last executing test programs: 2m21.589285401s ago: executing program 2 (id=1168): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4}, 0x0, &(0x7f0000000100)={0x3ff, 0x6, 0x8000, 0x100009, 0x75, 0xa, 0x9, 0xe}, 0x0, 0x0) 2m18.694944576s ago: executing program 2 (id=1172): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsopen(0x0, 0x0) unshare(0x22020600) rt_sigprocmask(0x1, &(0x7f0000000080)={[0x1]}, &(0x7f0000000180), 0x8) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x46}}}, [0x0, 0x401, 0x828a, 0x7, 0x0, 0x4, 0x3, 0x4, 0xfffffffffffffff8, 0x2009, 0x3ff, 0x1, 0xa, 0x2, 0x9]}, &(0x7f00000005c0)=0x100) setsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000600)={r5, 0x688, 0x3, 0x3}, 0x10) 2m17.56063955s ago: executing program 2 (id=1175): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000200)={0x14, &(0x7f0000000080)=ANY=[@ANYBLOB="4022ff000000ff0ac5cd5db397118ba8e6ab146a1ca04867ff3e82293b819a6507f4c87aebffaac57a0c0b9bb53401a3accd6700b7fabe91a127ea3d9f618221c96d0c19292f2a3982f7776c9d3274ad42ea4a3b8918559a61789f2d8bcfc64a73058129fecddf967cfcf2e5aab93f83146b25b8379237e3a4dc533c6bc56694f10fe2b3bec6901bd7468106d2874eb6ca6efd889025e3330d1f3b65129b5c5b07af5861efdbbef20f7640025dafba3005b332dac0c5b109a7a1c8d0576230b464137c3c679f2cc9fb6dc7a2d845bf73e58d6ffa09625a9b2df81a4f6ca232738ed65516f35dcdce0a2504f4e29eca0c65f829fe2fa0b25ec45a75c6"], 0x0}, &(0x7f0000000500)={0x44, &(0x7f0000000240)={0x0, 0x9, 0x74, "1074057d8bd3c31dccf21c2d3aa72da40a325f9d82b77e82329e0acada086ac88d950e31f8da121b8b45c02f75916341f6926b064750ae81545b16142f61d8e04c773c5c92588e58bb7440708b371325006212020a8fca8079bd74a8ceba4aca45c0727bfe4752be5cb885ddbe47de34f6dd08a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000340), &(0x7f0000000040)='./file0\x00', 0x2000800, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYRESOCT, @ANYRES64=0x0], 0x1, 0x296, &(0x7f0000000740)="$eJzs3U9qU0EcB/Bf0rSJ3SSgK+nigRs3hqY3CFJBDAiRLOoqwbYgTSikENCF7c67uPIO3sBjeAGzKETSF03SxuK/+jT5fCDMD+Z9YSaLzCxm8tpbvaP945PDvdufolRKohBx9v48IiIfa5F68CFt1yMiFxsx6ywAgP9Ns9mpZz0Gbla/X++M927FKz2td5kMCAAAAAAAAAAAgN/W3ipeOf8fw4jKzPn/3KTNO/8PAEvB+f/l1+/XO5uT/ds85/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA7AxHo/Lomk/W4wMA/jzrPwCsHus/AKye4dxanwvrPwAsv2d7z5/UG43dZpKUInpvB61BK23T/vphvIxuHMR2lOM8xvuDibR+9Lixu51cqES7dzrJnw5aa/P5WpSjsjhfS/PJfH49NmfzO1GOO4vzOwvzG3H/XkT+60SrUY6PL+I4urEf4+w0/6aWJA+fNi7lixfPAQAAAAAAAAAAAAAAAAAAwN9QTb5ZeH+/Wv1ef5r/if8HuHS/vhB3C9nOHQAAAAAAAAAAAAAAAAAAAP4VJ69eH3W63YP+wuLz5C7/dc8opsWtH/pWf60oRETmE1SsTJHxDxMAAAAAAAAAAAAAAAAAAKyg6aXfrEcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANmZvv//5oqs5wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACshi8BAAD//2dk6nI=") ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2m16.910647882s ago: executing program 2 (id=1180): creat(0x0, 0xc7) socket$nl_netfilter(0x10, 0x3, 0xc) socket$tipc(0x1e, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x200000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$btrfs(&(0x7f0000000140), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000240)={[{@noenospc_debug}, {@compress}, {@discard}]}, 0xfc, 0x559e, &(0x7f000000ac40)="$eJzs3X9sVeX9B/BzWwoN+C39jhUYfxAgBoMkyJYtjqB4MQa24eKlgsKcCEQlBivYRDcYqUWSZcaghU4EF5GQaDJjscM/FMywy7CMZfzY5hZjs4JSaZZsAzVrHDG69N77XO49l9tembNOXy/SnvPcz3me+9yT88d9X/qcGwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAURUcSc9+d0f3i0ZE1X77/Hz+e+OjGn4zfvX/roVvu23T/gjMjbto5a1nf+mlN8zdsbDjS/PS+ObdGUSLdL5Htf9u136q/88bbvlsdBly+MLOtrS31lJmuJzON4QUP9vcr/FkRRVFVbIDK7PbV7E5FwQC53cbiAQf0Tuui6O7J8ya1dT01bklyYU/xS6df9VBPYKhkr6ue89dSMv27InZErp136SUKLtFM//gF96m8CADgY5mZSm9yb0ezb3Fz7eZ4PdZOxtotsXZ4h9CS37gYmXGHl5rnpHh9iOaZzESFESXnGatnz3+unYr3j7VjUeNjzLPw0GykqS41z7Wx+lDNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCzZOzxo2tWtD2y575fdtQceff9OVc+8KWOw22LT4y8eunKHWum/HTWsr7105rmb9jYcKT56X1zbo2i2nS/RKZ74kTL5b9NjZ3fvXfcG427n6vpq8yOG7bD8g6OXg87s0ZH0cq8Sk8Y9q81UZQqLKSb0Y7iwl3pnW+HAgAAAJ8nX0n/rsi1M3GwqqCdSKfJRPpfkAmL77Quiu6ePG9SW9dT45YkF/Zc/HipEuMlLzherl17/ieRF4xD/I2Pd74eDm0sGmdg8RHjef7SMWPefmty/eSvT5v7xA3PjOru+r8nZ2xJ/bGu5oUrru+tf/a6ovxfO3D+D2dO/gcAAOA/If/HxxnYYPn/jqVTt7z+i2Grft3a8MTB+h1/bv3OMzsXneq54Ud9L09N3v7o1UX5f1LBUxbl/zDjkP8roovL/wAAAPBZ9t/O/8micQY2WP5vONM3+wcHX6vr+PucxXt+9dAVi8+e/tv8U7t3DV9zR8v6uoeuLMr/M8vL/8Pypx0e/F2Y8OrRUTSz/JMKAAAAFAj/737+o4WQ1zOfHMTz+rX/vKp5380ffPMbD97zpzff/s2xA7MnrdteN/PgyzfVf1j5ve3dRfk/WV7+r/p0Xi4AAABQhuePrpw773jPucfPvtB18vDu3pMznjyzrqnvdOslLatXbTr2WlH+T5WX/0cMzcsBAAAALuDeO59bsfnVl/oe2H/X2Ck9FVc1XpK4ZduOqU0TPuq8tPfy7VuL8v/y8vL/yOw2u/Ih06kz/BVC6+goqu7fWZspHIparskVAAAAgE9IyOlbP1ixbOzOsb3jj59+rObQG4dn/2Vt55yN13RXdW/uXNZ4WdH9AkJiL3X//3Cng7D+v+D+f0Xr//MKmbv+zXZjAAAAAL6Iitfzh9vjZ765oNT375e7/n9J3cQTiba33lv11XMHzo1ZsP/7129aV9/be8+El37/wz9M/6i6KP83l5f/K/O3n+T3/wEAAMBF+F/7/r+lReMMbLD7/zdV9DWsWrd3+uota7csTCw7UH3qwdV731+w5l9Tb36+qea6A0X5v6W8/B+2o/JfXkc4P5tGR9H4/p3s3QR/Hqa7OlZor8orZE58rMeNoUe20D4ir5C2Ntbja6OjaHL/TnOs8P+h0BIrnK3JFnbFCsdCIXs95Ap7YoWOcKVtq8lON154MRSyCyzawwqKUbklEbEe75Xq0V+4YI+u3JMDAAB8oYTwnM2yVYXNKB5l2xODHTBysAMqBjugcrADhsUOiB9Y6vFoeWEhPH575yMbNjVMSb7y8NzHfvbms40T9j1+WV3v5g9f2XbvxJ3TW6YW5f9d5eX/cCqGZzal1v9HYf1/9nsNc+v/l4dCbazQHgqp+B0DUuE5MmH34fActalsj7PjcwUAAAD4XAufC1QO8TwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/s3evcdJVd0JAj/d9INumqaNE9GMk3TUgGakaWwNw+AoaoxGRZpZddxkNBBoEGmE8FgFURtQZxziZ3ztrJnoCAoiu+qHGFeDwUhcxIw6iWLiA/Cxjq7r+h6VGM2E/XTfOkXVrS67EFDa+X7/6DpVv/O89eg69946FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/xjuPfjlk4YunP0PHzace8nqqqmL/kfH6Mv+cNW3vvjUPy5b9G9h/i9GnLll3kEXHjd/wbR/6Vi++ogzQmjtKleWFC977oqvPtS613HP3jFw48wbb63fUpWpNxMP/Tr/lGfuXBxbfbF/CHeXhVCRDgypSwKVmft1sb5960LYI2wLZEu01SYl0g2HB2pCWBK2BbJVra4JoS4ncMqG+++7vDNxTU0IXwkhVKfbeKY6aaMmHRhUlQRq04HpFUngt1sT2cBPypMA7LD4Zsi+6Fe15mdo6L5ckddf5U7r2KcrPbw+MdFQPN/rR+3iTuWoSj/QukNPW0F17BIFb4+13m294N1WsJ2v8LTlfpHKfEPZui1UHcontk0aP6d9dnykPDQ19SlW0y56np9+e/6E7Un3mtdh7EDDTnkdXvrYiun9lo2+9OrNvxqz4ayaA3a0m0/lbNLc9K5WHTKvuV7zPEajfJ70grdfwbekRl+6Qghbzz17xtfnTDz7iD63PLnu1QcfrNty9pwFvzhz4nmLLj55w7/Pf6lg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MvFmfzM0BAACg1+gNe01Xnv/6X73+/bWtMxed/u23Dj73w71afz3i/gFVB7yxrqn1/I2ff6Vg/t9Y2vH/eMi/Lne0a0MY1ZVYNCCEvbseTwIrY3e+OyCEL3elWvMDR6UCa0PYpytxULaqVIm+sURjKvByfSYwKhVYHwOtqcDyGLgiFbg4BlalAhNiYG0qcHQMhCn54/hqfWYcJQdqYmBcshFXxbMQ3qmPraW21aZsVQAAADtJZnZYmX8351yHHc0Qp5eranrKEM/ALpqhOlVDegabnVYVraGipxrKe6ohO+6Ojx5+Qc1lPdVccBpGWX6GG9f85X2LXjzsC2P3mvj5xUMvmPKz8eGst++uerx5yYtv7XvEzesK5v/NHz3/r+6mI2UFx/9DGNv1N+Yuz0Tas/FxrXkZAAAAgB1w0R//xR61Lw85oGHT+2X3zl/7xKMrfrl5j1NOf3/c8a//8PCaxnsL5v+jSjv/P+4T6ZOTOTwSd0NMHRBCc34gqXZkYSA56t0vEwAAAIDeIHs8PnssfErmNjlFOz2fLszfup3544H/Ud3m//09/7P2jq3/+mLZBd89d0TNgKX/9GrHhBNOPvqW47/1zj4VB/yyvGD+31ra+f+1+bdJJ9bHXlw9IIS+OYEHYy87A10aY+D5I/MDmfGvjxtgcawqc2JCtqrFscS4GGhOBZYUK/FotsTe+YHMk5VtfFF2HFMyJXICAAAA8ImLuwPicfl4/n/LGSNO++vvzfrbha88eN7qCy75q+Ed80eedP/THzbMvXJp2PTmEQXz/3Hbd/5/1zy44PT+9n4hDK0IoU/6hwGP1CYLA8ZAXVkmcW9tUlefdFULa0MY2TmwdFUvZNb/r0ivMfh4TVJVDOy93y1vD+pMLKsJYWhu4IlvLz2sMzEnFcg2flpNCF/qHG268bv6Jo1Xphu/tm8IX8wJZKua0DeEzsaq0lX9r+rMdQzSVa2qDmHPnEC2quHVIcwNAPRW8X/pxNwHZ82dN3V8e3vbzF2YiDvxa8KkKe1tTROmt0+sLtKniak+561jtKBwTKVe+mZTZo2ixSsnV5aSzv5QsDm3rcyO/IIzBzP345ehyq5xHlKZd7clPeQD9y9sIuR8lSo25PJdPOTa3Eq2PYkF9cf8VaFf6DtnVtvMpvPGz549c1jyt9TshyR/43GmZFsNS2+r2u76VsLLo+hyWSkfd1sNyq1k6OxpM4bOmjtvyJRp4ye3TW47p+XQP2sZMXz410YM7RxUc/K3h5EO6q7m1Ei3Li1xWDtxpF+oyKnkk/jQkJCQ6G2J/f7L5odH77n+nOt/9tqPz+/3zdPu3fvImT889KqpD1Xve/ji24ccWDD/n/HR8//4qRM/+DPrMxQ7/t8QD/Mnj287zD8uBpaUevy/odjR/OyJAY2pQEcMdDjMDwAAwGdD3B0Z92bGndKbb1m/buOSlrk/aHin5dY17Utvuum+U39y58ATvjQ47LXhuhM+VzD/7yjt9/87af3/7NL1JxRb5v+gWKK52Pr/6WX+s+v/dxRb/z+9zH92/f8ln8L6/3OygdQmecf6/wAAwGfBJ7f+f4/L+6cvEFCQocfl/dMXCCjI0OMy/qVeIGC71/9f8+Bff6Wq35g7/qTlN/WXvPZ39xzWeuS6zTP/5Etb10+877qxt6wpmP9fUdr838L9AAAAsPv4z5ddU3H02Xff0bJu6sZxbw5+98m3lgzq80HF0Q+3j3xh4Bu3nlcw/19S2vz/k1//LxQ7/7+xWKC12MKA1v8DAACglyq2/t89Q1sa/zCm/x+eHvab5Q/ePPqnj/z898v3+/mJPyvfZ8Gxz8+8bFLB/H9VafP/eNpFeV7u2JsP65M17UJ6Tbs367M/GQAAAIDeoTw0NVWWmDdvYdSjPn6bT2eWAv2odK7vvXLt2ZtfmH7c46ev+7uaEwbvOWHaBasa/2b4gXd+ftQley7ddGrB/H9tafP/vN9lXPrYiun9lo2+9MOrN/9qzIazag7YdvwfAAAA2HVK3S8BAAAAAAAAAAAAAAB8+s7tWHzhI8uOfe+bt//F/kcseXXwbXcd+Lsh/V664qoHJq1648zJXy/4/X8Y21Wu2O//43X/4u8L/igvd2y15/X/MvdPOfH2uV1LFj5SH8L+uYGpC6fuETLX5h+cG7jvjIMGdiYWpkusefbolzoT30kHjh/yuS2dicNTgXFxkcR90oF4VcUt/VOBuLzi4+lA3B6r0oGqTOCy/sk4ytLb6pW6ZFuVpbfVxroQBuQEstvq7rqkjbL0AK9JBbID/F46EAd4ciZQnu7V7f2SXsVAXSx6Q7+kVwAA7Lbit8DKMGlKe1tz/Aofb79QkX8b5S1ZtqCw2rISm9+UWZps8crJlaWk+6S/i2671nhlqO4cwrCCr6u5Wcq6Rrlzaulh0/1RkSH3tNpbeZFyadu76aqKj6gmGVHThOntEyt7HHhLz1kOqegxy7CCyU5ulvKuTVpCLSX0pYQRlbhtSuhyvF8empr6pHL9eQw2hDw9vSJK/b1+7jp/xV4FuXluO/TKt758zE+f++CfP/9E/2+cVnP7rO+/e+KvX7//wEOOuG5C05otBfP/htLm/9W549qSuRhAR7yy3sgBIYwrcUQAAADw2XfbRbfecfr09a9MWlvx5GOPTS0fc3rl1vl3zp93ycZ7Fx9/2cErdjR+2Fm//f5vBu//b89e9dJPR+7zwA03/58nD3v8z3//8I8eeqduZZ+x7xXM/xtLm//HPViZQ8HJ3o618fr/iwaE0HVp/YYksDIO97sDQvhyV6o1lkguqH9CLNGcBFbGHSYHxRLjWvOr6hsDq1KBl+szgbWpwPoYyOyluCVkduVcWR/CYV2psfklZsQSDanAmBhoTAWaYqA5FegfA6NSgdf6ZwKtqcDDMRCm5G+rH/fPbCsAAIDtkZlnVebfDel53qqKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xAyVqZNXynIyVaZrrUnVUpAhXgx/u/tVkCE8mp8zXbCg6Xj+QfZ8g7L8DFf+4NlT1w+e/tDqzcd8beBt/zhkz4Obp9e9t+CGp3475pzrnv/TQQXz/+bS5v+1+bdJ6+vj/H/b9f+SwIOxe1fHU8cbY+D5I/MDmR0D6+Nkd3G2qtZMicykfXEsMSoGGlOBGTEwKhUYNzYTWDIwP5CZaWcbX5RtfEqmRE4AAAAAPnFxB0HcTRPn/zce9YOr3x8wccuyeTPvH9vyxMmjv3H1XT+6d/9ld767YvCAce99p2D+P6q0+X9sr19uYxfH3rzYP4S7y7b1JhsYUpcE4n6Muvjz+H3rQtgjZwdHtkRbbVKiKtVweKAm+YV6Vbqq1TXJGgPx/ikb7r/v8s7ENTUhfCVn70u2jWeqkzZq0oFBVUmgNh2YXpEE4p6fbOAn5UkAdlh2r2B8QWVOdclq6L5ckdffZ+WaoOnhFewD7SZfd7+52lWq0w9k9qlmbd/TVlAdu0TB22Otd1tvfLc1eLflfpHKfEPZui1UHcontk0aP6d9dnwk95esBXbR85z7K9VS0jvhddjx8Xvbs+p0B5pTHx/N3Zfr/nVYFqu79LEV0/stG33p1Zt/NWbDWTUHlNyNIuIPhX+05X9XPpWzeXe16pB5zfW6z5NWnye98d9Ao6cthHDZ9cfsu+TdX+/33A3Pnbqu7Maxr/7lrHs2Lf+bysNHrXv/yaGjLy+Y/7eWNv+vSN12+V3cmLMGhHBgzsZ9JG7+YwYkn4M5geRTcs/CQHLI/V/ri35yAgAAwM6W3d2R3V8wJXObnBCenicX5m/dzvxxf8WobvOX2u9j121cedLQN6474G8vOPGNv7/28Kceuv6ysnXL//vYD1avuXzxe08UzP/HffT8v2+qm47/O/7PLuL4f7d2913RfdMPdOzQruiC6tglHP/v1u7+bnP8v1uO/zv+3x3H/3vg+H+3dvenreBb0gxfujonwdff+fPfTbzpg7mN+x180lPPHDrxun+6quXuu0555b+de9601761uWD+P6O0+b/1/7pftC+7/t+4Yuv/zSi2/l+H9f8AAIBdqshCc+l5XsHqfQUZ0qv3FWTocYHAHpcYtP7fdq//t3Dkv1904Q+fb7n2nTvHXb5m07Fnvvr0utXPzFpx3Lnnv9V6112tBfP/jtLm//Hl0C+39d6y/l/j2CJVXREDMywMCAAAwO6o2A4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPl2HnvbO+5d8/R/aBv1ixc1/f+v/+7/P1q594JvfuGn4L6f86RllazZcM+LMLfMOuvC4+Qum/UvH8tVHnBHClK5yZUnxsueu+OpDrXsd9+wdAzfOvPHW+i3VmXorM7d/nJc7tvphfQhLch6pi4k36zvvbAuccuLtcys6E4/Uh7B/bmDqwql7dCaW14cwODdw3xkHDexMLEyXWPPs0S91Jr6TDhw/5HNbOhOHZwJl6e5e1z/pblm6u5f3D2FATiDb3bP751eVbeO4TKA83caKuqSNGKiLRa+tS9qIgfZYYkrfEIZWhNAnXdU/VydV9UlXdU91UlWfdFUXVYcwMoRQka7quaqkqor0yB+tSqqKgb33u+XtQZ2JpVUhDM0NPPHtpYd1JmamAtnG/1NVCF/qfMmkG/9xZdJ4Zbrx/1oZwhdDCFXpEu9VJCWq0iVeqAhhz5zAto1YEcLcwGdD/PSZmPvgrLnzpo5vb2+buQsTVZm2asKkKe1tTROmt0+sTvWpmLKc9NYFH3/sm96eP6HzdvHKyZWlpCsy5Sq7unxIZd7dlt2997FftbmVbHs+CuqP+atCv9B3zqy2mU3njZ89e+aw5G+p2Q9J/vbJRJNtNay3bKtBuZUMnT1txtBZc+cNmTJt/OS2yW3ntBz6Zy0jhg//2oihnYNqTv7ujJEu/eRH+oWKnEo+ife/hIREb0uU5326Ne/un+MFX/S3dbQyVHd9QBdMK3KzlHWNcmcM+qiPOeKP8zWlxxENK5g4FGQ5pOcsLQWTiW1ZapIsXV/rCiaHuTWVd23SeL88NDX1KbYdGvLv5m7e13dg8z6d2XSlpgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAA//8fSxmR") write$nci(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000200)={@private0, 0x800, 0x0, 0x0, 0x1}, 0x20) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f0000000440)='./file1\x00', 0x4242, 0x1df2a23c5997faa6) socket$nl_route(0x10, 0x3, 0x0) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x0, 0x0, 0x5, 0x85, 0x1, 0x1, {0x3, 0x1, 0x5, 0x8, 0x1fc, 0xd615, 0x9, 0x535, 0xfffffffd, 0x1000, 0xff, 0x0, 0x0, 0x5, 0x2000000}}, {0x0, 0x13}}}, 0xa0) sendfile(r3, r3, &(0x7f0000000080), 0x7f03) 2m15.584792013s ago: executing program 2 (id=1183): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000480)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3a0) syz_emit_ethernet(0x42, &(0x7f0000000140)=ANY=[@ANYBLOB="33020000000100000000000086dd6000000000072c40fe800000001000000000000000000001ff0200000000000000000000000000018b017811c9bfc591493b2cc6038f4b6302bb31b597130a4393656691f51fb68644f9f9b1661cda44f3623c17fade0f6cc5bad28cdf8037f740dac9e94099aec796dc3336d426fe5ff7e0"], 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$nullb(0xffffffffffffff9c, 0x0, 0x529c2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x103001, 0x0) syz_open_pts(0xffffffffffffffff, 0x161601) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x80c446, &(0x7f0000002880)=ANY=[@ANYBLOB="646f74732c646f747300646d61736b3d30303030303030303003994db69d6fadd9fe8357bb9b326973636172642c0166733d6e6f7774066c655f726f2c6769643d8bde74b54a903862b1d491a0644fd032adf103782b3e6ab9bb8b7d5a0000008000000000830bbf712b3588cd20fd6b4fa30f99796b63d0000200006bf7964f30b515830fe521179cb856fcec51525e76986850e3c2079c07811902047009a8bd311ec4398a92a06f061a5a0ba1eb2b3db991e65cb55232662ecb874cb1ea47734fd6c56b06c03f20235fad7299622ac7c70fbb5466c8f69e509115f9048273682c4abdddc8cbc849980b03000000000000000000000063e0c97554c132b6effff3b3e0c109c72f794db4da27b9108716f1877464f58d22d0ea6e75321d887a6a375c5cf8cce358a8df2720e76ce466c78c7901cc6071bc2eafaa394d4290e95d4db56b59ed5d9bd10d94b075a7ace6d3f19993baa452c9ecc39f61cc383b51b627ad3b736c045f8c784b64bbaac710f4372841998dee85b80f515bdeba72caeb00c76ae7cb06986d7e9f9fec03b990c1fc56d5161ae3c622a649f9f95781dd32bc8e4090861fcad6bed6a3be33f3602b136695e7543543b93f62312f5387cd4c6d1aa22271ec1be39d675c08f44ed601b6c8fbf92f448158314570618bfd504dfd0ff459eff7bc34e453816efefe372fcecc66f0956afbe155f1f53d0eff4872d6921804209e82af2ed0a588b8ebbef33bbbc3d495d110acf1a7537f33a8f5a82a29e2d6761b50d3db9dae0a9606eb4b0a92cdb504659776a21344b8fdc9ca3851a76938dd00e59cb1d1ad7ec9ac6e19d3244e209fd56e67caf895cf9f8507b063cac9ddc2ae46f7dff3f9b86b5b3838383015a502f3540a8a796580c78737b10f54977af5ce0500000000000000973aed1e03820294e9811ef0c389ec53e04e14f226213fa4fd2f9c32cd317f936edcf16bffd78d69907336f1e4cf69c22d2e8f0a1caa2623483b45be9f59f1b74cd394ab3fbe2ddbbb373bc82df19a92db916f959d4bcb800c50bfabd4d63861e036ef6d614d46c31ab711ad2ead248d781e89017fc7c22d22be274e450e5f1837bf10921f4b117439ad4503f11682542bdba745be99695d4c3d64b96997f1a6f8f3145f94f227694be7682e8a2a1a288b69474164171c6dc00e770cb068702087467ee08643516fbc3f5f71715559152dbdb61082060c73a9338db0407ed89b6941d034f623a6643e3944560000000000000000000000000000003817b7051a63f3b8458458899cb957684a987df9cd9a07d57d0c00b322baec1e20a9746be433018f0f5b9c4257c67ec5578fa41e837b4f0fadfe479b0a085e776f9ccb4a2846adf4b9f018bd778d1744a48391df6d7a767f0ccb570eba43abdd496952976635fa", @ANYRES8, @ANYRES8=0x0], 0x1, 0x2b1, &(0x7f0000000100)="$eJzs3E1rE0EYwPEn2TabVvpyEvTig170stR4VKFRWhADStoV9SBs6VZDYlJ2gyYimLOnfo7i0ZsgfoHe/QDeiiA99eRKk826iemLISY1/f8g7Mw8O5uZnQSeCWx2H2+9LG741oZTlWRaJSnSkH2ReSlIWyI8pprlVNQutzPSkGsLr/berzx5ej+byy3lVZezqzcyqjp76fPrtx8uf6mee/Rx1jRlZ/7Z7o/Mt53zOxd2f66+KPha8LVcqaqja5VK1Vkrubpe8IuW6sOS6/iuFsq+63XEN0qVzc26OuX1melNz/V9dcp1TUpdqxVNh6Mqq2VZOjN9UE7LGZL66x72dj7vZHuGztSdG2+el3UMEZn6Y03t7dGMCAAAjNLh+X8yOqed/ye783+RY/L/d+FZs58Gnv8bEuX/RbeZ/1e9ujrPnUI8/8eR7MXO/H/xRL2S/25A6FeiEavc6Qh5XnaqdyfyfwAAAAAAAAAAAAAAAAAAAAAA/gf7QTAXBMHcwTEpIkFYN0XEiNV7dOUJ8TEQX/8g9jLDBT5i/TEGYg/upUW+N2p2zU40j6348r3c0oI2xR7826vVbCOKX2/FtTM+KdNhPNMznpKrV1rxg9jdB7l4fKtmT8l611iNjlpjkLcBAAAAAICxZmlkPmpMS7S/tyw1pTve3L83CxMi0v59oGt/PyEXJ4Y4EQAAAAAAcCi//qbolEquN5yCMcT36rsg0l/3m4E5kGEYIhJrMcOlip+TXxEZ3JRTcuyU9UQXNMVtj3a4C/c123f39Cn51J2wcGtgFwwSIq2WyXDNur4FAAAAAMbL7/3AqEcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDZNYy/Lhv1HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDT4lcAAAD//4aMsuk=") mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='mnt/encrypted_dir\x00', 0x200) 2m13.855790824s ago: executing program 2 (id=1187): syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000001c0)=0x3d8f, 0x4) shutdown(0xffffffffffffffff, 0x1) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r5 = socket$kcm(0x1e, 0x5, 0x0) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r1, 0x0, 0x5004) recvmsg$kcm(r5, &(0x7f0000001740)={0x0, 0x0, &(0x7f00000016c0)=[{0x0}], 0x1}, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(r4, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) 1m57.884663779s ago: executing program 32 (id=1187): syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000001c0)=0x3d8f, 0x4) shutdown(0xffffffffffffffff, 0x1) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r5 = socket$kcm(0x1e, 0x5, 0x0) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r1, 0x0, 0x5004) recvmsg$kcm(r5, &(0x7f0000001740)={0x0, 0x0, &(0x7f00000016c0)=[{0x0}], 0x1}, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(r4, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) 20.736600397s ago: executing program 1 (id=1404): ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r1, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_connect(0x3, 0x32, 0x0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) connect$pptp(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) read$FUSE(r1, &(0x7f0000000340)={0x2020}, 0x2020) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f00000095"], 0x0, 0xfffffdfe, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) socket$inet(0x2, 0x2, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) 16.828013631s ago: executing program 1 (id=1414): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x90, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x54, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 15.049977705s ago: executing program 1 (id=1418): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, 0x0, 0x0) 13.338763201s ago: executing program 1 (id=1420): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0xee00) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknod(0x0, 0x8001420, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 13.281184127s ago: executing program 3 (id=1421): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) syz_open_procfs(0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) shmctl$SHM_INFO(0x0, 0xe, &(0x7f00000000c0)=""/56) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000100)={0x20071026, 0xffffffffffffffff}, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)={0x3c, r4, 0x1, 0x0, 0x0, {0x2d}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}}, 0x0) 12.28951772s ago: executing program 1 (id=1422): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) 11.869079404s ago: executing program 4 (id=1423): syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000300)='./file0\x00', 0x408003, &(0x7f0000000ac0)={[{@init_itable_val={'init_itable', 0x3d, 0x101}}, {@noblock_validity}, {@data_journal}, {@sysvgroups}, {@errors_remount}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2b5}}, {@errors_remount}, {@i_version}, {@resuid, 0x32}], [{@func={'func', 0x3d, 'CREDS_CHECK'}}, {@dont_appraise}, {@func={'func', 0x3d, 'FILE_CHECK'}}, {@smackfsfloor={'smackfsfloor', 0x3d, ':{)]\\@\\'}}]}, 0x1b, 