clear_bhb_loop+0x60/0xb0 [ 635.380193][T17049] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 635.386081][T17049] RIP: 0033:0x7f8b80d9e199 [ 635.390490][T17049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.410093][T17049] RSP: 002b:00007f8b81d05028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 635.418504][T17049] RAX: ffffffffffffffda RBX: 00007f8b81025fa0 RCX: 00007f8b80d9e199 [ 635.426480][T17049] RDX: 0000000000000002 RSI: 0000000000000003 RDI: 0000000000000003 [ 635.434526][T17049] RBP: 00007f8b80e358e0 R08: 0000000000000000 R09: 0000000000000000 [ 635.442491][T17049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 635.450451][T17049] R13: 00007f8b81026038 R14: 00007f8b81025fa0 R15: 00007ffd6592d058 [ 635.458435][T17049] [ 635.583749][T17051] loop9: detected capacity change from 0 to 1024 [ 635.596903][T17051] EXT4-fs: Ignoring removed bh option [ 635.681235][T17051] EXT4-fs: Ignoring removed bh option [ 635.710539][T17047] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 635.787606][T17051] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 635.867762][T17047] EXT4-fs error (device loop8): ext4_readdir:263: inode #2: block 13: comm syz.8.5139: path /136/bus: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 636.036940][T17051] EXT4-fs error (device loop9): ext4_find_dest_de:2117: inode #12: block 7: comm syz.9.5141: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 636.223597][T17058] overlayfs: conflicting lowerdir path [ 636.276740][T15074] EXT4-fs (loop8): unmounting filesystem. [ 636.362135][ T4317] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 636.413975][T17051] EXT4-fs (loop9): Remounting filesystem read-only [ 636.570847][ T4317] usb 7-1: Using ep0 maxpacket: 8 [ 636.582026][ T4317] usb 7-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 636.624624][ T4317] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.654891][ T4317] usb 7-1: Product: syz [ 636.669913][ T4317] usb 7-1: Manufacturer: syz [ 636.693271][ T4317] usb 7-1: SerialNumber: syz [ 636.727354][ T4317] usb 7-1: config 0 descriptor?? [ 636.734916][T15512] EXT4-fs (loop9): unmounting filesystem. [ 636.795601][ T4317] gspca_main: sonixj-2.14.0 probing 0c45:614a [ 637.046325][T17068] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5146'. [ 637.742315][ T4276] hid-generic 0000:0000:0000.002C: unknown main item tag 0x0 [ 637.773755][ T4317] gspca_sonixj: reg_w err -71 [ 637.779293][ T4317] sonixj: probe of 7-1:0.0 failed with error -71 [ 637.838670][ T4276] hid-generic 0000:0000:0000.002C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 637.870598][ T4317] usb 7-1: USB disconnect, device number 32 [ 638.911136][ T28] INFO: task syz.7.4486:15282 blocked for more than 143 seconds. [ 638.918945][ T28] Not tainted syzkaller #0 [ 638.936764][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 638.946822][ T28] task:syz.7.4486 state:D stack:27888 pid:15282 ppid:12080 flags:0x00004004 [ 638.963704][ T28] Call Trace: [ 638.967019][ T28] [ 638.969978][ T28] __schedule+0x107f/0x4030 [ 638.986561][ T28] ? release_firmware_map_entry+0x187/0x187 [ 639.006962][ T28] ? __mutex_trylock_common+0x86/0x260 [ 639.025881][ T28] ? trace_raw_output_contention_end+0xd0/0xd0 [ 639.034791][ T28] schedule+0xb9/0x180 [ 639.038974][ T28] schedule_preempt_disabled+0xf/0x20 [ 639.050204][ T28] __mutex_lock+0x548/0xae0 [ 639.057210][ T28] ? __mutex_lock+0x3ba/0xae0 [ 639.067227][ T28] ? write_versions+0x90/0xbb0 [ 639.074453][ T28] ? mutex_lock_nested+0x10/0x10 [ 639.079645][ T28] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 639.091226][ T28] write_versions+0x90/0xbb0 [ 639.095952][ T28] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 639.108422][ T28] ? write_pool_threads+0x5e0/0x5e0 [ 639.115168][ T28] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 639.131051][ T28] nfsctl_transaction_write+0x105/0x150 [ 639.141117][ T28] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 639.150538][ T28] vfs_write+0x2dc/0x9a0 [ 639.159570][ T28] ? file_end_write+0x250/0x250 [ 639.169188][ T28] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 639.179166][ T28] ? __fdget_pos+0x23d/0x360 [ 639.188319][ T28] ? __fdget_pos+0x2ae/0x360 [ 639.196522][ T28] ? ksys_write+0x70/0x260 [ 639.205420][ T28] ksys_write+0x14d/0x260 [ 639.209876][ T28] ? __ia32_sys_read+0x80/0x80 [ 639.218202][ T28] ? lockdep_hardirqs_on+0x94/0x140 [ 639.228020][ T28] do_syscall_64+0x4c/0xa0 [ 639.241066][ T28] ? clear_bhb_loop+0x60/0xb0 [ 639.250293][ T28] ? clear_bhb_loop+0x60/0xb0 [ 639.257326][ T28] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 639.268652][ T28] RIP: 0033:0x7f5ed4f9e199 [ 639.275496][ T28] RSP: 002b:00007f5ed5e1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 639.289424][ T28] RAX: ffffffffffffffda RBX: 00007f5ed5225fa0 RCX: 00007f5ed4f9e199 [ 639.300195][ T28] RDX: 0000000000000015 RSI: 00002000000001c0 RDI: 0000000000000003 [ 639.315381][ T28] RBP: 00007f5ed50358e0 R08: 0000000000000000 R09: 0000000000000000 [ 639.331049][ T28] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 639.339164][ T28] R13: 00007f5ed5226038 R14: 00007f5ed5225fa0 R15: 00007ffd944bbac8 [ 639.360563][ T28] [ 639.366161][ T28] [ 639.366161][ T28] Showing all locks held in the system: [ 639.380256][ T28] 1 lock held by rcu_tasks_kthre/12: [ 639.387360][ T28] #0: ffffffff8cb2e230 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 [ 639.410040][ T28] 1 lock held by rcu_tasks_trace/13: [ 639.419155][ T28] #0: ffffffff8cb2ea50 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 [ 639.434752][ T28] 1 lock held by khungtaskd/28: [ 639.439746][ T28] #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 [ 639.453662][ T28] 2 locks held by getty/11802: [ 639.458560][ T28] #0: ffff88802f43f098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 [ 639.478557][ T28] #1: ffffc900040fe2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 [ 639.496588][ T28] 3 locks held by syz.4.4270/14748: [ 639.503282][ T28] #0: ffff888079734368 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 [ 639.518921][ T28] #1: ffff888055512460 (sb_writers#27){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 [ 639.529755][ T28] #2: ffffffff8cdccf08 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb3/0xb80 [ 639.546627][ T28] 3 locks held by syz.7.4486/15282: [ 639.554630][ T28] #0: ffff88801da41768 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 [ 639.570608][ T28] #1: ffff88804359c460 (sb_writers#27){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 [ 639.579796][ T28] #2: ffffffff8cdccf08 (nfsd_mutex){+.