0x4f3, &(0x7f0000000340)="$eJzs3V1rW+cdAPD/ObaSOHFmh+0iCywLS4Ydtkh2vCRmF1k2xnYV2JZdL/Ns2RjLlrHkJDZhcdgHGIyxDQaFXvWm0A9QKPkIpRBo70tbWkqbtBe5aVT0lhdHslUiW8H+/eDoPM950f//SJwjPecczglg3zoVEacj4nGlUjkbEUON6WljuFKtbNSXe/jg9nR1SKJSufZFEpHUp1UXGX3mPY/UV4lDEfGn30f8LXkxbmltfWGqUMivNOq58uJyrrS2fm5+cWouP5dfmpgYvzh5afLC5FhX2jkYEZd/+8l//vnG7y6/8/ObH17/bPTvSWN6xNN2dFu96ZnaZ9HUHxErOxGsB/oa7cn0OhEAADrS/J//k4g4G0PRV/s3BwAAAOwllV/Vz0xVAAAAgD0rrV0Dm6TZxnUAg5Gm2Wz9Gt4fxOG0UCyVfzZbXF2aqV8rOxyZdHa+kB9rXCs8HJmkWh+vlZ/Wz2+qT0TEsYj499BArZ6dLhZmen3wAwAAAPaJI5v6/18P1fv/AAAAwB4z3OsEAAAAgB2n/w8AAAB7n/4/AAAA7Gl/uHq1OlQORP351zM31lYXijfOzeRLC9nF1ensdHFlOTtXLM7V7tm3uN37FYrF5V/E0uqtXDlfKudKa+vXF4urS+Xr8889AhsAAADYRcd+fO+DJCI2fjlQG6oO9DopYFf0V1/udLjwxzubC7C7+nqdANAz/b1OAOiZTK8TAHouiYjXtpjf9uKdd3cmHwAAoPtGftj6/H+y7bGBjXSXUgR2iON/sH85/w/7l/P/sH9loi8678gP7GguQG8k28x/+fP/lcp3SggAAOi6wdqQpNmI2nGAwUjTbDbiaO2xAJlkdr6QH4uI70XE+0OZg9X6eG3NZNs+AwAAAAAAAAAAAAAAAAAAAAAAAABQV6kkUQEAAAD2tIj006Tx/K+RoTODm48PHEgeDdXGEXHz/9f+e2uqXF4Zr07/8sn08v8a08/34ggGAAAAsFmzn97sxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABANz18cHu6Oexm3M9/HRHDreL3x6Ha+FBkIuLwV0n0P7NeEhF9XYi/cTcifvOXFvGTalox3MiiVfyBbsU/3qr9W8dPI+JIF+LDfnavuv+50mr7S+NUbbx5+zv4ZN3+LsRvv/9Ln+z/+tps/0c7jHHi/lu5tvHvRpzob73/acZP2uz/TncY/69/Xl9vN6/yesRIy9+f5LlYufLicq60tn5ufnFqLj+XX5qYGL84eWnywuRYbna+kG+8tozxrx+9/Xir9h9uE394m/af6bD939y/9eD79WKmVfzR062//+Nt4qeN376fNsrV+SPN8ka9/KyTb753cqv2z7Rp/3bf/2iH7T/7x3981OGiAMAuKK2tL0wVCvmVfV14qU+j+reos4XTRphXockK+ZXSnVcjjVey0NwmHvVkvwQAAHTfi31gAAAAAAAAAAAAAAAAAAAAYLd1555hzXtib313vaaN+uiFeyEDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPTStwEAAP//MhzNBA==") sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0xffff, 0x4}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000540)='./bus\x00', 0x8800, &(0x7f0000000280), 0x1, 0x51f, &(0x7f0000000580)="$eJzs3c9vI1cdAPDvOHHi/OgmLT0AgnZpCwtarZN426jqAcoRoUqIHkHahsQbRbHjKHZKE/awPXNFohIneuQP4NwTB25cENy4LAckfkSgDRIHoxlPst6svTGbTRziz0cazXvzZv19L868t/NizwtgZF2PiPsRMRERH0TEXH48ybd4t7Ol5z08uLd6eHBvNYl2+/2/J1l5eiy6/k1qJn/NUkR8/9OIHyVPxm3u7W+u1GrVnTy/0KpvLzT39m9t1FfWq+vVrUpleWl58e3bb1WeW1tfrU/kqS8/+N39b/wkrdZsfqS7Hf+zpNPePkURUTyOkxqPiO8+c7DLZSxvz8SwK8IzKUTESxHxWnb9z8VY9m4CAFdZuz0X7bnuPABw1RWyObCkUM7nAmajUCiXO3N4L8d0odZotm7ebexurXXmyuajWLi7Uasu5nOF81FM0vxSln6Ur5zI346IFyPiZ5NTWb682qitDfM/PgAwwmZOjP//muyM/wDAFVcadgUAgAvXZ/zv95lWAOAKcP8PAKPH+A8Ao6eUPcNhatjVAAAukPt/ABg9xn8AGCnfe++9dGsf5s+/Xvtwb3ez8eGttWpzs1zfXS2vNna2y+uNxnr2zJ76aa9XazS2l96M3Y/mv7ndbC009/bv1Bu7W6072XO971SL2Vm+WQAAw/Tiq5/9MUlH5Hemsi261nIoDrVmwHkrDLsCwNCM9UkDV5/VvmB0neEe3/QAXBE9luh9TCl6fEGo3W63z69KwDm78QXz/zCquub/fQoYRow5fxhd5v9hdLXbyaBr/segJwIAl5s5fqDP3/9fyve/yv848MO1k2d8cp61AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMvtaP3fcr4W+GwUCuVyxAsRMR/F5O5GrboYEdci4g+Txck0vzTkOgMAZ1X4S5Kv/3Vj7o3Zx4pemTlOTkTEj3/x/s8/Wmm1dn4fMZH8Y/LoeOuT/Hjl4msPAJzuaJzO9l038g8P7q0ebRdZn79+OyJKnfiHBxNxeBx/PMazfSmKETH9zyTPdyRdcxdncf/jiPh8r/YnMZvNgXRWPj0ZP439woXGLzwWv5CVdfbpz+Jzz6EuMGo+S/ufd3tdf4W4nu17X/+lrIc6u7z/S19q9TDrAx/FP+r/xvr0f9cHjfHmb77TSU09WfZxxBfHI45iH3b1P0fxkz7x3xgw/p++9Mpr/crav4y4Eb3jd8daaNW3F5p7+7c26ivr1fXqVqWyvLS8+PbttyoL2Rz1Qv/R4G/v3LzWryxt/3Sf+KVT2v/VAdv/6X8++MFXnhL/66/3il+Il58SPx0TvzZg/JXpX5f6laXx1/q0/7T3/+aA8R/8ef+JZcMBgOFp7u1vrtRq1Z2nJa4dRpx2zv9lIgY7+bf5D+tS1HmkE+m7cAmq0TPxra4jM3GOsSb6XIw/fb3zazoZ0f2L3W4/U6x+PcbzmHUDLoPjiz4i/j3sygAAAAAAAAAAAAAAAD1dxLejht1GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArq7/BgAA//8BoMnq") r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x20009, 0x34888521, 0x5, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xa4081f7e}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 11.353736047s ago: executing program 3 (id=1425): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x200, 0x5, 0x0, 0x0, 0x1}, 0x8) r2 = io_uring_setup(0x4048, &(0x7f0000000140)={0x0, 0x8270, 0x400, 0x801, 0x2e0, 0x0, r1}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/141, 0x8d}], 0x113e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) io_uring_register$IORING_REGISTER_FILES(r2, 0x1e, &(0x7f0000000000)=[r2], 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x25, 0x0, 0x0) mlockall(0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) r4 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r4, 0xb) shmat(r4, &(0x7f0000ffd000/0x1000)=nil, 0x7000) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) sendmsg$NL80211_CMD_SET_WDS_PEER(r5, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x81101000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="000025bd7000fddbdf254200000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099008100000079000000"], 0x28}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4000010) 11.201538531s ago: executing program 4 (id=1426): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c80000001010203010902200001010080000904000002ff000000070581"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000400)={0x0, 0xa, 0x8, "ebaa550303010000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) 9.569652349s ago: executing program 0 (id=1427): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x90, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x54, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 9.393606101s ago: executing program 3 (id=1428): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/pppol2tp\x00', 0x80, 0x80) read(r1, &(0x7f0000000300), 0x1) read(r1, &(0x7f0000000400), 0x120) 8.977459003s ago: executing program 0 (id=1429): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, 0x0, 0x0) 8.957866898s ago: executing program 1 (id=1430): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) ioprio_get$uid(0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socket$kcm(0x10, 0x2, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r4, &(0x7f0000000140)={0x1d, 0x0, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, 0x0, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$BLKCLOSEZONE(r5, 0x40101287, &(0x7f0000000000)={0x612, 0x3}) sendfile(r6, r5, 0x0, 0x20fffe82) 8.720914246s ago: executing program 0 (id=1431): socket$l2tp6(0xa, 0x2, 0x73) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) mq_open(0x0, 0x8c2, 0x30, &(0x7f0000000080)={0x8000000000000000, 0x8, 0x1, 0xc05}) io_setup(0x6, &(0x7f0000000540)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x4000}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x2, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0x40405515, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x4000}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0xfffffffffffffffc, 0x0, 0x3, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ad, 0x0, 0x0, 0xc7, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7fff, 0x7, 0x0, 0x8]}) 8.461484573s ago: executing program 3 (id=1432): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000480)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) syz_emit_ethernet(0x42, &(0x7f0000000140)=ANY=[@ANYBLOB="33020000000100000000000086dd6000000000072c40fe800000001000000000000000000001ff0200000000000000000000000000018b017811c9bfc591493b2cc6038f4b6302bb31b597130a4393656691f51fb68644f9f9b1661cda44f362"], 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$nullb(0xffffffffffffff9c, 0x0, 0x529c2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x103001, 0x0) syz_open_pts(0xffffffffffffffff, 0x161601) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x80c446, &(0x7f0000002880)=ANY=[@ANYBLOB="646f74732c646f747300646d61736b3d30303030303030303003994db69d6fadd9fe8357bb9b326973636172642c0166733d6e6f7774066c655f726f2c6769643d8bde74b54a903862b1d491a0644fd032adf103782b3e6ab9bb8b7d5a0000008000000000830bbf712b3588cd20fd6b4fa30f99796b63d0000200006bf7964f30b515830fe521179cb856fcec51525e76986850e3c2079c07811902047009a8bd311ec4398a92a06f061a5a0ba1eb2b3db991e65cb55232662ecb874cb1ea47734fd6c56b06c03f20235fad7299622ac7c70fbb5466c8f69e509115f9048273682c4abdddc8cbc849980b03000000000000000000000063e0c97554c132b6effff3b3e0c109c72f794db4da27b9108716f1877464f58d22d0ea6e75321d887a6a375c5cf8cce358a8df2720e76ce466c78c7901cc6071bc2eafaa394d4290e95d4db56b59ed5d9bd10d94b075a7ace6d3f19993baa452c9ecc39f61cc383b51b627ad3b736c045f8c784b64bbaac710f4372841998dee85b80f515bdeba72caeb00c76ae7cb06986d7e9f9fec03b990c1fc56d5161ae3c622a649f9f95781dd32bc8e4090861fcad6bed6a3be33f3602b136695e7543543b93f62312f5387cd4c6d1aa22271ec1be39d675c08f44ed601b6c8fbf92f448158314570618bfd504dfd0ff459eff7bc34e453816efefe372fcecc66f0956afbe155f1f53d0eff4872d6921804209e82af2ed0a588b8ebbef33bbbc3d495d110acf1a7537f33a8f5a82a29e2d6761b50d3db9dae0a9606eb4b0a92cdb504659776a21344b8fdc9ca3851a76938dd00e59cb1d1ad7ec9ac6e19d3244e209fd56e67caf895cf9f8507b063cac9ddc2ae46f7dff3f9b86b5b3838383015a502f3540a8a796580c78737b10f54977af5ce0500000000000000973aed1e03820294e9811ef0c389ec53e04e14f226213fa4fd2f9c32cd317f936edcf16bffd78d69907336f1e4cf69c22d2e8f0a1caa2623483b45be9f59f1b74cd394ab3fbe2ddbbb373bc82df19a92db916f959d4bcb800c50bfabd4d63861e036ef6d614d46c31ab711ad2ead248d781e89017fc7c22d22be274e450e5f1837bf10921f4b117439ad4503f11682542bdba745be99695d4c3d64b96997f1a6f8f3145f94f227694be7682e8a2a1a288b69474164171c6dc00e770cb068702087467ee08643516fbc3f5f71715559152dbdb61082060c73a9338db0407ed89b6941d034f623a6643e3944560000000000000000000000000000003817b7051a63f3b8458458899cb957684a987df9cd9a07d57d0c00b322baec1e20a9746be433018f0f5b9c4257c67ec5578fa41e837b4f0fadfe479b0a085e776f9ccb4a2846adf4b9f018bd778d1744a48391df6d7a767f0ccb570eba43abdd496952976635fa", @ANYRES8, @ANYRES8=0x0], 0x1, 0x2b1, &(0x7f0000000100)="$eJzs3E1rE0EYwPEn2TabVvpyEvTig170stR4VKFRWhADStoV9SBs6VZDYlJ2gyYimLOnfo7i0ZsgfoHe/QDeiiA99eRKk826iemLISY1/f8g7Mw8O5uZnQSeCWx2H2+9LG741oZTlWRaJSnSkH2ReSlIWyI8pprlVNQutzPSkGsLr/berzx5ej+byy3lVZezqzcyqjp76fPrtx8uf6mee/Rx1jRlZ/7Z7o/Mt53zOxd2f66+KPha8LVcqaqja5VK1Vkrubpe8IuW6sOS6/iuFsq+63XEN0qVzc26OuX1melNz/V9dcp1TUpdqxVNh6Mqq2VZOjN9UE7LGZL66x72dj7vZHuGztSdG2+el3UMEZn6Y03t7dGMCAAAjNLh+X8yOqed/ye783+RY/L/d+FZs58Gnv8bEuX/RbeZ/1e9ujrPnUI8/8eR7MXO/H/xRL2S/25A6FeiEavc6Qh5XnaqdyfyfwAAAAAAAAAAAAAAAAAAAAAA/gf7QTAXBMHcwTEpIkFYN0XEiNV7dOUJ8TEQX/8g9jLDBT5i/TEGYg/upUW+N2p2zU40j6348r3c0oI2xR7826vVbCOKX2/FtTM+KdNhPNMznpKrV1rxg9jdB7l4fKtmT8l611iNjlpjkLcBAAAAAICxZmlkPmpMS7S/tyw1pTve3L83CxMi0v59oGt/PyEXJ4Y4EQAAAAAAcCi//qbolEquN5yCMcT36rsg0l/3m4E5kGEYIhJrMcOlip+TXxEZ3JRTcuyU9UQXNMVtj3a4C/c123f39Cn51J2wcGtgFwwSIq2WyXDNur4FAAAAAMbL7/3AqEcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDZNYy/Lhv1HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDT4lcAAAD//4aMsuk=") mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='mnt/encrypted_dir\x00', 0x200) 8.078118265s ago: executing program 0 (id=1433): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() capget(0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24040045) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f00000000c0)=0x20000, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000200)="480000001400190d7ebdeb75", 0xc}], 0x1) r7 = io_uring_setup(0x1195, 0x0) writev(r7, &(0x7f0000000000)=[{0x0}], 0x1) write$dsp(0xffffffffffffffff, &(0x7f00000001c0), 0x0) 6.058754883s ago: executing program 4 (id=1434): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) lseek(0xffffffffffffffff, 0x7fffffffffffffff, 0x1) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) shmctl$SHM_INFO(0x0, 0xe, &(0x7f00000000c0)=""/56) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000100)={0x20071026, 0xffffffffffffffff}, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)={0x3c, r4, 0x1, 0x0, 0x0, {0x2d}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}}, 0x0) 5.867516468s ago: executing program 5 (id=1214): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="18020000fcffffff0000000003000008850000002800000085000000a000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000000)={0xf, r0, 0x4b36baea9e1c7e99}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd700001b133d62ec562bab7670a5b99ea33d7"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20048004) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fd, 0x0, 0x3, 0x3}, 0x10) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/36, 0x24}], 0x1}, 0x4}], 0x1, 0x400101a0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) syz_io_uring_setup(0x34b8, &(0x7f0000000500)={0x0, 0x12d9, 0x20, 0x3, 0xe9}, &(0x7f0000000300), &(0x7f00000002c0), &(0x7f0000000400)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) write$binfmt_register(r6, &(0x7f0000000040)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x0, 0x3a, 'tracefs\x00', 0x3a, '*:@{\':', 0x3a, './trace'}, 0x35) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) 3.988372015s ago: executing program 4 (id=1435): syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000300)='./file0\x00', 0x408003, &(0x7f0000000ac0)={[{@init_itable_val={'init_itable', 0x3d, 0x101}}, {@noblock_validity}, {@data_journal}, {@sysvgroups}, {@errors_remount}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2b5}}, {@errors_remount}, {@i_version}, {@resuid, 0x32}], [{@func={'func', 0x3d, 'CREDS_CHECK'}}, {@dont_appraise}, {@func={'func', 0x3d, 'FILE_CHECK'}}, {@smackfsfloor={'smackfsfloor', 0x3d, ':{)]\\@\\'}}]}, 0x1b, 0x4f3, &(0x7f0000000340)="$eJzs3V1rW+cdAPD/ObaSOHFmh+0iCywLS4Ydtkh2vCRmF1k2xnYV2JZdL/Ns2RjLlrHkJDZhcdgHGIyxDQaFXvWm0A9QKPkIpRBo70tbWkqbtBe5aVT0lhdHslUiW8H+/eDoPM950f//SJwjPecczglg3zoVEacj4nGlUjkbEUON6WljuFKtbNSXe/jg9nR1SKJSufZFEpHUp1UXGX3mPY/UV4lDEfGn30f8LXkxbmltfWGqUMivNOq58uJyrrS2fm5+cWouP5dfmpgYvzh5afLC5FhX2jkYEZd/+8l//vnG7y6/8/ObH17/bPTvSWN6xNN2dFu96ZnaZ9HUHxErOxGsB/oa7cn0OhEAADrS/J//k4g4G0PRV/s3BwAAAOwllV/Vz0xVAAAAgD0rrV0Dm6TZxnUAg5Gm2Wz9Gt4fxOG0UCyVfzZbXF2aqV8rOxyZdHa+kB9rXCs8HJmkWh+vlZ/Wz2+qT0TEsYj499BArZ6dLhZmen3wAwAAAPaJI5v6/18P1fv/AAAAwB4z3OsEAAAAgB2n/w8AAAB7n/4/AAAA7Gl/uHq1OlQORP351zM31lYXijfOzeRLC9nF1ensdHFlOTtXLM7V7tm3uN37FYrF5V/E0uqtXDlfKudKa+vXF4urS+Xr8889AhsAAADYRcd+fO+DJCI2fjlQG6oO9DopYFf0V1/udLjwxzubC7C7+nqdANAz/b1OAOiZTK8TAHouiYjXtpjf9uKdd3cmHwAAoPtGftj6/H+y7bGBjXSXUgR2iON/sH85/w/7l/P/sH9loi8678gP7GguQG8k28x/+fP/lcp3SggAAOi6wdqQpNmI2nGAwUjTbDbiaO2xAJlkdr6QH4uI70XE+0OZg9X6eG3NZNs+AwAAAAAAAAAAAAAAAAAAAAAAAABQV6kkUQEAAAD2tIj006Tx/K+RoTODm48PHEgeDdXGEXHz/9f+e2uqXF4Zr07/8sn08v8a08/34ggGAAAAsFmzn97sxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABANz18cHu6Oexm3M9/HRHDreL3x6Ha+FBkIuLwV0n0P7NeEhF9XYi/cTcifvOXFvGTalox3MiiVfyBbsU/3qr9W8dPI+JIF+LDfnavuv+50mr7S+NUbbx5+zv4ZN3+LsRvv/9Ln+z/+tps/0c7jHHi/lu5tvHvRpzob73/acZP2uz/TncY/69/Xl9vN6/yesRIy9+f5LlYufLicq60tn5ufnFqLj+XX5qYGL84eWnywuRYbna+kG+8tozxrx+9/Xir9h9uE394m/af6bD939y/9eD79WKmVfzR062//+Nt4qeN376fNsrV+SPN8ka9/KyTb753cqv2z7Rp/3bf/2iH7T/7x3981OGiAMAuKK2tL0wVCvmVfV14qU+j+reos4XTRphXockK+ZXSnVcjjVey0NwmHvVkvwQAAHTfi31gAAAAAAAAAAAAAAAAAAAAYLd1555hzXtib313vaaN+uiFeyEDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPTStwEAAP//MhzNBA==") sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0xffff, 0x4}, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000540)='./bus\x00', 0x8800, &(0x7f0000000280), 0x1, 0x51f, &(0x7f0000000580)="$eJzs3c9vI1cdAPDvOHHi/OgmLT0AgnZpCwtarZN426jqAcoRoUqIHkHahsQbRbHjKHZKE/awPXNFohIneuQP4NwTB25cENy4LAckfkSgDRIHoxlPst6svTGbTRziz0cazXvzZv19L868t/NizwtgZF2PiPsRMRERH0TEXH48ybd4t7Ol5z08uLd6eHBvNYl2+/2/J1l5eiy6/k1qJn/NUkR8/9OIHyVPxm3u7W+u1GrVnTy/0KpvLzT39m9t1FfWq+vVrUpleWl58e3bb1WeW1tfrU/kqS8/+N39b/wkrdZsfqS7Hf+zpNPePkURUTyOkxqPiO8+c7DLZSxvz8SwK8IzKUTESxHxWnb9z8VY9m4CAFdZuz0X7bnuPABw1RWyObCkUM7nAmajUCiXO3N4L8d0odZotm7ebexurXXmyuajWLi7Uasu5nOF81FM0vxSln6Ur5zI346IFyPiZ5NTWb682qitDfM/PgAwwmZOjP//muyM/wDAFVcadgUAgAvXZ/zv95lWAOAKcP8PAKPH+A8Ao6eUPcNhatjVAAAukPt/ABg9xn8AGCnfe++9dGsf5s+/Xvtwb3ez8eGttWpzs1zfXS2vNna2y+uNxnr2zJ76aa9XazS2l96M3Y/mv7ndbC009/bv1Bu7W6072XO971SL2Vm+WQAAw/Tiq5/9MUlH5Hemsi261nIoDrVmwHkrDLsCwNCM9UkDV5/VvmB0neEe3/QAXBE9luh9TCl6fEGo3W63z69KwDm78QXz/zCquub/fQoYRow5fxhd5v9hdLXbyaBr/segJwIAl5s5fqDP3/9fyve/yv848MO1k2d8cp61AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMvtaP3fcr4W+GwUCuVyxAsRMR/F5O5GrboYEdci4g+Txck0vzTkOgMAZ1X4S5Kv/3Vj7o3Zx4pemTlOTkTEj3/x/s8/Wmm1dn4fMZH8Y/LoeOuT/Hjl4msPAJzuaJzO9l038g8P7q0ebRdZn79+OyJKnfiHBxNxeBx/PMazfSmKETH9zyTPdyRdcxdncf/jiPh8r/YnMZvNgXRWPj0ZP439woXGLzwWv5CVdfbpz+Jzz6EuMGo+S/ufd3tdf4W4nu17X/+lrIc6u7z/S19q9TDrAx/FP+r/xvr0f9cHjfHmb77TSU09WfZxxBfHI45iH3b1P0fxkz7x3xgw/p++9Mpr/crav4y4Eb3jd8daaNW3F5p7+7c26ivr1fXqVqWyvLS8+PbttyoL2Rz1Qv/R4G/v3LzWryxt/3Sf+KVT2v/VAdv/6X8++MFXnhL/66/3il+Il58SPx0TvzZg/JXpX5f6laXx1/q0/7T3/+aA8R/8ef+JZcMBgOFp7u1vrtRq1Z2nJa4dRpx2zv9lIgY7+bf5D+tS1HmkE+m7cAmq0TPxra4jM3GOsSb6XIw/fb3zazoZ0f2L3W4/U6x+PcbzmHUDLoPjiz4i/j3sygAAAAAAAAAAAAAAAD1dxLejht1GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArq7/BgAA//8BoMnq") r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x20009, 0x34888521, 0x5, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xa4081f7e}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.796262862s ago: executing program 5 (id=1436): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$loop_ctrl(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x0, 0x100010, 0xffffffffffffffff, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r4, 0x0, 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000001600)={0x8, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0xb, "97451a24bdc556"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0x4c80, &(0x7f0000000600)={r6, r5, "05d3000028000000000083eb29e46b4bfb57461914278705b6a55ba904cefb1f00536dfdc9ce9c12d1207f8a35d1dad7ed0fc16b2ccd00000000000000080000000c0996d78e489e96651d35ca509de7cf52e7578e9ce37700000000000032936e283ae72a84cc5a72f07fef2fec1463729b336e892b5aadc70f51cb7e5925747f779254377a6a42493fb7026e77fb899a2072631f76cd0a59b17031b431163758724ac0df2d95b9c3fbccef0111f1fc6db466c73268e04c38df1f6bf2cc88aa6126229c332b887eb8e67112000631988ad55f281047000000000000000003000000000100", "2fc7eecad58f368bf3ba45a6f7874bf0f0a2e2d039d23b33645c7a714b200d1ec427e16f2d87c3a7f0a258b1856e10dbfadd1f9f5b294c68af413bb746e6b0803177028065618aa080c2ca8efe18fbb6c85459e9ff5c1aa9c17498a05220b09c2d859832bf5ae846009f6a415023b9a7110bda56f514841bf04e54bf592d28107037e86729ff5789dd40d9180160cf72a92609650dc97d806d75465c3cbabb3e8f59afcd807086dc9a87048f229a1c8b183c2077b18922f8dcade6cbf835b715887e9a20c69f14468fb321e017c8a2361f5300617d2ff15e5e2df6b8fa425461dc9c997020beed571b01b0ae899a7a21fe7f9dce8b2ff0374cde255fe2cd3444fa236242d0a976de3ceed2abb0bcb9e4580db4bf248fa20f27dc7c9a953b420f032e6fe0de2a657b7903f0a3d4d67908255b1ac3274313a683ad8a328816336d20dbfdc9f262073dade576891220dd05e0cb6e97bb433637adb6f42c3a040a0089d9a86b42dffeba614460c184bd405cf3749fad5a47609eeb5c48f0222ea459597a0fa855c9d6d789ed17235c6cbf62757d54c99a03b777b7af6058a33b32aa49973625747e0ff1d3c4898a1ea7e68807d9be2b9ca09de22790441964131b1e6dbf633f06c23ddb02736a741396cb1c3dbe49eabdad6f662ee642be86560e24bf2578bc93119d19b446587a8455b445e1cbcb86848331888a8a8adb0836628a73c9c41f8501ae67caa0165fca251674fcfd5f78415a4497519f0d4a79ba166a55721c4db05be7155ae7bca92f4fff5cdcf2d581d2da972ee240355984210e5927904ee74bd15da96d23e0b5bb07ce1adf2683032e8ae4dd9dd6f5bd841ef30ccdce954426f1cf29f2f35decb485f4faa36caae23e7d136317dbb6ace192dc0484d5e3cc341dee5041430dcd5f320a9f3679196bd2a2348619c4a55e090cecf0da78fdba2b25a3373a813d5e719ef2fbfea38035828e28d1666b64dbabce44140e9f0c7e8685e69d8192d1953c1dba2c2a471658538ade2e295732c4a23ca63b54252673ea15374da608ff431e56c9b74bc88b858511910a8ff6a294354093449e90994cf70a60cb108e19ad7625c27bc7934076a8a8fa8a14b06b0e94813a9ff3961e251856a0d34b728025121cf045be55d3997ca1ba4643509fb7eb84b1dbf97663f63fbf32b32f92eebff4ff420cd8c45fda163c09aa879283c282ef4bc93d416854ada56921cc6f82a67a3d024c1a828eb8d4c901f6066f8df327f694f828124d880da4f98c66087f8a825b9b01609f980a0f48c471fdcb7696e493a02a7b34420ccddae0e26b8f4db77ee712ccbc480fb8fe625d51ee2ead77637b9f7bd4a70fc21581498915c72ce999eb2a3888ad4c66c5e623d2f9c983f4c3e17714a63af06c222a62671b407a8f30619f1cb8a9efc177a18ceefc0760a27f5001124e81eeff04950364cf1881c03c1cc99b1e5dbc36ec94ed875c54a87dc18143303b2ad34738e683fdfe7e257fa5609e785e3c81dcd387bccfba8d31077b2140b06a361167ab1abb6e8c9b6e7b8918c992a7c4fce8797048bc3eba6ef7f65789b6d59ce4e4dcc5a3d44b9ef24de8996347c79cbaaaaef13dbac1dab9fb6090a757be36cf3e15bcde5bddc318bd42265371ebfe941f63a5d2dbcd9c6103ab91b5c292ae86e4dc6df13194dd81319db2ad7f51fe377196b2b87db9614cd1d572f3df9b518d36aacd8c4f454c1a61fd587642e87e8a4d4029e46064cc730e7b75efae0e6b798184b33365160696e327ce80ad8ec0a5c20e57b07b2cc19f849b1c527994b6631ae61bd9c6703966d141714bffb6cfb7708e2c6669cf33f42c8e8130d73a2bdb42bbd3316e1a2deae59b7bbe6e77518326d11714ac543143c8bc4c9cf39d84b06bf10ad463d7b9d14f5d44d98c78f5bc96793c254a652e300065a0e568234110f4f3d93b584b5767e41cb9d2514a16138d8dd650b885b6ac87ce233957dee5c1d2004fc5882d41ffcc1751d565ad92d04ce0cf0221ac7d7a0441f4024ce74ff4d3df9559026ebb5b5602ee9e8d87f189b8f6e61879c417a00321e87ceac1b952e51700d384ed3b07c70fd8be0d61290b6100abc393bfd33f425892509e55350797f139b64b68e357f66a1776504ea67689ca482534308c9c7b76c7f9fbe1d1cc739dee391c0b7a781d6bade90ec2a46f617d436cc7f51eb1c94de092ccf1d7b57c31fc1c8e18b9bab9858792a129dfa62b379d22aec6129065a867bda550337e30edcfc0732a5b69559c8d45270d7df9d06b385c51a05e57280d66f5c02c7ca1f463e6ef6d1d2e3b04c6df77fd88e06197acf4d5287660e90d7b1d5d4b7410d44e36aa3652e86d9b97935fc19459bd1e7f155e497bee58013f9cbef97b669b3d8fbd77a286a50b86aa11e4376e44275297bcdcb252ad8ca4742a6cd66563c4ba6318b765899d853043877b6400d654ba955fa6376857b6307d443168211dde06a156d8908269ab033c9de9546b3cc41583e7cae7038720d909fed58b52f7bc7aba12b1be3a2e23474af919426326556cf37d584c4e905f8d84604fdb192f0993b213107fae21c323d69f3113d2f5d6371a49a40b98030868c824ff0916556044bc32ce80497c46c01e254e2accfd01aeabf18c545b907cd5fd0b00a82c42e644690ad1099dc3ec5e0df8c5d783ec93e6712857137eee4d06762fa12233d1ba4e7bc597d970a434ce615ffe432f6289bd297f7973f29e8460391c44cab29f2e21f639e7aea6c0c7e57a35585573b88ce6a2beed7807278b73a9eb21d82a477f7f9eef24c1cf0b7fddee8b3dfa633cb37c3f1ac53f34acd6dc0e29494d644f9bdce8d65e734fa52d1cdd0f147d48f02000b31fd0dcd2766cf8ea8b92bd340195c6833e4320eaf125ad61fa8772ac380f363fd2b3b5df23aa0e08034cfe5963fada592e851f5b274e6defae6cb1dbc5f29c52855352d8417262780ba7c8040cac21a0fda09a76af7a58b66f9a89d35f7a957548cf49f7117542a2f0f2c1c8bb371eba256aaac009798a97a27a62256fafad3988bb9b577eb00c06d28a91c85aa20f176e44e52b37a8068bfec1434c1277e68619e8459f83359976c81ca49462e1b9abf83fed9d4e08d9fdc6626bd73099ff8c2e95384e0517eff3e02a1882ef5a804989ad5a9536628f3989631f610ba9172c92c44c372ff48d590be9896e741001b3ea511727a1476d706debdea7216e1bf2461fda61a7bc6db99c098fe4f32eafbe2ac15782ddfd1609cec300015b542c835ff195cd779699d8ced1edd571f3734ef6373c526553ee9684674cd5ae1e8f390065ed761257cbb120168dcebacc94f22a15d6bc8444afff61601305c9212f086ae5a322968983568bfaed808fd935a8260709781a58bf3cbc3256e81d272a9c1271b93a1f97feebe77e94912e0361c149076abd1aa186ac38e65d879e92bc58bc7adde9339f712b8a07d798ad573318559a31c1e64354bfc5f3e9a195118cab384d9b7d192305e5fe6e8eaebd7403095e3833fb3a6425e7b8b7ae0515d5cba8a19c2b49e33cd9bedbac96f01c5a24ddc36b35f16cfd55ec584f18ecf7313a812d5d44b6ac02808ab4389e7ed6426454d9f4c69a288d36a211f27c4770cad16daba3c97e0d51a7012ba7ee4881daf21ca720c0a14d54852516c8342989ed328d13366be829416218e0d2cc9c708a06669873b4a7a32e35dbc59d5f7eeebb7fb3c307e84c287c2e3a921e94149a90a56e4c8bcf954844eb7edefea72690c518075cdce72c222961c388ba8cb9e2f881582131cce0898c86ab2f7c1a925301eb6a33bf33baf957f18d648b55e0c613db371343cc7ce89f91423629e644b286bba4d8b4cbb116e30da5f7a4bba8606093fe5d6bad8bc5f98fb1ac476bf8724a8008a725ed3aed86c763f2eac7d77f1ef9a96702e13ec5080bb82606741e08fde37aceb1dd32c11afa92be85ff46ec2010ce17d5cf92e91243ccb1070000002a746ca1f1135b1b0638ffe19c8b31644a08f9f1990685e0f458f096daae910e9f36a83a8ba01dde2b5d0d3097b1cf03be7aee0a8c7c4c8672d45c6310e7d2e5558143ad9e79a9751b8ac54a3e86fdfd9320ef69c7130460e259462be21db94fcbd3181903130f3f982f4c8011bfe62bd5903ad8713281be0fa8de38553ea6c3e566152518bd80fbeb5863f0de7c7cf26606b48b63c89d9f9c798816e7e1e1dbb3946a1048ebf383f117ac9bf565a277086fd9cc0250dd22cf1d2c3cf58fa227f4f2c201be2df79230b6a95333f3a3ded0d11f9b647da9b4cb70fa02631552df57b7a6009b1b36d8f7c9f2fc7ac53912f29e79fdb57acecd431adf2dca1c0e7d31d7ff38ce7b3089416d9ab4f7474f1b68141228d4350ad7541676caf115e6c4eeecc706e0268c2eda740cce7a22e1090fb0216608a13c50316ee056414d0dfce99ab3f9c4619df20d7e0c254c3e9a9717f140b1a4ecdba1ca5ce3bb252083a69bb107338184f55d064c912745aa81588de2299fb9f77201c5ded7cbf572b64c0d6d300344226355d1a4cb8088e43780e01e190e9b877ba14431d115296e31c2cc0266c0df82da2530ac1e094cdfee42fcfdb8ee5d03c251d24d5b0fefafa7b9c2a2e73a814e768d57a5429372dce6266dc547a4c93a05dece1e7601a658d4855843db66ba8ecae9cd1703d66a3aff1be2be77c0ce96772d570c73f88d028eb8716dcb5e49792b39f1a5a4275a4f83d8ae2ea8883bbfaa42050392da86d7a4a22835553cd2fdcd0cca630ad003c4a15ae0b7a7cee875b5a08f0ef70d86187054260001c9698419bf1569b1802439cd3fe320d9272b853e7b34a322a5fbade5cd3ad0e1c4b07d111981494215d3b82c2fe8a7697052a3b7b1ef3fb22d5e33e57c8d422b5e3dc9cf1a5df5401559c56610f44a4e409b12aa82bf661c17a2bb76e469583531f782b55da4eabbb68cb39bf32844398fe0ffb79e4c95e3e3c3ed3e9ac304cf1980b7cde8fcf76966cca196748e4ad7a02debd6ccc4a3e9b8adaa7dc668a76cbd137b2e6fbc673900000100000000009bf5ed16d5f5818535802fa7627a7d352f4216ba3f84481394c0500b7aea67e838d5dd0422eeb940ad42546e1f3c2cd85c53abbaada51b5571323d7ea53d436c2d349befca87909c1dc2a23d2db53ecc272b80896b65fa0cad8854e6b36e052ecbe677024b9614a180fc54c20fac7ed4d16e7ba17a368f0a00a036d23ae4b19ad3d99642ff054850233b60e706a4f575e49234acc76211a5bace9b8417eb6d986dab4bc6b8b510ee0477f6b8738f00709b7f35aac1730017c0037e5c40404d145b527a29500fab1e3c00"}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000061118d000000000016000000000000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x48) r7 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r7) r8 = socket$inet_tcp(0x2, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000200)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x7, 0x7fff0000}]}) io_getevents(0x0, 0x400, 0x0, 0x0, 0xffffffffffffffff) bind$inet(r8, &(0x7f0000000000)={0x2, 0x1111, @empty}, 0x10) listen(r8, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) 3.652680514s ago: executing program 0 (id=1437): ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r2 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x10000) 2.403282539s ago: executing program 5 (id=1438): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x90, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x54, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 1.109805232s ago: executing program 3 (id=1439): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) 1.019378569s ago: executing program 4 (id=1440): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, 0x0, 0x0) 997.146275ms ago: executing program 0 (id=1441): r0 = syz_open_procfs$pagemap(0x0, &(0x7f00000002c0)) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfed5, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00', @ANYRESOCT, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32, @ANYRESHEX=0x0], 0x30}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x7, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x9, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xc0000, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf32106855", 0x18d, 0x8012, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write(r3, 0x0, 0x0) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000340)={0x60, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x583, 0x0, 0x0, 0x0, 0x28, 0x26, 0x7f, 0x50}) 867.081923ms ago: executing program 5 (id=1442): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x1000800, &(0x7f0000000380)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c6261636b67726f756e645f67633d6f6e2c6e6f757365725f78617474722c6e6f71756f74612c64697361626c655f726f6c6c5f666f72776172642c67635f6d657267652c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c646973636172645f756e69743d73656374696f6e2c636865636b706f696e743d64697361626c652c6e6f696e6c696e655f64656e7472792c00ec6da92d1c80a6c720380e3c2c55bf27596d2776ce408c4bb19b149757508e1c7e919c6c2047023baa412d14fa75c8cac6e5f103e13ea52708af0a7c5da8af4ecb6612"], 0x2, 0x5524, &(0x7f00000108c0)="$eJzs3L9vG3UUAPDnpGnTH5QIMbD1pAopkWqrTpsKtgCt+CFSRQUGJnBsx3Jr+6LYcUImBkbEwH+CQGJi5G9gYGZDDCA2JJDvzqUpFCHFjZvk85HO7+7rr9+9rxWd9O4iB3BqLSS//1qKy3E+ImYj4lJEtl+KiLnxpNU8vBQRVyJi5pGtVIw/HDgbERci4vIoeZ6zVLz15bXh1ZVf3vntux/Onbn41bc/Tm/VwLS9HBHdrXx/t5vHtJXH+8V4bdjOYvfmsIj5G90HxXGax93mRpZhtzaeV8vijVY+P93a6Y/iZqdWH8VWezMb3+rlJ+wPW+M82Qfu17az40ZzI4vtfprF1n5e195+fm3b7w/yPI0i3ydZ+hgMxjEfb+418/VsPchivTcoxvO8aaO5N4rDIhani3raaWR1bBzmm362vdvu7ewlw+Z2v532kpVK9ZVK9Va5up02moPmzXKt27h1M1lsdUbTyoNmrbvaStNWp1mpp92lZLFVr5er1WTxdnOjXesl1WrlRuV6eWWp2LuWvHn3g6TTSBZH8fV2b2fQ7vSTzXQ7yT+xlCxXbry6lFytJu+trSfr9+7cWVt//6PbH959be3tN4pJ/ygrWVy+vrxcrl4vL1eXTtH6PyuKnuD64VBK0y4A4Pj5r/7/4WVV/w9M2BP7/9EF6FD9//a9iKff/4f+fyKOVf/7zPT/83FS1g+Hov8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADi1fpr7+q1sZyE/vliMP1cMvVAclyJiJiL+/BezcfZAztkiz9wT5s89VsP3pcgyjM5xrtguRMRqsf3x/NP+FgAAAODk+ubTK1/k3Xr+sjDtgjhK+U2bmUsfTyjffETMLfw8oWwzo5cXJ5Qs+/s+E3sTypbdwJqfULL8ltuZSWX7X2YPhPlHQikPM0daDgAAcCQOdgJH24UAAABwlD6fdgFMRynGjzLHz4Kz/7z/+4Hg+QNHAAAAwDFUmnYBAAAAwMQ9/hw/6//9/h8AAACcbPnv/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8xc7946gNRHEAfjYYyD8FRelzlXRwjBwhZcqIA+QSHCAFuUK6VJyBdDlChCPsCQu7FKwY26vV90nGeGT/eIOgmBlpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADo0u9qs/zx9cO3W3P29bV+RcTD1jy9AQAAAC7ZVZtl82beXr9K7W9S07t0XUREeXHkXtejmJxljlJOdXf/99P7q3s1/IxoEg6fMU3Hy4j4mI6/b7v+FgAAAOD52q7Wi3a03r7Mhy6IPrWTNuXrT5nyioio5n8ypZWHvPc5kibp9z2OLzni0sRWzDKFtVNu41xpV2n+7sdZu9nJqWhP5cXHjkVm6zsAANCj0dmp31EIAAAAffo8dAHkdt3yXBH/lzKPS4HTs+dfPCYNAAAAeIqKoQsAAAAAOteM/3va/6+2/x8AAAAMo93/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC7tqs1yu1ovbs3Z17fJ0xsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPjH/ryjQAiEQRjsXd+ZzP0PKw2amppUgfDxNwYDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb373l/8TU+NMMvfaWHoeSdZOja1TY+/cOPrD+Po1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf785ICIRAEUTBn/O+k739YSdAziBABDY8qatEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAX/e6X/xNT40wyd9pYOh5J1q4aW1eNvQeNowfj7d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABc79+8bNxUHAPzZPl9pAXEEdEMQAokBFnq9lpZuiAEUMfAnIEXptYRe+dFmoFWFuIUNZe6CYEQICRS2/g+dWylL2DLcECRmkM92zvkhcUBkX5LPR3p+Xzsnv++zpShfP+cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKI3fncZJtunkcVwce7xzfyXrn+zrMw/XNxezlsVRnUkfDy9Xd6Juc4kAAABwoo2qO0lZ34cQttKNpayPO5P6Py0/k9X83z+bx2U9v7/uL/uy9s/ab79uv7g7UCcfJzvp9dXh4MLBvFpHPtNj4rl/+Hl+YaL82UsyuSHxB6MXxunkekbfPnr0XnsSnqkjWwDgvzhf9kVQ/j2U9f0mEwPg1GhVCu+y/k86zeYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIfxKDxdxlEIYbE1jTNPdu6vHNY/XN9cLNuVBw/Ww9fTc2anSEMI11eHgwu1zma+3bl77+bycDi4XX/wSgihqdHfKaZ/86MZPhxCI9dHcERBXNzsecnneAQN/lICAOBESouW1fVb6cZSdixaCOGvH/bW/69X4jBj/b/98ZXH1bGq9X+/thnOv97arc97d+7ee3P11vKNwY3Bp29d7L/dv3T18uWrvcmzkp4nJgAAAPw/7aJV6/944eD6/7lKHGas/7/4rv9VdaxE/X+o6aJf05kAAACcbs+/+ucf0SHHo3Y7fLm8tna7n2939y/m2wZS/dfOFK1a/ycLTWcFAAAA1GE8ivas/1+rxGHG9f9nfnzp5+o5kxDC2WL9//zKZ8Nr9U1nrtXx78RNzxEAAIBmnS1adf0/nbz/H+++8hCHEN54LY+LrwGcqf5P3v/mp+pY1ff/L9U3xbkUd/PrMem7IbS6TWcEAADASfZU0bJi//d0Y+mTX8592Pb+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDd/g4AAP//MY062g==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183b41, 0x12b) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f00000000c0)) 490.313894ms ago: executing program 3 (id=1443): sched_setscheduler(0x0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r0, 0x33, 0x0, @void}, 0x10) syz_emit_ethernet(0x82, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x0) ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={0x0, {}, {0x2, 0x0, @rand_addr=0x64010101}, {0x2, 0x0, @empty}, 0xab852ebbeefbd6f5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x200) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000a00)=ANY=[@ANYRES32], 0x0, 0x5e}, 0x28) 232.478242ms ago: executing program 5 (id=1444): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000000)='./file1\x00', 0x4000, &(0x7f0000000cc0)=ANY=[@ANYBLOB="6e6f6e756d7461696c3d302c636865636b3d7374726963742c756d61736b3d30303030303030303030303030303030303133363033302c756e695f786c6174653d312c756e695f786c6174653d302c666d61736b3d30303030303030303030303030303030303030303034302c757466383d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e39352c73686f72746e616d653d6c6f7765722c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c74696d655f6f66667365743d3078303030303030303030303030303166622c666c7573682c756e695f786c6174653d302c73686f72746e616d653d77696e39352c00208893fdd4787adad4209069"], 0x6, 0x2cb, &(0x7f0000000e00)="$eJzs3buLXFUcB/Df3d15GMGZwkoEL5jCxpBNazOLTGBwClGmUAsNJgHZGYQEFnzgJJWtjaV/gSDY+U/YWNgHbAU7Fwxcua95ZWaSCZnEx+dTJGfPOd9zfvfunV22mDMfvTw5vZ7Gzbtf3ot2O4mDXvTiPIluHETtTizpfRMAwL/ZeZbFH1lpeSTZmstH27NJd/ZYIQDwpG3+/b/Bj3svCQDYs3ffe/+tk+Gw/06atuPq5OuzUf4nff5/OX5yMz6JcdyIy9GJ+xHZTNm+mmXZ9CjNdePiZHo2ypOTD3+u1j/5PaLIH0cnukXXcn4w7B+npYX8NK/jQrV/L89fiU68uGb/wbB/ZU0+Rs147dWF+i9FJ375OD6NcVwviijyr/81GPa/Ok7TN7Nv//zig7y8PJ9Mz0atYt5cdviUvzUAAAAAAAAAAAAAAAAAAAAAAPyHXUrTVqTFP924OMm7qvN3Du/nXzQirXWXz+cp87NTglfOB5pm8V19Ps/lNE2zauI8fxQvHcXRs7lqAAAAAAAAAAAAAAAAAAAA+Ge5/dnnp9fG4xu3nkijPg2gflv/467TW+h5JdbM6caspzXf8qDadsvKcVjPSSK2lpGvuFPxjYfvvqHx3KbU9z/seuvaD5/TeIwKd2zUT9fptWT9PWxF3dOuH5KfFuc04xH3am4aynZ6/JprhzqPGr93oXo1NZ8veqZbJkeyrbA3fitXqnqS1atoFnd1bbxRNcrXQjX0wkK8vdPz/ODPisRpHQAAAAAAAAAAAAAAAAAAsFfzN/2uGby7IfTroPyQ/+juuToAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeDrmn/+/qXGePTA0rcIrkyPejtV4M27dfsaXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP/A3wEAAP//EPpehQ==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) sendfile(r1, r0, 0x0, 0x10000) 137.476179ms ago: executing program 4 (id=1445): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) lseek(0xffffffffffffffff, 0x7fffffffffffffff, 0x1) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) shmctl$SHM_INFO(0x0, 0xe, &(0x7f00000000c0)=""/56) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000100)={0x20071026, 0xffffffffffffffff}, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)={0x3c, r4, 0x1, 0x0, 0x0, {0x2d}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}}, 0x0) 0s ago: executing program 5 (id=1446): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="18020000fcffffff0000000003000008850000002800000085000000a000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000000)={0xf, r0, 0x4b36baea9e1c7e99}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd700001b133d62ec562bab7670a5b99ea33d7"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20048004) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fd, 0x0, 0x3, 0x3}, 0x10) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/36, 0x24}], 0x1}, 0x4}], 0x1, 0x400101a0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) syz_io_uring_setup(0x34b8, &(0x7f0000000500)={0x0, 0x12d9, 0x20, 0x3, 0xe9}, &(0x7f0000000300), &(0x7f00000002c0), &(0x7f0000000400)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) write$binfmt_register(r6, &(0x7f0000000040)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x0, 0x3a, 'tracefs\x00', 0x3a, '*:@{\':', 0x3a, './trace'}, 0x35) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) kernel console output (not intermixed with test programs): irst mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 233.782991][ T6498] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 233.791763][ T6498] BTRFS info (device loop2): use zlib compression, level 3 [ 233.799102][ T6498] BTRFS info (device loop2): turning on sync discard [ 233.805879][ T6498] BTRFS info (device loop2): using free space tree [ 233.860147][ T6508] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 233.916696][ T6523] loop1: detected capacity change from 0 to 128 [ 233.969488][ T6523] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 234.020463][ T6508] usb 1-1: device descriptor read/64, error -71 [ 234.024484][ T6523] ext4 filesystem being mounted at /97/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 234.105528][ T6498] BTRFS info (device loop2): enabling ssd optimizations [ 234.844681][ T26] audit: type=1800 audit(1790341712.166:16): pid=6543 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.551" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 234.885314][ T6508] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 234.927705][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 235.134749][ T6508] usb 1-1: device descriptor read/64, error -71 [ 235.136261][ T6545] loop3: detected capacity change from 0 to 1024 [ 235.241900][ T4279] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 235.356155][ T6551] loop1: detected capacity change from 0 to 512 [ 235.637310][ T6551] FAT-fs (loop1): Directory bread(block 199916) failed [ 235.821322][ T6551] FAT-fs (loop1): Directory bread(block 199917) failed [ 235.874085][ T6551] FAT-fs (loop1): Directory bread(block 199918) failed [ 235.880509][ T6508] usb usb1-port1: attempt power cycle [ 235.930532][ T6551] FAT-fs (loop1): Directory bread(block 199919) failed [ 235.937755][ T6551] FAT-fs (loop1): Directory bread(block 199920) failed [ 235.949419][ T6545] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 236.069623][ T6551] FAT-fs (loop1): Directory bread(block 199921) failed [ 236.082579][ T6551] FAT-fs (loop1): Directory bread(block 199922) failed [ 236.089514][ T6551] FAT-fs (loop1): Directory bread(block 199923) failed [ 236.317124][ T6558] loop4: detected capacity change from 0 to 32768 [ 236.338674][ T6562] overlayfs: unrecognized mount option "/" or missing value [ 236.406467][ T6558] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.559 (6558) [ 236.551170][ T6558] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 236.561697][ T6558] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 236.571181][ T6558] BTRFS info (device loop4): use zlib compression, level 3 [ 236.580311][ T6558] BTRFS info (device loop4): turning on sync discard [ 236.587116][ T6558] BTRFS info (device loop4): using free space tree [ 236.658945][ T6571] binder: 6570:6571 ioctl c0306201 0 returned -14 [ 236.804266][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 237.241484][ T6586] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 237.635771][ T6593] random: crng reseeded on system resumption [ 238.062973][ T6595] loop3: detected capacity change from 0 to 128 [ 238.650976][ T6558] BTRFS info (device loop4): enabling ssd optimizations [ 239.041477][ T26] audit: type=1800 audit(1790341716.286:17): pid=6611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.559" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 239.482295][ T4286] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 239.648702][ T6619] loop1: detected capacity change from 0 to 1024 [ 240.111381][ T6619] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 240.560085][ T6621] nvme_fabrics: missing parameter 'transport=%s' [ 240.566482][ T6621] nvme_fabrics: missing parameter 'nqn=%s' [ 240.676918][ T6619] overlayfs: unrecognized mount option "/" or missing value [ 240.706146][ T6635] 9pnet_fd: Insufficient options for proto=fd [ 240.954437][ T6636] loop2: detected capacity change from 0 to 512 [ 241.049755][ T6640] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 241.143749][ T6641] random: crng reseeded on system resumption [ 241.173592][ T6636] FAT-fs (loop2): Directory bread(block 199916) failed [ 241.207849][ T6642] loop0: detected capacity change from 0 to 128 [ 241.216445][ T6636] FAT-fs (loop2): Directory bread(block 199917) failed [ 241.353798][ T6636] FAT-fs (loop2): Directory bread(block 199918) failed [ 241.475940][ T6636] FAT-fs (loop2): Directory bread(block 199919) failed [ 241.613985][ T6636] FAT-fs (loop2): Directory bread(block 199920) failed [ 241.629952][ T6636] FAT-fs (loop2): Directory bread(block 199921) failed [ 241.636991][ T6636] FAT-fs (loop2): Directory bread(block 199922) failed [ 242.221620][ T6636] FAT-fs (loop2): Directory bread(block 199923) failed [ 242.382243][ T6648] binder: 6643:6648 ioctl c0306201 0 returned -14 [ 243.958548][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 244.006824][ T6651] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 244.128900][ T6654] random: crng reseeded on system resumption [ 244.191981][ T6655] loop4: detected capacity change from 0 to 128 [ 245.071076][ T6663] loop0: detected capacity change from 0 to 32768 [ 245.097426][ T6663] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.582 (6663) [ 245.113395][ T6663] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 245.113463][ T6663] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 245.113559][ T6663] BTRFS info (device loop0): use zlib compression, level 3 [ 245.113580][ T6663] BTRFS info (device loop0): turning on sync discard [ 245.113594][ T6663] BTRFS info (device loop0): using free space tree [ 245.369858][ T6688] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 245.396053][ T6663] BTRFS info (device loop0): enabling ssd optimizations [ 245.914621][ T26] audit: type=1800 audit(1790341723.266:18): pid=6694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.582" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 246.175963][ T6686] nvme_fabrics: missing parameter 'transport=%s' [ 246.230025][ T6686] nvme_fabrics: missing parameter 'nqn=%s' [ 246.432876][ T6698] loop3: detected capacity change from 0 to 1024 [ 246.467125][ T4271] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 246.540923][ T6698] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 246.570545][ T6707] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 246.650162][ T6508] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 246.698176][ T6708] random: crng reseeded on system resumption [ 246.760657][ T6709] loop4: detected capacity change from 0 to 128 [ 247.674290][ T6508] usb 3-1: not running at top speed; connect to a high speed hub [ 247.693528][ T6508] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 247.707159][ T6712] overlayfs: unrecognized mount option "/" or missing value [ 247.782042][ T6508] usb 3-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 247.834700][ T6508] usb 3-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 247.845360][ T6508] usb 3-1: Product: syz [ 247.849597][ T6508] usb 3-1: Manufacturer: syz [ 247.884445][ T6508] usb 3-1: Found UVC 1.00 device syz (225a:e1d4) [ 248.074638][ T6508] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 248.102368][ T6508] uvcvideo 3-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 248.130611][ T6724] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 248.133453][ T6508] uvcvideo 3-1:1.1: Failed to initialize the device (-5). [ 248.177752][ T6508] usb 3-1: USB disconnect, device number 13 [ 248.240046][ T6725] random: crng reseeded on system resumption [ 248.303759][ T6726] loop4: detected capacity change from 0 to 128 [ 249.485228][ T6739] loop4: detected capacity change from 0 to 32768 [ 249.623118][ T6739] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.596 (6739) [ 249.990825][ T6739] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 250.001805][ T6739] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 250.010518][ T6739] BTRFS info (device loop4): use zlib compression, level 3 [ 250.019350][ T6739] BTRFS info (device loop4): turning on sync discard [ 250.026138][ T6739] BTRFS info (device loop4): using free space tree [ 250.045389][ T6737] nvme_fabrics: missing parameter 'transport=%s' [ 250.070178][ T6737] nvme_fabrics: missing parameter 'nqn=%s' [ 250.371734][ T6749] 9pnet_fd: Insufficient options for proto=fd [ 250.559067][ T6739] BTRFS info (device loop4): enabling ssd optimizations [ 250.873191][ T26] audit: type=1800 audit(1790341728.226:19): pid=6770 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.596" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 251.167863][ T4286] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 251.178306][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 251.192191][ T6775] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 251.334525][ T6778] random: crng reseeded on system resumption [ 251.397225][ T6780] loop1: detected capacity change from 0 to 128 [ 252.051611][ T6781] loop3: detected capacity change from 0 to 512 [ 252.116938][ T6781] FAT-fs (loop3): Directory bread(block 199916) failed [ 252.153937][ T6781] FAT-fs (loop3): Directory bread(block 199917) failed [ 252.178800][ T6781] FAT-fs (loop3): Directory bread(block 199918) failed [ 252.237486][ T6781] FAT-fs (loop3): Directory bread(block 199919) failed [ 252.272739][ T6781] FAT-fs (loop3): Directory bread(block 199920) failed [ 252.279683][ T6781] FAT-fs (loop3): Directory bread(block 199921) failed [ 252.355492][ T6781] FAT-fs (loop3): Directory bread(block 199922) failed [ 252.362798][ T4320] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 252.390893][ T6781] FAT-fs (loop3): Directory bread(block 199923) failed [ 252.650052][ T4260] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 252.671510][ T4320] usb 1-1: not running at top speed; connect to a high speed hub [ 252.680895][ T4320] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 252.735530][ T6777] loop2: detected capacity change from 0 to 32768 [ 252.830364][ T4260] usb 5-1: Using ep0 maxpacket: 32 [ 252.847627][ T4260] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 252.887990][ T6777] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.605 (6777) [ 252.998804][ T4260] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 253.169410][ T4260] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 253.289128][ T4320] usb 1-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 253.293798][ T4260] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.299502][ T4320] usb 1-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 253.334446][ T4260] usb 5-1: Product: syz [ 253.349003][ T4260] usb 5-1: Manufacturer: syz [ 253.359120][ T4260] usb 5-1: SerialNumber: syz [ 253.385727][ T6777] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 253.402467][ T4320] usb 1-1: Product: syz [ 253.407383][ T4320] usb 1-1: Manufacturer: syz [ 253.429418][ T4320] usb 1-1: Found UVC 1.00 device syz (225a:e1d4) [ 253.440707][ T4260] usb 5-1: config 0 descriptor?? [ 253.448580][ T6777] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 253.469118][ T6777] BTRFS info (device loop2): setting nodatasum [ 253.495908][ T6777] BTRFS info (device loop2): force zlib compression, level 3 [ 253.523812][ T6777] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 253.551784][ T6777] BTRFS info (device loop2): use lzo compression, level 0 [ 253.590181][ T6777] BTRFS info (device loop2): turning on flush-on-commit [ 253.607544][ T6777] BTRFS info (device loop2): enabling auto defrag [ 253.629805][ T4320] usb 1-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 253.649767][ T6777] BTRFS info (device loop2): max_inline at 0 [ 253.670227][ T4320] uvcvideo 1-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 253.678949][ T6798] nvme_fabrics: missing parameter 'transport=%s' [ 253.679115][ T4320] uvcvideo 1-1:1.1: Failed to initialize the device (-5). [ 253.693204][ T6798] nvme_fabrics: missing parameter 'nqn=%s' [ 253.703357][ T6777] BTRFS info (device loop2): using free space tree [ 253.749986][ T4320] usb 1-1: USB disconnect, device number 8 [ 253.948503][ T6796] loop3: detected capacity change from 0 to 32768 [ 253.966491][ T6777] BTRFS info (device loop2): enabling ssd optimizations [ 253.978876][ T6796] (syz.3.614,6796,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 254.046933][ T6796] (syz.3.614,6796,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 254.101833][ T6796] JBD2: Ignoring recovery information on journal [ 254.221216][ T6796] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 254.248861][ T4279] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 254.278995][ T6829] loop0: detected capacity change from 0 to 1024 [ 254.401214][ T6829] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 254.603782][ T6829] overlayfs: unrecognized mount option "/" or missing value [ 254.697402][ T6834] random: crng reseeded on system resumption [ 254.769748][ T6837] loop1: detected capacity change from 0 to 128 [ 255.289816][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 255.695076][ T4320] usb 5-1: USB disconnect, device number 5 [ 255.743712][ T4272] ocfs2: Unmounting device (7,3) on (node local) [ 255.792295][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.800729][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.874754][ T6841] loop0: detected capacity change from 0 to 1024 [ 256.168089][ T6841] hfsplus: xattr searching failed [ 256.198030][ T6843] loop2: detected capacity change from 0 to 32768 [ 256.241908][ T6843] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.619 (6843) [ 256.773550][ T6843] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 256.784325][ T6843] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 256.793052][ T6843] BTRFS info (device loop2): use zlib compression, level 3 [ 256.800326][ T6843] BTRFS info (device loop2): turning on sync discard [ 256.807023][ T6843] BTRFS info (device loop2): using free space tree [ 258.332103][ T6843] BTRFS info (device loop2): enabling ssd optimizations [ 258.564191][ T26] audit: type=1800 audit(1790341735.916:20): pid=6887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.619" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 258.652745][ T6869] nvme_fabrics: missing parameter 'transport=%s' [ 258.660540][ T27] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 258.678584][ T6869] nvme_fabrics: missing parameter 'nqn=%s' [ 258.687350][ T6889] loop3: detected capacity change from 0 to 1024 [ 260.033608][ T27] usb 2-1: not running at top speed; connect to a high speed hub [ 260.043312][ T6889] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 260.052677][ T4279] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 260.071709][ T27] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 260.274635][ T6889] overlayfs: unrecognized mount option "/" or missing value [ 260.406436][ T27] usb 2-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 260.420034][ T27] usb 2-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 260.441731][ T27] usb 2-1: Product: syz [ 260.450457][ T27] usb 2-1: Manufacturer: syz [ 260.485938][ T27] usb 2-1: Found UVC 1.00 device syz (225a:e1d4) [ 260.684396][ T27] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 260.702662][ T27] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 260.712125][ T27] uvcvideo 2-1:1.1: Failed to initialize the device (-5). [ 260.729784][ T27] usb 2-1: USB disconnect, device number 6 [ 260.858246][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 260.866700][ T6903] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 261.006902][ T6904] random: crng reseeded on system resumption [ 261.131913][ T6906] loop2: detected capacity change from 0 to 128 [ 262.816644][ T6923] loop2: detected capacity change from 0 to 1024 [ 263.020151][ T6931] netlink: 8 bytes leftover after parsing attributes in process `syz.4.641'. [ 263.736307][ T6928] nvme_fabrics: missing parameter 'nqn=%s' [ 264.027445][ T6940] loop2: detected capacity change from 0 to 64 [ 264.073692][ T6940] hfs: request for non-existent node 524288 in B*Tree [ 264.086113][ T6940] hfs: request for non-existent node 524288 in B*Tree [ 264.094007][ T6940] hfs: get root inode failed [ 264.156050][ T6510] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 264.175050][ T4265] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 264.229259][ T7] smpboot: CPU 1 is now offline [ 264.250757][ T6940] loop2: detected capacity change from 0 to 256 [ 264.363854][ T6510] usb 1-1: config 1 has an invalid interface number: 128 but max is 1 [ 264.396980][ T6510] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 264.453759][ T6510] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 264.498500][ T6510] usb 1-1: config 1 has no interface number 0 [ 264.519578][ T6510] usb 1-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 264.563593][ T6510] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 264.585563][ T6510] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.606069][ T6510] usb 1-1: Product: syz [ 264.617034][ T6921] loop1: detected capacity change from 0 to 40427 [ 264.623631][ T6510] usb 1-1: Manufacturer: syz [ 264.633605][ T6510] usb 1-1: SerialNumber: syz [ 264.646010][ T6921] F2FS-fs (loop1): build fault injection attr: rate: 19, type: 0x3ffff [ 264.675158][ T6510] cdc_wdm 1-1:1.128: skipping garbage [ 264.687883][ T6510] cdc_wdm 1-1:1.128: skipping garbage [ 264.759096][ T6510] cdc_wdm: probe of 1-1:1.128 failed with error -22 [ 264.877960][ T7] usb 1-1: USB disconnect, device number 9 [ 264.930091][ T6510] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 264.983067][ T6947] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 265.453955][ T6510] usb 3-1: unable to get BOS descriptor or descriptor too short [ 266.028693][ T6950] random: crng reseeded on system resumption [ 266.465210][ T6510] usb 3-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 266.530096][ T6510] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.550463][ T6947] loop4: detected capacity change from 0 to 128 [ 266.719978][ T6510] usb 3-1: Product: syz [ 266.744371][ T6510] usb 3-1: Manufacturer: syz [ 267.068660][ T6510] usb 3-1: SerialNumber: syz [ 267.929366][ T6510] usb 3-1: MIDIStreaming interface descriptor not found [ 269.310709][ T6965] netlink: 8 bytes leftover after parsing attributes in process `syz.0.656'. [ 269.341606][ T6969] loop3: detected capacity change from 0 to 1024 [ 269.484232][ T6970] loop2: detected capacity change from 0 to 32768 [ 269.512273][ T6970] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.658 (6970) [ 269.545010][ T6510] usb 3-1: USB disconnect, device number 14 [ 269.812795][ T6972] loop1: detected capacity change from 0 to 64 [ 269.894054][ T6970] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 269.904376][ T6970] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 269.913063][ T6970] BTRFS info (device loop2): use zlib compression, level 3 [ 269.920433][ T6970] BTRFS info (device loop2): turning on sync discard [ 269.927156][ T6970] BTRFS info (device loop2): using free space tree [ 270.141661][ T6982] binder: 6978:6982 ioctl c018620b 0 returned -14 [ 270.215295][ T6970] BTRFS info (device loop2): enabling ssd optimizations [ 270.495732][ T26] audit: type=1800 audit(1790341747.846:21): pid=6999 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.658" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 270.676169][ T7001] FAULT_INJECTION: forcing a failure. [ 270.676169][ T7001] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 270.817125][ T4279] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 270.939379][ T7001] CPU: 0 PID: 7001 Comm: syz.3.663 Not tainted syzkaller #0 [ 270.946722][ T7001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 270.956795][ T7001] Call Trace: [ 270.960070][ T7001] [ 270.962988][ T7001] dump_stack_lvl+0x188/0x24e [ 270.967692][ T7001] ? show_regs_print_info+0x12/0x12 [ 270.972878][ T7001] ? load_image+0x410/0x410 [ 270.977400][ T7001] ? __lock_acquire+0x7c40/0x7c40 [ 270.982414][ T7001] ? full_name_hash+0x8e/0xe0 [ 270.987094][ T7001] should_fail_ex+0x390/0x4c0 [ 270.991765][ T7001] _copy_to_user+0x2c/0x130 [ 270.996271][ T7001] put_user_ifreq+0x74/0xb0 [ 271.000807][ T7001] sock_do_ioctl+0x272/0x320 [ 271.005408][ T7001] ? sock_show_fdinfo+0xb0/0xb0 [ 271.010254][ T7001] sock_ioctl+0x48a/0x700 [ 271.014592][ T7001] ? sock_poll+0x420/0x420 [ 271.019007][ T7001] ? bpf_lsm_file_ioctl+0x5/0x10 [ 271.023982][ T7001] ? security_file_ioctl+0x7c/0xa0 [ 271.029102][ T7001] ? sock_poll+0x420/0x420 [ 271.033519][ T7001] __se_sys_ioctl+0xfa/0x170 [ 271.038111][ T7001] do_syscall_64+0x4c/0xa0 [ 271.042535][ T7001] ? clear_bhb_loop+0x60/0xb0 [ 271.047218][ T7001] ? clear_bhb_loop+0x60/0xb0 [ 271.052580][ T7001] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 271.058556][ T7001] RIP: 0033:0x7fc677f9e159 [ 271.062982][ T7001] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.083120][ T7001] RSP: 002b:00007fc678f35028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 271.091545][ T7001] RAX: ffffffffffffffda RBX: 00007fc678225fa0 RCX: 00007fc677f9e159 [ 271.099508][ T7001] RDX: 0000200000000040 RSI: 0000000000008933 RDI: 0000000000000005 [ 271.107468][ T7001] RBP: 00007fc67803506b R08: 0000000000000000 R09: 0000000000000000 [ 271.115427][ T7001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 271.123381][ T7001] R13: 00007fc678226038 R14: 00007fc678225fa0 R15: 00007ffd96ecec38 [ 271.131347][ T7001] [ 271.408973][ T7005] nvme_fabrics: missing parameter 'nqn=%s' [ 273.332600][ T7018] netlink: 8 bytes leftover after parsing attributes in process `syz.0.672'. [ 273.555169][ T7024] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 273.713189][ T7024] random: crng reseeded on system resumption [ 274.012177][ T7024] loop4: detected capacity change from 0 to 128 [ 274.106250][ T7033] binder: BINDER_SET_CONTEXT_MGR already set [ 274.165084][ T7033] binder: 7032:7033 ioctl 4018620d 200000000100 returned -16 [ 274.214393][ T7034] binder: BINDER_SET_CONTEXT_MGR already set [ 274.235152][ T7036] netlink: 24 bytes leftover after parsing attributes in process `syz.1.676'. [ 274.257916][ T7034] binder: 7032:7034 ioctl 4018620d 200000004a80 returned -16 [ 275.146392][ T7033] binder: 7032:7033 ioctl c018620b 0 returned -14 [ 275.378070][ T7045] loop0: detected capacity change from 0 to 1024 [ 275.454114][ T7045] hfsplus: xattr searching failed [ 277.022061][ T7052] loop3: detected capacity change from 0 to 128 [ 277.153047][ T7052] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 277.215627][ T7052] ext4 filesystem being mounted at /142/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 277.263788][ T7057] netlink: 32 bytes leftover after parsing attributes in process `syz.1.686'. [ 277.334299][ T7053] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 277.695648][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 277.732397][ T7053] CIFS: Attempting to mount \\127.0.0.1\share [ 277.836500][ T7053] CIFS: VFS: No username specified [ 278.059500][ T7075] Bluetooth: MGMT ver 1.22 [ 279.204151][ T7080] binder: BINDER_SET_CONTEXT_MGR already set [ 279.247990][ T7080] binder: 7078:7080 ioctl 4018620d 200000004a80 returned -16 [ 279.313282][ T7080] binder: 7078:7080 ioctl c018620b 0 returned -14 [ 279.818795][ T7091] loop4: detected capacity change from 0 to 1024 [ 279.984541][ T7095] netlink: 8 bytes leftover after parsing attributes in process `syz.2.698'. [ 281.549309][ T7100] netlink: 8 bytes leftover after parsing attributes in process `syz.3.699'. [ 282.799952][ T7] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 283.451127][ T7] usb 5-1: not running at top speed; connect to a high speed hub [ 283.475716][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 283.506039][ T7] usb 