+.}-{3:3}, at: write_versions+0x90/0xbb0 [ 639.601628][ T28] 2 locks held by kworker/u4:8/16192: [ 639.609373][ T28] #0: ffff8880b8f3acd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 [ 639.630840][ T28] #1: ffff8880b8f27888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x400/0x740 [ 639.656716][ T28] 3 locks held by syz.5.5105/16953: [ 639.669595][ T28] 2 locks held by syz.8.5151/17077: [ 639.679894][ T28] 1 lock held by syz.5.5154/17085: [ 639.691922][ T28] #0: ffff888025e271d8 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x16c/0x2d0 [ 639.713257][ T28] 1 lock held by syz.5.5154/17087: [ 639.718491][ T28] 1 lock held by syz.3.5160/17098: [ 639.729080][ T28] 2 locks held by dhcpcd/17100: [ 639.737798][ T28] #0: ffff88802837a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 [ 639.752617][ T28] #1: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 [ 639.769312][ T28] [ 639.774039][ T28] ============================================= [ 639.774039][ T28] [ 639.788011][ T28] NMI backtrace for cpu 1 [ 639.792377][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 639.799590][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 639.809668][ T28] Call Trace: [ 639.812965][ T28] [ 639.815906][ T28] dump_stack_lvl+0x188/0x24e [ 639.820607][ T28] ? irq_work_queue+0xb8/0x140 [ 639.825495][ T28] ? show_regs_print_info+0x12/0x12 [ 639.830716][ T28] ? load_image+0x410/0x410 [ 639.835237][ T28] ? vprintk_emit+0x59f/0x6a0 [ 639.839940][ T28] ? printk_sprint+0x460/0x460 [ 639.844739][ T28] nmi_cpu_backtrace+0x3e6/0x460 [ 639.849716][ T28] ? nmi_trigger_cpumask_backtrace+0x450/0x450 [ 639.855897][ T28] ? _printk+0xda/0x130 [ 639.860081][ T28] ? load_image+0x410/0x410 [ 639.864615][ T28] ? load_image+0x410/0x410 [ 639.869143][ T28] ? nmi_trigger_cpumask_backtrace+0xf3/0x450 [ 639.875233][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 639.881320][ T28] nmi_trigger_cpumask_backtrace+0x1d4/0x450 [ 639.887329][ T28] watchdog+0xf0e/0xf50 [ 639.891532][ T28] ? watchdog+0x1ed/0xf50 [ 639.895885][ T28] kthread+0x29d/0x330 [ 639.899965][ T28] ? hungtask_pm_notify+0x40/0x40 [ 639.905009][ T28] ? kthread_blkcg+0xd0/0xd0 [ 639.909617][ T28] ret_from_fork+0x1f/0x30 [ 639.914187][ T28] [ 639.917687][ T28] Sending NMI from CPU 1 to CPUs 0: [ 639.922971][ C0] NMI backtrace for cpu 0 [ 639.922981][ C0] CPU: 0 PID: 17077 Comm: syz.8.5151 Not tainted syzkaller #0 [ 639.922996][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 639.923004][ C0] RIP: 0010:__lock_acquire+0xab4/0x7ea0 [ 639.923031][ C0] Code: 3d b0 91 5f 15 00 0f 84 99 00 00 00 45 31 f6 4d 8d a6 c8 00 00 00 4c 89 e0 48 c1 e8 03 42 0f b6 04 00 84 c0 0f 85 24 01 00 00 <45> 0f b6 24 24 45 84 e4 74 3e 0f b6 84 24 88 00 00 00 41 0f b6 cc [ 639.923043][ C0] RSP: 0018:ffffc900000078c0 EFLAGS: 00000046 [ 639.923057][ C0] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffff81640f49 [ 639.923068][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b33248 [ 639.923078][ C0] RBP: ffffc90000007b08 R08: dffffc0000000000 R09: 1ffffffff2166649 [ 639.923088][ C0] R10: dffffc0000000000 R11: fffffbfff216664a R12: ffffffff904a0308 [ 639.923099][ C0] R13: ffff8880197b2950 R14: ffffffff904a0240 R15: ffff8880197b2950 [ 639.923110][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 639.923122][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 639.923133][ C0] CR2: 00007f8b80fef158 CR3: 000000002c1b5000 CR4: 00000000003506f0 [ 639.923147][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 639.923155][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 639.923165][ C0] Call Trace: [ 639.923170][ C0] [ 639.923177][ C0] ? verify_lock_unused+0x140/0x140 [ 639.923205][ C0] ? mark_lock+0x94/0x320 [ 639.923225][ C0] ? verify_lock_unused+0x140/0x140 [ 639.923243][ C0] ? __lock_acquire+0x142d/0x7ea0 [ 639.923277][ C0] lock_acquire+0x1bc/0x4a0 [ 639.923296][ C0] ? debug_object_deactivate+0x63/0x380 [ 639.923398][ C0] ? __rwlock_init+0x140/0x140 [ 639.923412][ C0] ? read_lock_is_recursive+0x10/0x10 [ 639.923433][ C0] ? xfrm_dev_backlog+0x248/0x3c0 [ 639.923484][ C0] _raw_spin_lock_irqsave+0xb0/0x100 [ 639.923507][ C0] ? debug_object_deactivate+0x63/0x380 [ 639.923521][ C0] ? _raw_spin_lock+0x40/0x40 [ 639.923543][ C0] ? ktime_get_update_offsets_now+0x95/0x3e0 [ 639.923565][ C0] debug_object_deactivate+0x63/0x380 [ 639.923583][ C0] __hrtimer_run_queues+0x2d8/0xc90 [ 639.923599][ C0] ? ktime_get_update_offsets_now+0x95/0x3e0 [ 639.923619][ C0] ? ktime_get_real_ts64+0x440/0x440 [ 639.923640][ C0] ? hrtimer_interrupt+0x980/0x980 [ 639.923655][ C0] ? ktime_get_update_offsets_now+0x3ce/0x3e0 [ 639.923677][ C0] hrtimer_interrupt+0x399/0x980 [ 639.923701][ C0] __sysvec_apic_timer_interrupt+0x153/0x5a0 [ 639.923729][ C0] sysvec_apic_timer_interrupt+0x9b/0xc0 [ 639.923750][ C0] [ 639.923754][ C0] [ 639.923759][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 639.923776][ C0] RIP: 0010:check_preemption_disabled+0x2e/0x110 [ 639.923798][ C0] Code: 56 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 65 8b 05 11 4b ce 75 65 8b 0d b2 a0 ce 75 f7 c1 ff ff ff 7f 74 1f <65> 48 8b 0c 25 28 00 00 00 48 3b 4c 24 08 0f 85 c4 00 00 00 48 83 [ 639.923810][ C0] RSP: 0018:ffffc900034175c8 EFLAGS: 00000202 [ 639.923822][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080000002 [ 639.923831][ C0] RDX: 0000000000000000 RSI: ffffffff8adf6dc0 RDI: ffffffff8adf6d80 [ 639.923841][ C0] RBP: ffffc90003417740 R08: ffffffff8e20d96f R09: 1ffffffff1c41b2d [ 639.923851][ C0] R10: dffffc0000000000 R11: fffffbfff1c41b2e R12: 1ffff92000682ed0 [ 639.923870][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000 [ 639.923889][ C0] rcu_is_watching+0x11/0xa0 [ 639.923910][ C0] lock_acquire+0xe2/0x4a0 [ 639.923931][ C0] ? pfn_valid+0xcd/0x420 [ 639.923980][ C0] ? read_lock_is_recursive+0x10/0x10 [ 639.924000][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 639.924019][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 639.924039][ C0] ? pfn_valid+0xcd/0x420 [ 639.924057][ C0] ? page_ext_get+0x1e/0x2a0 [ 639.924076][ C0] page_ext_get+0x3a/0x2a0 [ 639.924094][ C0] ? page_ext_get+0x1e/0x2a0 [ 639.924114][ C0] page_table_check_clear+0x4a/0x6b0 [ 639.924133][ C0] ? __page_table_check_pte_clear+0x3f/0x70 [ 639.924154][ C0] unmap_page_range+0x1905/0x25b0 [ 639.924188][ C0] unmap_vmas+0x260/0x390 [ 639.924208][ C0] ? unmap_vmas+0x1bd/0x390 [ 639.924229][ C0] ? unmap_page_range+0x25b0/0x25b0 [ 639.924251][ C0] ? __lock_acquire+0x7ea0/0x7ea0 [ 639.924282][ C0] exit_mmap+0x20d/0x970 [ 639.924302][ C0] ? vm_brk+0x20/0x20 [ 639.924319][ C0] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 639.924342][ C0] ? exit_mm+0x23d/0x350 [ 639.924392][ C0] ? uprobe_clear_state+0x274/0x290 [ 639.924445][ C0] __mmput+0x118/0x3a0 [ 639.924461][ C0] exit_mm+0x24d/0x350 [ 639.924480][ C0] ? sysctl_delayacct+0x220/0x220 [ 639.924501][ C0] ? do_exit+0x2570/0x2570 [ 639.924523][ C0] ? tty_audit_exit+0x149/0x1f0 [ 639.924546][ C0] do_exit+0x958/0x2570 [ 639.924566][ C0] ? lock_chain_count+0x20/0x20 [ 639.924587][ C0] ? preempt_schedule_common+0xa5/0xd0 [ 639.924604][ C0] ? put_task_struct+0x80/0x80 [ 639.924623][ C0] ? preempt_schedule+0xbc/0xd0 [ 639.924640][ C0] ? schedule_preempt_disabled+0x20/0x20 [ 639.924664][ C0] do_group_exit+0x229/0x2e0 [ 639.924686][ C0] __x64_sys_exit_group+0x3b/0x40 [ 639.924706][ C0] do_syscall_64+0x4c/0xa0 [ 639.924722][ C0] ? clear_bhb_loop+0x60/0xb0 [ 639.924737][ C0] ? clear_bhb_loop+0x60/0xb0 [ 639.924753][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 639.924768][ C0] RIP: 0033:0x7f0af359e199 [ 639.924780][ C0] Code: Unable to access opcode bytes at 0x7f0af359e16f. [ 639.924815][ C0] RSP: 002b:00007ffeaaefa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 639.924830][ C0] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0af359e199 [ 639.924840][ C0] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 [ 639.924849][ C0] RBP: 00007ffeaaefa79c R08: 0000000000000000 R09: 00000000000927c0 [ 639.924858][ C0] R10: 0000000000000001 R11: 0000000000000246 R12: 000000000000008c [ 639.924867][ C0] R13: 00000000000927c0 R14: 000000000009b9da R15: 00007ffeaaefa7f0 [ 639.924883][ C0] [ 640.565396][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 640.572296][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 640.579508][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 640.589593][ T28] Call Trace: [ 640.592881][ T28] [ 640.595820][ T28] dump_stack_lvl+0x188/0x24e [ 640.600518][ T28] ? memcpy+0x3c/0x60 [ 640.604518][ T28] ? show_regs_print_info+0x12/0x12 [ 640.609735][ T28] ? load_image+0x410/0x410 [ 640.614281][ T28] panic+0x2d3/0x710 [ 640.618195][ T28] ? schedule_preempt_disabled+0x20/0x20 [ 640.623859][ T28] ? bpf_jit_dump+0xd0/0xd0 [ 640.628389][ T28] ? __irq_work_queue_local+0x12c/0x190 [ 640.633967][ T28] ? nmi_trigger_cpumask_backtrace+0x35b/0x450 [ 640.640142][ T28] ? nmi_trigger_cpumask_backtrace+0x360/0x450 [ 640.646317][ T28] watchdog+0xf4d/0xf50 [ 640.650502][ T28] ? watchdog+0x1ed/0xf50 [ 640.654861][ T28] kthread+0x29d/0x330 [ 640.658942][ T28] ? hungtask_pm_notify+0x40/0x40 [ 640.663982][ T28] ? kthread_blkcg+0xd0/0xd0 [ 640.668586][ T28] ret_from_fork+0x1f/0x30 [ 640.673030][ T28] [ 640.676293][ T28] Kernel Offset: disabled [ 640.680615][ T28] Rebooting in 86400 seconds..