5-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 283.534334][ T7] usb 5-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 283.563343][ T7] usb 5-1: Product: syz [ 283.574186][ T7] usb 5-1: Manufacturer: syz [ 283.606938][ T7] usb 5-1: Found UVC 1.00 device syz (225a:e1d4) [ 283.653265][ T7119] FAULT_INJECTION: forcing a failure. [ 283.653265][ T7119] name failslab, interval 1, probability 0, space 0, times 0 [ 283.854399][ T7] usb 5-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 284.812858][ T7119] CPU: 0 PID: 7119 Comm: syz.0.692 Not tainted syzkaller #0 [ 284.820191][ T7119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 284.830267][ T7119] Call Trace: [ 284.833550][ T7119] [ 284.836466][ T7119] dump_stack_lvl+0x188/0x24e [ 284.841149][ T7119] ? show_regs_print_info+0x12/0x12 [ 284.846334][ T7119] ? load_image+0x410/0x410 [ 284.850853][ T7119] ? __might_sleep+0xd0/0xd0 [ 284.855430][ T7119] ? __lock_acquire+0x7c40/0x7c40 [ 284.860452][ T7119] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 284.866421][ T7119] should_fail_ex+0x390/0x4c0 [ 284.871089][ T7119] should_failslab+0x5/0x20 [ 284.875576][ T7119] slab_pre_alloc_hook+0x59/0x300 [ 284.880592][ T7119] ? lockdep_hardirqs_on+0x94/0x140 [ 284.885781][ T7119] ? setup_mq_sysctls+0x50/0x560 [ 284.890722][ T7119] __kmem_cache_alloc_node+0x4f/0x270 [ 284.896085][ T7119] ? setup_mq_sysctls+0x50/0x560 [ 284.901003][ T7119] __kmalloc_node_track_caller+0xa0/0x240 [ 284.906711][ T7119] kmemdup+0x27/0x60 [ 284.910677][ T7119] setup_mq_sysctls+0x50/0x560 [ 284.915423][ T7119] ? copy_ipcs+0x2e9/0x500 [ 284.919826][ T7119] copy_ipcs+0x2fc/0x500 [ 284.924063][ T7119] create_new_namespaces+0x212/0x700 [ 284.929337][ T7119] unshare_nsproxy_namespaces+0x116/0x160 [ 284.935042][ T7119] ksys_unshare+0x4f6/0x8e0 [ 284.939533][ T7119] ? sighand_ctor+0x40/0x40 [ 284.944017][ T7119] ? lock_chain_count+0x20/0x20 [ 284.948942][ T7119] ? syscall_enter_from_user_mode+0x21/0x80 [ 284.954829][ T7119] __x64_sys_unshare+0x34/0x40 [ 284.959581][ T7119] do_syscall_64+0x4c/0xa0 [ 284.963983][ T7119] ? clear_bhb_loop+0x60/0xb0 [ 284.968676][ T7119] ? clear_bhb_loop+0x60/0xb0 [ 284.973360][ T7119] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.979255][ T7119] RIP: 0033:0x7ff72fb9e159 [ 284.983659][ T7119] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.003263][ T7119] RSP: 002b:00007ff7309ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 285.011667][ T7119] RAX: ffffffffffffffda RBX: 00007ff72fe25fa0 RCX: 00007ff72fb9e159 [ 285.019631][ T7119] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c040480 [ 285.027604][ T7119] RBP: 00007ff72fc3506b R08: 0000000000000000 R09: 0000000000000000 [ 285.035561][ T7119] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 285.043530][ T7119] R13: 00007ff72fe26038 R14: 00007ff72fe25fa0 R15: 00007ffc2af94298 [ 285.051492][ T7119] [ 285.430030][ T7] uvcvideo 5-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 285.438921][ T7] uvcvideo 5-1:1.1: Failed to initialize the device (-5). [ 285.556556][ T7] usb 5-1: USB disconnect, device number 6 [ 285.576240][ T7121] loop1: detected capacity change from 0 to 256 [ 285.583215][ T7121] exfat: Deprecated parameter 'namecase' [ 285.601925][ T7121] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 285.618589][ T7121] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xd31fc67a, utbl_chksum : 0xe619d30d) [ 286.289234][ T7130] loop3: detected capacity change from 0 to 32768 [ 286.337388][ T7130] XFS (loop3): Mounting V5 Filesystem [ 286.518793][ T7130] XFS (loop3): Ending clean mount [ 286.619726][ T4272] XFS (loop3): Unmounting Filesystem [ 287.093091][ T6509] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 287.291787][ T6509] usb 3-1: config 1 has an invalid interface number: 128 but max is 1 [ 287.310662][ T7151] netlink: 8 bytes leftover after parsing attributes in process `syz.3.712'. [ 287.324684][ T6509] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 287.350498][ T6509] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 287.383076][ T6509] usb 3-1: config 1 has no interface number 0 [ 287.407763][ T6509] usb 3-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 287.475776][ T6509] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 287.491320][ T7154] loop4: detected capacity change from 0 to 128 [ 287.510327][ T6509] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.534344][ T7154] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 287.558847][ T6509] usb 3-1: Product: syz [ 287.573799][ T7154] ext4 filesystem being mounted at /150/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 287.588475][ T6509] usb 3-1: Manufacturer: syz [ 287.599441][ T6509] usb 3-1: SerialNumber: syz [ 287.699483][ T6509] cdc_wdm 3-1:1.128: skipping garbage [ 287.846977][ T6509] cdc_wdm 3-1:1.128: skipping garbage [ 287.864194][ T7158] random: crng reseeded on system resumption [ 288.158621][ T6509] cdc_wdm: probe of 3-1:1.128 failed with error -22 [ 288.181216][ T7158] loop0: detected capacity change from 0 to 128 [ 288.242315][ T6509] usb 3-1: USB disconnect, device number 15 [ 288.381514][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 289.320288][ T7165] loop0: detected capacity change from 0 to 32768 [ 289.360532][ T7165] XFS (loop0): Mounting V5 Filesystem [ 289.478201][ T7165] XFS (loop0): Ending clean mount [ 289.678136][ T7165] XFS (loop0): Quotacheck needed: Please wait. [ 290.043049][ T7165] XFS (loop0): Quotacheck: Done. [ 290.646959][ T7206] loop4: detected capacity change from 0 to 128 [ 290.660449][ T4271] XFS (loop0): Unmounting Filesystem [ 290.699347][ T7206] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 291.575202][ T7206] ext4 filesystem being mounted at /153/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 292.210842][ T7220] comedi comedi1: Minor 0 could not be opened [ 292.225674][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 293.070478][ T6510] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 293.272863][ T6510] usb 1-1: Using ep0 maxpacket: 32 [ 293.289013][ T6510] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 293.423294][ T6510] usb 1-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 293.638915][ T6510] usb 1-1: config 0 interface 0 has no altsetting 0 [ 293.661876][ T6510] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 293.684465][ T7233] nvme_fabrics: missing parameter 'nqn=%s' [ 293.695305][ T6510] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.723650][ T6510] usb 1-1: Product: syz [ 293.737249][ T6510] usb 1-1: Manufacturer: syz [ 293.763023][ T6510] usb 1-1: SerialNumber: syz [ 293.785476][ T6510] usb 1-1: config 0 descriptor?? [ 293.828305][ T6510] gs_usb 1-1:0.0: Required endpoints not found [ 294.268747][ T7245] futex_wake_op: syz.3.741 tries to shift op by 144; fix this program [ 295.846136][ T6509] usb 1-1: USB disconnect, device number 10 [ 297.323984][ T7258] 9pnet_fd: Insufficient options for proto=fd [ 298.755492][ T7279] nvme_fabrics: unknown parameter or missing value 'nq' in ctrl creation request [ 299.498610][ T7295] loop3: detected capacity change from 0 to 1024 [ 299.580441][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.619800][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.659189][ T7296] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.697824][ T7296] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.741119][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.782873][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.928309][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 299.969372][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.014080][ T7296] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.041136][ T7296] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.117930][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.146262][ T7295] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.202551][ T7296] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.230697][ T7] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 300.241735][ T7296] hfsplus: request for non-existent node 33423360 in B*Tree [ 300.441407][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 300.462801][ T7] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 300.515363][ T7] usb 5-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 300.575893][ T7] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.625769][ T7] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 300.676837][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.821561][ T7] usb 5-1: Product: syz [ 301.009924][ T7] usb 5-1: Manufacturer: syz [ 301.035982][ T7] usb 5-1: SerialNumber: syz [ 302.391104][ T7] usb 5-1: config 0 descriptor?? [ 302.430740][ T7] gs_usb 5-1:0.0: Required endpoints not found [ 302.467372][ T7317] nvme_fabrics: unknown parameter or missing value 'nq' in ctrl creation request [ 303.817704][ T4315] usb 5-1: USB disconnect, device number 7 [ 304.219163][ T7337] loop4: detected capacity change from 0 to 512 [ 304.246106][ T7337] EXT4-fs (loop4): couldn't mount as ext2 due to feature incompatibilities [ 304.831472][ T4277] Bluetooth: hci0: command 0x040e tx timeout [ 304.925941][ T7346] 9pnet_fd: Insufficient options for proto=fd [ 307.737934][ T7370] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[4272] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[7370] [ 309.360000][ T4315] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 311.004932][ T4315] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 311.032793][ T4315] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBE, skipping [ 311.081649][ T7389] futex_wake_op: syz.2.784 tries to shift op by 144; fix this program [ 311.097406][ T4315] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 312.234813][ T4315] usb 5-1: string descriptor 0 read error: -71 [ 312.320039][ T4315] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 312.373051][ T4315] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 312.602527][ T4315] usb 5-1: config 0 descriptor?? [ 312.718904][ T7402] nvme_fabrics: unknown parameter or missing value 'nqn=' in ctrl creation request [ 312.741465][ T4315] usb 5-1: can't set config #0, error -71 [ 312.949374][ T4315] usb 5-1: USB disconnect, device number 8 [ 313.386334][ T7410] loop1: detected capacity change from 0 to 4096 [ 313.857041][ T7410] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 314.054883][ T7421] loop4: detected capacity change from 0 to 32768 [ 314.067837][ T7421] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.794 (7421) [ 314.083075][ T7421] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 314.093462][ T7421] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 314.102218][ T7421] BTRFS info (device loop4): use zlib compression, level 3 [ 314.109424][ T7421] BTRFS info (device loop4): turning on sync discard [ 314.116233][ T7421] BTRFS info (device loop4): using free space tree [ 314.199132][ T7410] ntfs3: loop1: Failed to load $Extend. [ 314.268453][ T7421] BTRFS info (device loop4): enabling ssd optimizations [ 314.438828][ T26] audit: type=1800 audit(1790341791.786:22): pid=7421 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.794" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 314.876866][ T4286] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 317.276955][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.287956][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.387734][ T7458] nvme_fabrics: unknown parameter or missing value 'nqn=' in ctrl creation request [ 318.536500][ T7460] FAULT_INJECTION: forcing a failure. [ 318.536500][ T7460] name failslab, interval 1, probability 0, space 0, times 0 [ 318.617017][ T7460] CPU: 0 PID: 7460 Comm: syz.4.803 Not tainted syzkaller #0 [ 318.624352][ T7460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 318.634506][ T7460] Call Trace: [ 318.637776][ T7460] [ 318.640701][ T7460] dump_stack_lvl+0x188/0x24e [ 318.645373][ T7460] ? show_regs_print_info+0x12/0x12 [ 318.650572][ T7460] ? load_image+0x410/0x410 [ 318.655244][ T7460] ? __might_sleep+0xd0/0xd0 [ 318.659846][ T7460] ? __lock_acquire+0x7c40/0x7c40 [ 318.664870][ T7460] should_fail_ex+0x390/0x4c0 [ 318.669561][ T7460] should_failslab+0x5/0x20 [ 318.674059][ T7460] slab_pre_alloc_hook+0x59/0x300 [ 318.679083][ T7460] ? nfnetlink_rcv+0xea4/0x2470 [ 318.683930][ T7460] __kmem_cache_alloc_node+0x4f/0x270 [ 318.689293][ T7460] ? nfnetlink_rcv+0xea4/0x2470 [ 318.694312][ T7460] kmalloc_trace+0x26/0xe0 [ 318.698811][ T7460] nfnetlink_rcv+0xea4/0x2470 [ 318.703531][ T7460] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 318.709092][ T7460] ? ref_tracker_free+0x682/0x830 [ 318.714176][ T7460] ? netlink_deliver_tap+0x2e/0x1b0 [ 318.719396][ T7460] ? __netlink_deliver_tap+0x7a9/0x7e0 [ 318.725026][ T7460] ? netlink_deliver_tap+0x2e/0x1b0 [ 318.730457][ T7460] netlink_unicast+0x7ad/0x920 [ 318.736118][ T7460] netlink_sendmsg+0x8ad/0xbd0 [ 318.740972][ T7460] ? netlink_getsockopt+0x550/0x550 [ 318.746424][ T7460] ? apparmor_socket_sendmsg+0x8a/0x330 [ 318.752079][ T7460] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 318.758395][ T7460] ? security_socket_sendmsg+0x7c/0xa0 [ 318.764328][ T7460] ? netlink_getsockopt+0x550/0x550 [ 318.772264][ T7460] ____sys_sendmsg+0x5ed/0x9a0 [ 318.777091][ T7460] ? __sys_sendmsg_sock+0x30/0x30 [ 318.782591][ T7460] ? __import_iovec+0x306/0x510 [ 318.790541][ T7460] ? import_iovec+0x6f/0xa0 [ 318.795684][ T7460] ___sys_sendmsg+0x2a2/0x360 [ 318.800380][ T7460] ? __sys_sendmsg+0x2a0/0x2a0 [ 318.805155][ T7460] __se_sys_sendmsg+0x1c3/0x2b0 [ 318.810006][ T7460] ? __x64_sys_sendmsg+0x80/0x80 [ 318.814943][ T7460] ? lockdep_hardirqs_on+0x94/0x140 [ 318.820248][ T7460] do_syscall_64+0x4c/0xa0 [ 318.825086][ T7460] ? clear_bhb_loop+0x60/0xb0 [ 318.829816][ T7460] ? clear_bhb_loop+0x60/0xb0 [ 318.834833][ T7460] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 318.842760][ T7460] RIP: 0033:0x7f8aa9d9e159 [ 318.847538][ T7460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.868237][ T7460] RSP: 002b:00007f8aaac91028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 318.877109][ T7460] RAX: ffffffffffffffda RBX: 00007f8aaa025fa0 RCX: 00007f8aa9d9e159 [ 318.885101][ T7460] RDX: 000000000000c860 RSI: 0000200000007dc0 RDI: 0000000000000004 [ 318.893511][ T7460] RBP: 00007f8aa9e3506b R08: 0000000000000000 R09: 0000000000000000 [ 318.903471][ T7460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 318.912250][ T7460] R13: 00007f8aaa026038 R14: 00007f8aaa025fa0 R15: 00007ffcd7785e88 [ 318.920511][ T7460] [ 319.179084][ T7463] loop1: detected capacity change from 0 to 32768 [ 319.200044][ T7463] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.806 (7463) [ 319.217808][ T7463] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 319.228276][ T7463] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 319.237798][ T7463] BTRFS info (device loop1): use zlib compression, level 3 [ 319.245098][ T7463] BTRFS info (device loop1): turning on sync discard [ 319.251925][ T7463] BTRFS info (device loop1): using free space tree [ 320.970011][ T7463] BTRFS info (device loop1): enabling ssd optimizations [ 320.985754][ T26] audit: type=1800 audit(1790341798.336:23): pid=7463 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.806" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 321.010432][ T7480] netlink: 8 bytes leftover after parsing attributes in process `syz.2.804'. [ 321.226575][ T4282] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 322.033030][ T7498] loop1: detected capacity change from 0 to 32768 [ 322.059758][ T7498] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.808 (7498) [ 322.078107][ T7498] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 322.088345][ T7498] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 322.097084][ T7498] BTRFS info (device loop1): use zlib compression, level 3 [ 322.104368][ T7498] BTRFS info (device loop1): turning on sync discard [ 322.111141][ T7498] BTRFS info (device loop1): using free space tree [ 322.119949][ T4287] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 322.593440][ T7516] capability: warning: `syz.2.811' uses deprecated v2 capabilities in a way that may be insecure [ 322.743819][ T4287] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 322.759285][ T7498] BTRFS info (device loop1): enabling ssd optimizations [ 322.792043][ T4287] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 322.916003][ T4287] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 322.948666][ T4287] usb 4-1: config 0 interface 0 has no altsetting 0 [ 323.029476][ T4287] usb 4-1: New USB device found, idVendor=1b96, idProduct=0011, bcdDevice= 0.00 [ 323.067710][ T4287] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.107212][ T4287] usb 4-1: config 0 descriptor?? [ 323.246974][ T7527] nvme_fabrics: unknown parameter or missing value 'nqn=' in ctrl creation request [ 323.487268][ T26] audit: type=1800 audit(1790341800.826:24): pid=7529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.808" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 323.839595][ T4282] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 323.860100][ T4287] input: HID 1b96:0011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:1B96:0011.0001/input/input5 [ 325.066671][ T7543] binder: BINDER_SET_CONTEXT_MGR already set [ 325.093988][ T4287] ntrig 0003:1B96:0011.0001: input,hidraw0: USB HID v0.04 Joystick [HID 1b96:0011] on usb-dummy_hcd.3-1/input0 [ 325.114208][ T7543] binder: 7542:7543 ioctl 4018620d 200000004a80 returned -16 [ 325.247187][ T7546] loop2: detected capacity change from 0 to 32768 [ 325.267066][ T7546] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.818 (7546) [ 325.356618][ T4287] usb 4-1: USB disconnect, device number 4 [ 325.424123][ T7546] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 325.434948][ T7546] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 325.444679][ T7546] BTRFS info (device loop2): use zlib compression, level 3 [ 325.451925][ T7546] BTRFS info (device loop2): turning on sync discard [ 325.458606][ T7546] BTRFS info (device loop2): using free space tree [ 325.608967][ T7544] fido_id[7544]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 325.639026][ T7567] binder: 7562:7567 ioctl c0306201 0 returned -14 [ 325.658352][ T7546] BTRFS info (device loop2): enabling ssd optimizations [ 325.686033][ T26] audit: type=1800 audit(1790341803.036:25): pid=7546 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.818" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 327.194268][ T4279] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 329.238168][ T7582] loop1: detected capacity change from 0 to 512 [ 329.301259][ T7582] EXT4-fs: Ignoring removed nomblk_io_submit option [ 329.494345][ T7586] loop3: detected capacity change from 0 to 32768 [ 329.527913][ T7586] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.827 (7586) [ 329.542994][ T7582] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 329.587001][ T7582] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 329.708374][ T7582] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3861: comm syz.1.826: Allocating blocks 41-42 which overlap fs metadata [ 329.862801][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 330.015151][ T7582] Quota error (device loop1): write_blk: dquota write failed [ 330.075208][ T7582] Quota error (device loop1): find_free_dqentry: Can't write quota data block 5 [ 330.101560][ T7586] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 330.111767][ T7586] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 330.120422][ T7586] BTRFS info (device loop3): use zlib compression, level 3 [ 330.127617][ T7586] BTRFS info (device loop3): turning on sync discard [ 330.134314][ T7586] BTRFS info (device loop3): using free space tree [ 330.197107][ T7582] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3861: comm syz.1.826: Allocating blocks 41-42 which overlap fs metadata [ 330.276970][ T7586] BTRFS info (device loop3): enabling ssd optimizations [ 330.387052][ T26] audit: type=1800 audit(1790341807.736:26): pid=7586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.827" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 330.454054][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 330.749108][ T7582] Quota error (device loop1): write_blk: dquota write failed [ 330.792425][ T4272] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 330.834523][ T7582] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 330.932655][ T7617] kAFS: bad VL server IP address [ 330.975771][ T7582] EXT4-fs error (device loop1): ext4_acquire_dquot:6841: comm syz.1.826: Failed to acquire dquot type 1 [ 331.095286][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 331.143076][ T7582] EXT4-fs error (device loop1): mb_free_blocks:1839: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 331.508686][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 331.542396][ T7582] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #12: comm syz.1.826: corrupted inode contents [ 331.622401][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 331.657914][ T7582] EXT4-fs error (device loop1): ext4_dirty_inode:6166: inode #12: comm syz.1.826: mark_inode_dirty error [ 331.745742][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 331.887055][ T7627] loop3: detected capacity change from 0 to 32768 [ 331.899798][ T7627] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.831 (7627) [ 331.925132][ T7582] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #12: comm syz.1.826: corrupted inode contents [ 331.939615][ T7627] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 331.949914][ T7627] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 331.958512][ T7627] BTRFS info (device loop3): use zlib compression, level 3 [ 331.965723][ T7627] BTRFS info (device loop3): turning on sync discard [ 331.972399][ T7627] BTRFS info (device loop3): using free space tree [ 332.089613][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 332.100450][ T5144] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 333.345043][ T7627] BTRFS info (device loop3): enabling ssd optimizations [ 333.374178][ T7582] EXT4-fs error (device loop1): __ext4_ext_dirty:202: inode #12: comm syz.1.826: mark_inode_dirty error [ 333.434056][ T26] audit: type=1800 audit(1790341810.786:27): pid=7627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.831" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 333.519136][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 333.550436][ T5144] usb 5-1: Using ep0 maxpacket: 8 [ 333.589493][ T5144] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 333.610927][ T7582] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #12: comm syz.1.826: corrupted inode contents [ 333.671542][ T5144] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 333.700834][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 334.887793][ T5144] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 334.899915][ T7582] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 334.949410][ T5144] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 334.969455][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 335.158706][ T7582] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #12: comm syz.1.826: corrupted inode contents [ 335.353320][ T5144] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 335.473384][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 335.484778][ T5144] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 335.608603][ T7582] EXT4-fs error (device loop1): ext4_truncate:4325: inode #12: comm syz.1.826: mark_inode_dirty error [ 335.632318][ T5144] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 335.650319][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 335.664218][ T5144] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.674583][ T7582] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 335.723787][ T5144] usb 5-1: can't set config #16, error -71 [ 335.736975][ T7582] EXT4-fs (loop1): Remounting filesystem read-only [ 335.758712][ T5144] usb 5-1: USB disconnect, device number 9 [ 335.772836][ T7582] EXT4-fs (loop1): 1 truncate cleaned up [ 335.813535][ T7582] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 335.837418][ T4272] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 337.802715][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 338.611055][ T7678] binder: 7677:7678 ioctl 4018620d 0 returned -22 [ 342.776431][ T7710] loop1: detected capacity change from 0 to 32768 [ 342.789009][ T7710] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.855 (7710) [ 342.802951][ T7710] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 342.813169][ T7710] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 342.821804][ T7710] BTRFS info (device loop1): use zlib compression, level 3 [ 342.828999][ T7710] BTRFS info (device loop1): turning on sync discard [ 342.839976][ T7710] BTRFS info (device loop1): using free space tree [ 344.009954][ T7710] BTRFS info (device loop1): enabling ssd optimizations [ 344.110839][ T26] audit: type=1800 audit(1790341821.456:28): pid=7710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.855" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 344.396519][ T4282] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 349.050993][ T7761] md: array md0 already initialised! [ 349.061550][ T7761] md: personality for level is not loaded! [ 349.625935][ T7767] loop3: detected capacity change from 0 to 512 [ 349.712188][ T7767] EXT4-fs: Ignoring removed orlov option [ 349.785330][ T7767] EXT4-fs: Ignoring removed mblk_io_submit option [ 350.898503][ T7767] EXT4-fs (loop3): orphan cleanup on readonly fs [ 352.299298][ T7767] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -13 [ 352.372664][ T7767] EXT4-fs error (device loop3): ext4_clear_blocks:883: inode #13: comm syz.3.857: attempt to clear invalid blocks 2 len 1 [ 352.482120][ T7767] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 352.609067][ T7786] md: personality for level is not loaded! [ 352.635904][ T7767] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.857: invalid indirect mapped block 1819239214 (level 0) [ 352.698259][ T7767] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.857: invalid indirect mapped block 1819239214 (level 1) [ 352.934952][ T7767] EXT4-fs (loop3): 1 truncate cleaned up [ 352.957043][ T7767] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 353.023336][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 353.752358][ T7806] md: array md0 already has disks! [ 353.757710][ T7806] md: could not open device unknown-block(1,0). [ 353.764098][ T7806] md: error, md_import_device() returned -16 [ 353.770883][ T7806] md: personality for level is not loaded! [ 355.599919][ T7816] netlink: 68 bytes leftover after parsing attributes in process `syz.3.883'. [ 357.047992][ T7822] md: personality for level is not loaded! [ 357.068797][ T7824] FAULT_INJECTION: forcing a failure. [ 357.068797][ T7824] name failslab, interval 1, probability 0, space 0, times 0 [ 357.109079][ T7825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.885'. [ 357.179665][ T7824] CPU: 0 PID: 7824 Comm: syz.2.887 Not tainted syzkaller #0 [ 357.186969][ T7824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 357.197031][ T7824] Call Trace: [ 357.200294][ T7824] [ 357.203298][ T7824] dump_stack_lvl+0x188/0x24e [ 357.207962][ T7824] ? show_regs_print_info+0x12/0x12 [ 357.213154][ T7824] ? load_image+0x410/0x410 [ 357.217659][ T7824] ? __might_sleep+0xd0/0xd0 [ 357.222231][ T7824] ? __lock_acquire+0x7c40/0x7c40 [ 357.227277][ T7824] should_fail_ex+0x390/0x4c0 [ 357.231943][ T7824] should_failslab+0x5/0x20 [ 357.236428][ T7824] slab_pre_alloc_hook+0x59/0x300 [ 357.241434][ T7824] kmem_cache_alloc_lru+0x49/0x2e0 [ 357.246527][ T7824] ? __d_alloc+0x2e/0x6e0 [ 357.250838][ T7824] __d_alloc+0x2e/0x6e0 [ 357.254971][ T7824] ? d_alloc_pseudo+0xe/0x70 [ 357.259538][ T7824] d_alloc_pseudo+0x19/0x70 [ 357.264021][ T7824] alloc_file_pseudo+0xe0/0x200 [ 357.268875][ T7824] ? alloc_empty_file_noaccount+0x80/0x80 [ 357.274603][ T7824] ? alloc_fd+0x590/0x640 [ 357.278922][ T7824] sock_alloc_file+0xb3/0x240 [ 357.283594][ T7824] __sys_socket+0x12d/0x190 [ 357.288092][ T7824] __x64_sys_socket+0x76/0x80 [ 357.292764][ T7824] do_syscall_64+0x4c/0xa0 [ 357.297183][ T7824] ? clear_bhb_loop+0x60/0xb0 [ 357.301849][ T7824] ? clear_bhb_loop+0x60/0xb0 [ 357.306528][ T7824] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 357.312419][ T7824] RIP: 0033:0x7f542c59e159 [ 357.316827][ T7824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 357.336433][ T7824] RSP: 002b:00007f542d48f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 357.344843][ T7824] RAX: ffffffffffffffda RBX: 00007f542c825fa0 RCX: 00007f542c59e159 [ 357.352797][ T7824] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 357.360766][ T7824] RBP: 00007f542c63506b R08: 0000000000000000 R09: 0000000000000000 [ 357.368716][ T7824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 357.376665][ T7824] R13: 00007f542c826038 R14: 00007f542c825fa0 R15: 00007ffe9f1c5638 [ 357.384628][ T7824] [ 359.772210][ T7843] md: array md0 already has disks! [ 359.777602][ T7843] md: could not open device unknown-block(1,0). [ 359.783933][ T7843] md: error, md_import_device() returned -16 [ 360.050874][ T7843] md: could not open device unknown-block(0,0). [ 360.057823][ T7843] md: error, md_import_device() returned -6 [ 360.064479][ T7845] md: personality for level is not loaded! [ 360.293306][ T7856] md: personality for level is not loaded! [ 360.311175][ T5138] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 360.500608][ T5138] usb 2-1: Using ep0 maxpacket: 16 [ 360.514368][ T5138] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 360.556250][ T5138] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 360.616844][ T5138] usb 2-1: config 0 interface 0 has no altsetting 0 [ 360.640363][ T5138] usb 2-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 360.772069][ T5138] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.807371][ T5138] usb 2-1: config 0 descriptor?? [ 362.215742][ T5138] usbhid 2-1:0.0: can't add hid device: -71 [ 362.240376][ T5138] usbhid: probe of 2-1:0.0 failed with error -71 [ 362.573470][ T5138] usb 2-1: USB disconnect, device number 7 [ 362.636208][ T7880] binder: BINDER_SET_CONTEXT_MGR already set [ 362.658944][ T7880] binder: 7879:7880 ioctl 4018620d 200000000100 returned -16 [ 364.642351][ T6510] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 364.931033][ T6510] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 366.164020][ T6510] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 366.243200][ T6510] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 366.334038][ T6510] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 366.390663][ T6510] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.435303][ T6510] usb 5-1: Product: syz [ 366.449667][ T6510] usb 5-1: Manufacturer: syz [ 366.470404][ T6510] usb 5-1: SerialNumber: syz [ 366.518186][ T7920] netlink: 8 bytes leftover after parsing attributes in process `syz.3.915'. [ 368.184778][ T6510] usb 5-1: USB disconnect, device number 10 [ 368.184810][ C0] usb 5-1: comm data receiver aborted. [ 368.725382][ T7937] comedi comedi1: Minor 0 could not be opened [ 369.208821][ T7945] loop1: detected capacity change from 0 to 32768 [ 369.282934][ T7945] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop1 scanned by syz.1.925 (7945) [ 369.296643][ T7945] BTRFS info (device loop1): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 369.307218][ T7945] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 369.315985][ T7945] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 369.325393][ T7945] BTRFS info (device loop1): use zstd compression, level 3 [ 369.332622][ T7945] BTRFS info (device loop1): force clearing of disk cache [ 369.339740][ T7945] BTRFS info (device loop1): enabling disk space caching [ 369.346803][ T7945] BTRFS info (device loop1): disk space caching is enabled [ 370.606062][ T7945] BTRFS info (device loop1): enabling ssd optimizations [ 371.861006][ T7945] BTRFS info (device loop1): rebuilding free space tree [ 371.935729][ T7945] BTRFS info (device loop1): disabling free space tree [ 371.942992][ T7945] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 371.953019][ T7945] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 372.048026][ T7973] ip_tables: iptables: counters copy to user failed while replacing table [ 372.299211][ T4282] BTRFS info (device loop1): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 373.953139][ T7996] netlink: 8 bytes leftover after parsing attributes in process `syz.1.932'. [ 374.276913][ T7998] loop3: detected capacity change from 0 to 128 [ 374.287084][ T7999] comedi comedi1: Minor 0 could not be opened [ 374.340821][ T6509] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 374.354711][ T7998] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 374.365411][ T7998] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 374.631334][ T6509] usb 3-1: not running at top speed; connect to a high speed hub [ 374.653400][ T6509] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 374.686690][ T6509] usb 3-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 374.748353][ T6509] usb 3-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 374.847209][ T6509] usb 3-1: Product: syz [ 374.868909][ T6509] usb 3-1: Manufacturer: syz [ 375.082592][ T8005] loop1: detected capacity change from 0 to 32768 [ 376.028979][ T8005] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.940 (8005) [ 376.082077][ T6509] uvcvideo 3-1:1.1: Unknown video format 32595559-0000-0010-8000-00aa00050000 [ 376.189544][ T6509] usb 3-1: Found UVC 1.00 device syz (225a:e1d4) [ 376.243519][ T6509] uvcvideo 3-1:1.1: No supported video formats found. [ 376.262781][ T6509] uvcvideo 3-1:1.1: Failed to initialize the device (-22). [ 376.335113][ T6509] usb 3-1: USB disconnect, device number 16 [ 376.377313][ T8005] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 376.387674][ T8005] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 376.396335][ T8005] BTRFS info (device loop1): use zlib compression, level 3 [ 376.403552][ T8005] BTRFS info (device loop1): turning on sync discard [ 376.410257][ T8005] BTRFS info (device loop1): using free space tree [ 376.484633][ T8016] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 376.545659][ T8023] xt_hashlimit: size too large, truncated to 1048576 [ 376.573511][ T8016] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 376.638956][ T8005] BTRFS info (device loop1): enabling ssd optimizations [ 376.648007][ T8036] vivid-003: disconnect [ 376.682147][ T8029] vivid-003: reconnect [ 376.698676][ T8016] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 376.868905][ T8016] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 376.985626][ T26] audit: type=1800 audit(1790341854.336:29): pid=8039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.940" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 378.671552][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.680633][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.969083][ T8063] netlink: 8 bytes leftover after parsing attributes in process `syz.4.950'. [ 379.130124][ T8064] comedi comedi1: Minor 0 could not be opened [ 380.642652][ T4282] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 380.662023][ T8074] netlink: 40 bytes leftover after parsing attributes in process `syz.4.955'. [ 380.700868][ T8074] netlink: 40 bytes leftover after parsing attributes in process `syz.4.955'. [ 381.377931][ T8082] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 382.485475][ T8085] random: crng reseeded on system resumption [ 383.006484][ T8082] loop2: detected capacity change from 0 to 128 [ 383.383603][ T8096] 9pnet_fd: Insufficient options for proto=fd [ 384.775273][ T8107] netlink: 8 bytes leftover after parsing attributes in process `syz.4.965'. [ 384.786506][ T8108] comedi comedi1: Minor 0 could not be opened [ 385.290586][ T8110] loop2: detected capacity change from 0 to 32768 [ 385.303635][ T8110] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.966 (8110) [ 385.317740][ T8110] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 385.328086][ T8110] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 385.336768][ T8110] BTRFS info (device loop2): use zlib compression, level 3 [ 385.344029][ T8110] BTRFS info (device loop2): turning on sync discard [ 385.351489][ T8110] BTRFS info (device loop2): using free space tree [ 385.545637][ T8110] BTRFS info (device loop2): enabling ssd optimizations [ 386.591939][ T26] audit: type=1800 audit(1790341863.336:30): pid=8131 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.966" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 386.727027][ T4279] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 386.746878][ T8134] netlink: 56 bytes leftover after parsing attributes in process `syz.4.968'. [ 388.066557][ T8151] loop1: detected capacity change from 0 to 1024 [ 388.302433][ T8151] hfsplus: request for non-existent node 33423360 in B*Tree [ 389.423954][ T8151] hfsplus: request for non-existent node 33423360 in B*Tree [ 389.469281][ T8160] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 389.518017][ T8159] hfsplus: request for non-existent node 33423360 in B*Tree [ 389.658451][ T8159] hfsplus: request for non-existent node 33423360 in B*Tree [ 390.597731][ T8164] random: crng reseeded on system resumption [ 391.231229][ T8160] loop3: detected capacity change from 0 to 128 [ 391.489418][ T8169] netlink: 8 bytes leftover after parsing attributes in process `syz.4.978'. [ 391.739332][ T8173] loop1: detected capacity change from 0 to 32768 [ 391.757171][ T8173] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.979 (8173) [ 391.823363][ T8173] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 391.833678][ T8173] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 391.842368][ T8173] BTRFS info (device loop1): use zlib compression, level 3 [ 391.849587][ T8173] BTRFS info (device loop1): turning on sync discard [ 391.856336][ T8173] BTRFS info (device loop1): using free space tree [ 391.974075][ T8173] BTRFS info (device loop1): enabling ssd optimizations [ 392.957981][ T26] audit: type=1800 audit(1790341869.736:31): pid=8192 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.979" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 393.094553][ T4282] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 393.281183][ T5770] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 10 /dev/loop1 scanned by udevd (5770) [ 394.004462][ T8204] netlink: 32 bytes leftover after parsing attributes in process `syz.2.983'. [ 394.338158][ T8196] loop4: detected capacity change from 0 to 32768 [ 394.397691][ T8196] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 scanned by syz.4.982 (8196) [ 394.535906][ T8196] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 394.606736][ T8210] futex_wake_op: syz.2.986 tries to shift op by 144; fix this program [ 394.623888][ T8196] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 395.779427][ T8196] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 397.049417][ T8196] BTRFS info (device loop4): use zstd compression, level 3 [ 397.113386][ T8196] BTRFS info (device loop4): using free space tree [ 397.311097][ T8225] 9pnet_fd: Insufficient options for proto=fd [ 397.332940][ T8196] BTRFS error (device loop4): open_ctree failed: -12 [ 397.800352][ T8246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.992'. [ 399.510693][ T8252] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 400.904452][ T8252] random: crng reseeded on system resumption [ 401.045539][ T8252] loop3: detected capacity change from 0 to 128 [ 401.824250][ T8270] futex_wake_op: syz.1.1000 tries to shift op by 144; fix this program [ 406.665336][ T8315] futex_wake_op: syz.2.1016 tries to shift op by 144; fix this program [ 406.717884][ T8318] Bluetooth: MGMT ver 1.22 [ 409.430646][ T8329] random: crng reseeded on system resumption [ 409.809950][ T4277] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 409.817562][ T4277] Bluetooth: hci2: command 0x0401 tx timeout [ 409.933862][ T8342] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 409.945167][ T8341] 9pnet_fd: Insufficient options for proto=fd [ 410.169882][ T130] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 411.087995][ T8345] random: crng reseeded on system resumption [ 411.693357][ T130] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 411.822441][ T130] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.959779][ T130] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 411.991881][ T130] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 412.018557][ T130] usb 3-1: Manufacturer: syz [ 412.047336][ T130] usb 3-1: config 0 descriptor?? [ 412.231947][ T130] rc_core: IR keymap rc-hauppauge not found [ 412.253708][ T130] Registered IR keymap rc-empty [ 412.283367][ T8358] futex_wake_op: syz.4.1031 tries to shift op by 144; fix this program [ 412.297493][ T130] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 413.480105][ T130] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input6 [ 413.656146][ T130] usb 3-1: USB disconnect, device number 17 [ 415.059376][ T8369] random: crng reseeded on system resumption [ 416.944588][ T8394] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 417.978269][ T8397] random: crng reseeded on system resumption [ 420.385737][ T8421] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.1050'. [ 420.619892][ T130] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 421.709868][ T4277] Bluetooth: hci1: command 0x0406 tx timeout [ 423.050782][ T130] usb 5-1: not running at top speed; connect to a high speed hub [ 423.068832][ T130] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 423.113593][ T130] usb 5-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 423.148795][ T130] usb 5-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 423.182065][ T130] usb 5-1: Product: syz [ 423.190590][ T130] usb 5-1: Manufacturer: syz [ 423.270723][ T130] usb 5-1: Found UVC 1.00 device syz (225a:e1d4) [ 423.291388][ T8440] kAFS: bad VL server IP address [ 423.302064][ T130] usb 5-1: No streaming interface found for terminal 2. [ 423.384505][ T130] usb 5-1: USB disconnect, device number 11 [ 423.580524][ T6509] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 423.719716][ T8451] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 424.011185][ T6509] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 425.121392][ T8451] random: crng reseeded on system resumption [ 425.219477][ T6509] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 425.268168][ T6509] usb 1-1: Product: syz [ 425.281510][ T6509] usb 1-1: SerialNumber: syz [ 425.321268][ T6509] usb 1-1: config 0 descriptor?? [ 425.450885][ T8459] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.1063'. [ 425.533041][ T6509] hso 1-1:0.0: Failed to find BULK IN ep [ 425.746165][ T130] usb 1-1: USB disconnect, device number 11 [ 427.333743][ T8482] kAFS: bad VL server IP address [ 427.449963][ T6509] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 427.457937][ T8488] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 427.650877][ T6509] usb 4-1: not running at top speed; connect to a high speed hub [ 428.488708][ T8492] random: crng reseeded on system resumption [ 428.894628][ T6509] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.973067][ T6509] usb 4-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 429.012015][ T6509] usb 4-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 429.053138][ T6509] usb 4-1: Product: syz [ 429.065972][ T6509] usb 4-1: Manufacturer: syz [ 429.098452][ T6509] usb 4-1: Found UVC 1.00 device syz (225a:e1d4) [ 429.130395][ T6509] usb 4-1: No streaming interface found for terminal 2. [ 429.312860][ T6509] usb 4-1: USB disconnect, device number 5 [ 430.412027][ T8505] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.1078'. [ 430.699853][ T130] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 430.767224][ T8515] binder: 8514:8515 ioctl c0306201 0 returned -14 [ 430.782032][ T8517] kAFS: bad VL server IP address [ 430.831836][ T6509] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 431.429346][ T130] usb 5-1: Using ep0 maxpacket: 32 [ 431.606738][ T130] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 431.616662][ T6509] usb 2-1: Using ep0 maxpacket: 32 [ 431.632091][ T6509] usb 2-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 431.664360][ T130] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 431.682237][ T6509] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.793807][ T130] usb 5-1: config 0 interface 0 has no altsetting 0 [ 431.808476][ T6509] usb 2-1: config 0 descriptor?? [ 431.835543][ T130] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 431.853763][ T6509] gspca_main: sunplus-2.14.0 probing 041e:400b [ 433.305426][ T130] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.361678][ T130] usb 5-1: Product: syz [ 433.386170][ T130] usb 5-1: Manufacturer: syz [ 433.410497][ T130] usb 5-1: SerialNumber: syz [ 433.436948][ T8532] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 433.457957][ T130] usb 5-1: config 0 descriptor?? [ 433.494247][ T130] usb 5-1: can't set config #0, error -71 [ 433.502243][ T6509] gspca_sunplus: reg_r err -71 [ 433.507056][ T6509] sunplus: probe of 2-1:0.0 failed with error -71 [ 434.541453][ T8534] random: crng reseeded on system resumption [ 434.881369][ T130] usb 5-1: USB disconnect, device number 12 [ 434.903563][ T6509] usb 2-1: USB disconnect, device number 8 [ 435.194196][ T8543] binder: 8542:8543 ioctl c0306201 0 returned -14 [ 435.410980][ T8553] kAFS: bad VL server IP address [ 436.880472][ T6509] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 436.935305][ T5142] nvmet: connect request for invalid subsystem testsubsys! [ 436.966433][ T8558] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 437.175488][ T6509] usb 3-1: not running at top speed; connect to a high speed hub [ 438.542752][ T6509] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 438.593480][ T6509] usb 3-1: can't read configurations, error -71 [ 438.701559][ T5142] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 438.773093][ T8580] binder: 8579:8580 ioctl c0306201 0 returned -14 [ 438.919975][ T5142] usb 5-1: Using ep0 maxpacket: 32 [ 440.111188][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.117507][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.273164][ T5142] usb 5-1: device descriptor read/all, error -71 [ 440.315452][ T8585] random: crng reseeded on system resumption [ 443.581120][ T8611] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1115'. [ 446.620348][ T8626] binder: 8624:8626 ioctl c0306201 0 returned -14 [ 446.879919][ T130] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 447.089903][ T130] usb 3-1: Using ep0 maxpacket: 32 [ 447.740057][ T8637] random: crng reseeded on system resumption [ 448.363297][ T130] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 448.411940][ T130] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 448.469403][ T130] usb 3-1: config 0 interface 0 has no altsetting 0 [ 448.618169][ T130] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 449.052422][ T8641] jffs2: notice: (8641) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 449.693032][ T8641] jffs2: fork failed for JFFS2 garbage collect thread: 4 [ 449.800152][ T130] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.808169][ T130] usb 3-1: Product: syz [ 449.876438][ T130] usb 3-1: Manufacturer: syz [ 449.898456][ T130] usb 3-1: SerialNumber: syz [ 449.923925][ T130] usb 3-1: config 0 descriptor?? [ 449.975401][ T130] usb 3-1: can't set config #0, error -71 [ 450.020340][ T130] usb 3-1: USB disconnect, device number 20 [ 455.247780][ T8676] binder: 8674:8676 ioctl c0306201 0 returned -14 [ 456.608060][ T8678] random: crng reseeded on system resumption [ 457.310017][ T6509] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 457.510307][ T6509] usb 5-1: Using ep0 maxpacket: 32 [ 457.523919][ T6509] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 457.567903][ T6509] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 459.294061][ T6509] usb 5-1: config 0 interface 0 has no altsetting 0 [ 459.331429][ T6509] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 459.372512][ T6509] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.390777][ T8711] block nbd1: shutting down sockets [ 459.410589][ T6509] usb 5-1: Product: syz [ 459.475465][ T6509] usb 5-1: Manufacturer: syz [ 459.492773][ T6509] usb 5-1: SerialNumber: syz [ 459.513679][ T6509] usb 5-1: config 0 descriptor?? [ 459.670701][ T8715] futex_wake_op: syz.1.1148 tries to shift op by 144; fix this program [ 460.710009][ T6509] gs_usb 5-1:0.0: Couldn't send data format (err=-110) [ 460.750082][ T6509] gs_usb: probe of 5-1:0.0 failed with error -110 [ 460.788133][ T6509] usb 5-1: USB disconnect, device number 15 [ 463.439992][ T8725] random: crng reseeded on system resumption [ 463.492651][ T8730] binder: 8729:8730 ioctl c0306201 0 returned -14 [ 468.719868][ T130] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 470.090121][ T130] usb 5-1: Using ep0 maxpacket: 32 [ 471.328532][ T130] usb 5-1: device descriptor read/all, error -71 [ 472.775420][ T8774] random: crng reseeded on system resumption [ 473.261689][ T8781] binder: 8780:8781 ioctl c0306201 0 returned -14 [ 476.377372][ T6509] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 476.385500][ T130] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 476.722926][ T130] usb 4-1: config index 0 descriptor too short (expected 56, got 39) [ 476.782227][ T6509] usb 2-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 476.801469][ T130] usb 4-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 476.815826][ T6509] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.836441][ T130] usb 4-1: config 9 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 476.857503][ T6509] gspca_main: sunplus-2.14.0 probing 046d:0960 [ 476.875083][ T130] usb 4-1: config 9 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 476.899899][ T130] usb 4-1: config 9 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 476.938409][ T130] usb 4-1: New USB device found, idVendor=0bda, idProduct=8152, bcdDevice=30.11 [ 476.966188][ T130] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.994053][ T130] usb 4-1: Product: syz [ 477.007264][ T130] usb 4-1: Manufacturer: syz [ 477.022208][ T130] usb 4-1: SerialNumber: syz [ 477.058520][ T6509] gspca_sunplus: reg_w_riv err -71 [ 477.066185][ T130] r8152 4-1:9.0: Expected endpoints are not found [ 477.085327][ T6509] sunplus: probe of 2-1:8.0 failed with error -71 [ 477.183300][ T6509] usb 2-1: USB disconnect, device number 9 [ 477.258230][ T130] r8152-cfgselector 4-1: Unknown version 0x0000 [ 477.282237][ T130] r8152-cfgselector 4-1: USB disconnect, device number 6 [ 477.499858][ T6508] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 477.627097][ T8821] (unnamed net_device) (uninitialized): option lacp_rate: invalid value (20) [ 477.841803][ T6508] usb 5-1: Using ep0 maxpacket: 32 [ 477.944653][ T6508] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 477.974341][ T6508] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 478.934300][ T8829] binder: 8826:8829 ioctl c0306201 0 returned -14 [ 478.942451][ T6508] usb 5-1: config 0 interface 0 has no altsetting 0 [ 478.962893][ T6508] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 479.099844][ T130] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 479.872604][ T6508] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.254363][ T8831] random: crng reseeded on system resumption [ 480.399282][ T6508] usb 5-1: Product: syz [ 480.426696][ T6508] usb 5-1: Manufacturer: syz [ 480.464376][ T6508] usb 5-1: SerialNumber: syz [ 480.493446][ T6508] usb 5-1: config 0 descriptor?? [ 480.613948][ T6508] usb 5-1: can't set config #0, error -71 [ 480.629913][ T130] usb 2-1: Using ep0 maxpacket: 16 [ 480.650344][ T130] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 480.841807][ T6508] usb 5-1: USB disconnect, device number 18 [ 480.903217][ T130] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 480.975997][ T130] usb 2-1: config 0 interface 0 has no altsetting 0 [ 481.006836][ T130] usb 2-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 481.058031][ T130] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.102437][ T8851] X25: received unknown 00 with LCI 000 [ 481.126671][ T130] usb 2-1: config 0 descriptor?? [ 481.157629][ T130] usb 2-1: can't set config #0, error -71 [ 481.201502][ T130] usb 2-1: USB disconnect, device number 10 [ 481.510763][ T8856] misc userio: Invalid payload size [ 483.079125][ T8856] overlayfs: unrecognized mount option "verity=require" or missing value [ 487.482582][ T8895] random: crng reseeded on system resumption [ 489.210424][ T8905] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1200'. [ 490.480831][ T8919] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 490.578934][ T6508] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 492.367823][ T8933] futex_wake_op: syz.4.1207 tries to shift op by 144; fix this program [ 493.798213][ T8951] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 493.939991][ T6508] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 495.151705][ T8957] random: crng reseeded on system resumption [ 495.380076][ T6508] usb 1-1: not running at top speed; connect to a high speed hub [ 496.636645][ T6508] usb 1-1: unable to read config index 0 descriptor/all [ 496.646250][ T8956] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1212'. [ 496.709978][ T6508] usb 1-1: can't read configurations, error -71 [ 497.254045][ T8665] tipc: Resetting bearer [ 497.330419][ T8665] tipc: Disabling bearer [ 499.024026][ T8981] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 499.038402][ T8981] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 499.047889][ T6508] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 499.072999][ T8981] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 499.085813][ T8981] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 499.093741][ T8981] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 499.102088][ T8981] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 499.218722][ T4726] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.359834][ T6508] usb 1-1: Using ep0 maxpacket: 16 [ 500.663765][ T8989] futex_wake_op: syz.4.1220 tries to shift op by 144; fix this program [ 500.681654][ T6508] usb 1-1: device descriptor read/all, error -71 [ 501.740029][ T8981] Bluetooth: hci2: command 0x0409 tx timeout [ 501.749870][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.756223][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.862877][ T4726] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.008696][ T8994] md: personality for level is not loaded! [ 502.028174][ T4726] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.159938][ T6508] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 502.188193][ T4726] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.359836][ T6508] usb 1-1: Using ep0 maxpacket: 16 [ 502.409929][ T5142] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 503.689960][ T6508] usb 1-1: config 1 has an invalid interface number: 105 but max is 0 [ 503.732238][ T6508] usb 1-1: config 1 has no interface number 0 [ 503.738459][ T6508] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 503.773202][ T9002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1225'. [ 503.789943][ T8981] Bluetooth: hci2: command 0x041b tx timeout [ 503.872682][ T6508] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 503.888214][ T8980] chnl_net:caif_netlink_parms(): no params data found [ 503.898362][ T5142] usb 2-1: not running at top speed; connect to a high speed hub [ 503.919722][ T5142] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 503.939436][ T6508] usb 1-1: config 1 interface 105 has no altsetting 0 [ 503.975314][ T6508] usb 1-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 504.001311][ T5142] usb 2-1: config 1 interface 1 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 504.028723][ T6508] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 504.055452][ T5142] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 504.092349][ T6508] usb 1-1: Product: syz [ 504.096554][ T6508] usb 1-1: Manufacturer: syz [ 504.119338][ T8980] bridge0: port 1(bridge_slave_0) entered blocking state [ 504.133566][ T6508] usb 1-1: SerialNumber: syz [ 504.138661][ T5142] usb 2-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 504.178261][ T8980] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.185707][ T8992] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 504.200377][ T5142] usb 2-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 504.216426][ T8992] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 504.240469][ T8980] device bridge_slave_0 entered promiscuous mode [ 504.246954][ T5142] usb 2-1: Product: syz [ 504.266963][ T5142] usb 2-1: Manufacturer: syz [ 504.282740][ T8980] bridge0: port 2(bridge_slave_1) entered blocking state [ 504.335340][ T5142] usb 2-1: Found UVC 1.00 device syz (225a:e1d4) [ 504.360472][ T8980] bridge0: port 2(bridge_slave_1) entered disabled state [ 504.389059][ T8980] device bridge_slave_1 entered promiscuous mode [ 504.531002][ T5142] usb 2-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 504.548539][ T8980] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 504.606019][ T5142] uvcvideo 2-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 504.625894][ T4726] tipc: Left network mode [ 504.636826][ T8980] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 504.657180][ T5142] uvcvideo 2-1:1.1: Failed to initialize the device (-5). [ 504.666380][ T8992] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 504.695204][ T8992] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 504.741913][ T5142] usb 2-1: USB disconnect, device number 11 [ 504.825245][ T9020] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 504.858130][ T8980] team0: Port device team_slave_0 added [ 505.514039][ T6508] aqc111 1-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 505.779432][ T9024] random: crng reseeded on system resumption [ 505.869890][ T8981] Bluetooth: hci2: command 0x040f tx timeout [ 506.468265][ T6508] aqc111 1-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 506.574072][ T6508] aqc111 1-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 506.740691][ T8980] team0: Port device team_slave_1 added [ 506.819888][ T6508] aqc111 1-1:1.105 eth5: register 'aqc111' at usb-dummy_hcd.0-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 76:38:42:80:96:e5 [ 506.895862][ T9040] futex_wake_op: syz.1.1231 tries to shift op by 144; fix this program [ 506.923846][ T6508] usb 1-1: USB disconnect, device number 16 [ 508.509880][ T8981] Bluetooth: hci2: command 0x0419 tx timeout [ 508.529604][ T6508] aqc111 1-1:1.105 eth5: unregister 'aqc111' usb-dummy_hcd.0-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 508.846348][ T9044] md: personality for level is not loaded! [ 508.994285][ T6508] aqc111 1-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 509.034240][ T6508] aqc111 1-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 509.093378][ T6508] aqc111 1-1:1.105 eth5 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 509.285307][ T8980] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.321390][ T8980] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 509.732803][ T8980] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 509.906344][ T8980] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 509.935215][ T8980] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 510.028289][ T8980] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 510.109852][ T6508] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 510.348520][ T6508] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 510.376098][ T6508] usb 5-1: can't read configurations, error -71 [ 510.408761][ T9060] device wg0 entered promiscuous mode [ 510.490759][ T9060] team0: Device wg0 is of different type [ 510.645919][ T8980] device hsr_slave_0 entered promiscuous mode [ 510.722937][ T8980] device hsr_slave_1 entered promiscuous mode [ 510.768583][ T8980] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 510.806062][ T8980] Cannot create hsr debugfs directory [ 511.136782][ T9087] vivid-003: disconnect [ 511.400188][ T9094] futex_wake_op: syz.3.1245 tries to shift op by 144; fix this program [ 512.448280][ T9080] vivid-003: reconnect [ 512.716594][ T9098] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 513.743741][ T9099] random: crng reseeded on system resumption [ 514.241875][ T9102] md: personality for level is not loaded! [ 515.183334][ T9122] vivid-007: ================= START STATUS ================= [ 515.218132][ T9122] vivid-007: Enable Output Cropping: true [ 515.274735][ T9122] vivid-007: Enable Output Composing: true [ 515.315814][ T9122] vivid-007: Enable Output Scaler: true [ 515.322312][ T6508] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 515.344655][ T9122] vivid-007: Tx RGB Quantization Range: Automatic [ 515.376921][ T9122] vivid-007: Transmit Mode: HDMI [ 516.173320][ T4726] device hsr_slave_0 left promiscuous mode [ 516.192256][ T9122] vivid-007: Display Present: true inactive [ 516.198451][ T9122] vivid-007: Hotplug Present: 0x00000001 [ 516.208563][ T4726] device hsr_slave_1 left promiscuous mode [ 516.229040][ T4726] device bridge_slave_1 left promiscuous mode [ 516.245609][ T9122] vivid-007: RxSense Present: 0x00000001 [ 516.258172][ T4726] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.280268][ T6508] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 516.287893][ T6508] usb 1-1: can't read configurations, error -71 [ 516.313207][ T9122] vivid-007: EDID Present: 0x00000001 [ 516.336124][ T9122] vivid-007: ================== END STATUS ================== [ 516.346070][ T4726] device bridge_slave_0 left promiscuous mode [ 516.374428][ T4726] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.496864][ T9130] overlayfs: unrecognized mount option "=00000" or missing value [ 516.506214][ T4726] device veth1_macvtap left promiscuous mode [ 516.532658][ T4726] device veth0_macvtap left promiscuous mode [ 516.569277][ T4726] device veth1_vlan left promiscuous mode [ 516.594585][ T4726] device veth0_vlan left promiscuous mode [ 518.090408][ T9140] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 519.537827][ T9140] random: crng reseeded on system resumption [ 520.580784][ T6508] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 520.782876][ T6508] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 520.863398][ T6508] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 520.892769][ T6508] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 520.938318][ T6508] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 520.969531][ T6508] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 521.011645][ T6508] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 521.059038][ T6508] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 521.093451][ T6508] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 521.128056][ T6508] usb 5-1: config 0 descriptor?? [ 521.151518][ T9156] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 521.457011][ T6508] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 21 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 521.543679][ T6508] usb 5-1: USB disconnect, device number 21 [ 521.579249][ T6508] usblp0: removed [ 522.109834][ T6508] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 523.393450][ T9177] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1276'. [ 523.442784][ T9180] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 523.625546][ T6508] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 524.869961][ T6508] usb 2-1: can't read configurations, error -71 [ 524.877783][ T9183] random: crng reseeded on system resumption [ 526.886190][ T4726] team0 (unregistering): Port device team_slave_1 removed [ 527.174043][ T4726] team0 (unregistering): Port device team_slave_0 removed [ 527.465356][ T4726] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 527.778787][ T4726] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 530.746766][ T9218] comedi comedi1: Minor 0 could not be opened [ 530.817911][ T9216] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1288'. [ 530.871331][ T9220] input: syz0 as /devices/virtual/input/input7 [ 530.999385][ T9224] autofs4:pid:9224:autofs_fill_super: called with bogus options [ 531.550873][ T9235] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 533.045685][ T9235] random: crng reseeded on system resumption [ 533.505792][ T9249] futex_wake_op: syz.0.1297 tries to shift op by 144; fix this program [ 537.166167][ T9259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1300'. [ 537.381478][ T9264] comedi comedi1: Minor 0 could not be opened [ 537.872194][ T4726] bond0 (unregistering): Released all slaves [ 538.703602][ T9276] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 540.290005][ T9276] random: crng reseeded on system resumption [ 540.356081][ T8980] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 540.504628][ T8980] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 540.534677][ T9293] futex_wake_op: syz.1.1309 tries to shift op by 144; fix this program [ 541.643006][ T8980] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 541.749472][ T8980] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 542.860318][ T8980] 8021q: adding VLAN 0 to HW filter on device bond0 [ 543.382602][ T9303] xt_TCPMSS: Only works on TCP SYN packets [ 543.506098][ T4839] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 543.531390][ T4839] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 543.573824][ T8980] 8021q: adding VLAN 0 to HW filter on device team0 [ 543.663669][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 543.709378][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 543.786758][ T4726] bridge0: port 1(bridge_slave_0) entered blocking state [ 543.793886][ T4726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 544.007626][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 544.038319][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 544.094041][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 544.138923][ T4726] bridge0: port 2(bridge_slave_1) entered blocking state [ 544.146066][ T4726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 544.223261][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 544.276230][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 544.322863][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 544.386273][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 544.435214][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 544.476504][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 544.517929][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 544.554273][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 544.607686][ T8980] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 544.664192][ T9320] comedi comedi1: Minor 0 could not be opened [ 544.765634][ T8980] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 544.963076][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 544.987476][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 545.040650][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 545.469874][ T8981] Bluetooth: hci2: command 0x0407 tx timeout [ 546.609157][ T9330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1313'. [ 548.562008][ T4299] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 548.602026][ T4299] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 548.661896][ T8980] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 551.026473][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 551.084211][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 551.182793][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 551.237606][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 551.291735][ T8980] device veth0_vlan entered promiscuous mode [ 551.322446][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 551.355221][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 551.409483][ T8980] device veth1_vlan entered promiscuous mode [ 551.514183][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 551.546585][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 551.603940][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 552.955729][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 553.004287][ T8980] device veth0_macvtap entered promiscuous mode [ 553.179346][ T9412] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1330'. [ 553.215723][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 553.344667][ T8980] device veth1_macvtap entered promiscuous mode [ 554.297534][ T8980] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 555.600398][ T8980] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 556.388294][ T8980] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 556.527903][ T8980] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 556.755393][ T8980] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 556.807657][ T8980] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 556.857170][ T8980] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 556.912064][ T8980] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 556.965969][ T8980] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 557.034819][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 557.166079][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 557.953124][ T130] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 558.000683][ T4277] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 558.010204][ T4278] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 558.017835][ T4278] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 558.025462][ T4277] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 558.033848][ T4277] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 558.041185][ T4278] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 558.280002][ T130] usb 4-1: Using ep0 maxpacket: 32 [ 559.632621][ T130] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 559.746190][ T130] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 559.817466][ T130] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 559.873196][ T130] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.892557][ T9464] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 559.900263][ T9464] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 559.942323][ T130] usb 4-1: config 0 descriptor?? [ 560.009479][ T130] hub 4-1:0.0: USB hub found [ 560.042791][ T9464] vhci_hcd vhci_hcd.0: Device attached [ 560.092697][ T9472] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 560.110065][ T4278] Bluetooth: hci5: command 0x0409 tx timeout [ 560.133375][ T9465] usbip_core: unknown command [ 560.154586][ T9465] vhci_hcd: unknown pdu 4095249048 [ 560.164884][ T9450] FAULT_INJECTION: forcing a failure. [ 560.164884][ T9450] name failslab, interval 1, probability 0, space 0, times 0 [ 560.240264][ T9465] usbip_core: unknown command [ 560.339859][ T5140] usb 33-1: new high-speed USB device number 2 using vhci_hcd [ 561.447217][ T9473] random: crng reseeded on system resumption [ 561.987683][ T4726] vhci_hcd: stop threads [ 562.041558][ T4726] vhci_hcd: release socket [ 562.099335][ T9450] CPU: 0 PID: 9450 Comm: syz.3.1339 Not tainted syzkaller #0 [ 562.106963][ T9450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 562.117125][ T9450] Call Trace: [ 562.120712][ T9450] [ 562.123674][ T9450] dump_stack_lvl+0x188/0x24e [ 562.128397][ T9450] ? show_regs_print_info+0x12/0x12 [ 562.133634][ T9450] ? load_image+0x410/0x410 [ 562.138250][ T9450] ? __might_sleep+0xd0/0xd0 [ 562.142860][ T9450] ? __lock_acquire+0x7c40/0x7c40 [ 562.147990][ T9450] ? mark_lock+0x94/0x320 [ 562.152363][ T9450] should_fail_ex+0x390/0x4c0 [ 562.159115][ T9450] should_failslab+0x5/0x20 [ 562.163647][ T9450] slab_pre_alloc_hook+0x59/0x300 [ 562.168722][ T9450] ? tcp_sendmsg_fastopen+0x1d5/0x600 [ 562.175344][ T9450] __kmem_cache_alloc_node+0x4f/0x270 [ 562.181905][ T9450] ? tcp_sendmsg_fastopen+0x1d5/0x600 [ 562.188315][ T9450] kmalloc_trace+0x26/0xe0 [ 562.192952][ T9450] tcp_sendmsg_fastopen+0x1d5/0x600 [ 562.199869][ T9450] tcp_sendmsg_locked+0x356b/0x39e0 [ 562.206335][ T9450] ? __might_sleep+0xd0/0xd0 [ 562.211552][ T9450] ? __might_sleep+0xd0/0xd0 [ 562.218848][ T9450] ? mark_lock+0x94/0x320 [ 562.224378][ T9450] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 562.232314][ T9450] ? lock_chain_count+0x20/0x20 [ 562.238353][ T9450] ? tcp_sendmsg+0x1d/0x40 [ 562.243615][ T9450] ? tcp_set_state+0x520/0x520 [ 562.248985][ T9450] tcp_sendmsg+0x2b/0x40 [ 562.253434][ T9450] __sys_sendto+0x497/0x650 [ 562.258064][ T9450] ? __ia32_sys_getpeername+0x80/0x80 [ 562.263771][ T9450] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 562.271821][ T9450] ? lock_chain_count+0x20/0x20 [ 562.279877][ T9450] __x64_sys_sendto+0xda/0xf0 [ 562.287278][ T9450] do_syscall_64+0x4c/0xa0 [ 562.293638][ T9450] ? clear_bhb_loop+0x60/0xb0 [ 562.301074][ T9450] ? clear_bhb_loop+0x60/0xb0 [ 562.307096][ T9450] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 562.313378][ T9450] RIP: 0033:0x7fc677f9e159 [ 562.317926][ T9450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.339816][ T9450] RSP: 002b:00007fc678f35028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 562.349140][ T9450] RAX: ffffffffffffffda RBX: 00007fc678225fa0 RCX: 00007fc677f9e159 [ 562.359127][ T9450] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 562.368014][ T9450] RBP: 00007fc67803506b R08: 00002000000001c0 R09: 000000000000001c [ 562.377116][ T9450] R10: 0000000024000010 R11: 0000000000000246 R12: 0000000000000000 [ 562.385286][ T9450] R13: 00007fc678226038 R14: 00007fc678225fa0 R15: 00007ffd96ecec38 [ 562.393357][ T9450] [ 562.401689][ T4278] Bluetooth: hci5: command 0x041b tx timeout [ 562.425730][ T4726] vhci_hcd: disconnect device [ 563.354766][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.369949][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.894713][ T9457] chnl_net:caif_netlink_parms(): no params data found [ 564.430224][ T4278] Bluetooth: hci5: command 0x040f tx timeout [ 565.230053][ T130] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 565.799573][ T9457] bridge0: port 1(bridge_slave_0) entered blocking state [ 565.836090][ T130] usbhid 4-1:0.0: can't add hid device: -32 [ 565.863356][ T9457] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.902253][ T130] usbhid: probe of 4-1:0.0 failed with error -32 [ 565.920197][ T9457] device bridge_slave_0 entered promiscuous mode [ 566.050548][ T9457] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.058124][ T9457] bridge0: port 2(bridge_slave_1) entered disabled state [ 566.100781][ T9457] device bridge_slave_1 entered promiscuous mode [ 566.249502][ T9457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 566.443210][ T9457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 566.510305][ T4278] Bluetooth: hci5: command 0x0419 tx timeout [ 566.740549][ T9496] comedi comedi1: Minor 0 could not be opened [ 566.782477][ T9511] futex_wake_op: syz.4.1344 tries to shift op by 144; fix this program [ 568.040113][ T5140] vhci_hcd: vhci_device speed not set [ 568.060164][ T9457] team0: Port device team_slave_0 added [ 568.265060][ T9457] team0: Port device team_slave_1 added [ 568.726034][ T9457] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 568.767980][ T9457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 569.190618][ T6509] usb 4-1: USB disconnect, device number 7 [ 569.282450][ T9457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 570.792269][ T9457] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 570.841383][ T9457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 570.986636][ T9457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 571.009845][ T6509] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 571.303742][ T6509] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.576209][ T6509] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 572.653317][ T6509] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 572.718953][ T6509] usb 1-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 573.420058][ T6509] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.499689][ T6509] usb 1-1: config 0 descriptor?? [ 573.547995][ T6509] usb 1-1: can't set config #0, error -71 [ 573.559373][ T6509] usb 1-1: USB disconnect, device number 19 [ 574.545495][ T9457] device hsr_slave_0 entered promiscuous mode [ 574.644601][ T9457] device hsr_slave_1 entered promiscuous mode [ 575.018244][ T9591] binder: BINDER_SET_CONTEXT_MGR already set [ 575.111456][ T9591] binder: 9590:9591 ioctl 4018620d 200000004a80 returned -16 [ 575.235336][ T4358] device hsr_slave_0 left promiscuous mode [ 575.293578][ T4358] device hsr_slave_1 left promiscuous mode [ 575.316779][ T4358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 575.352138][ T4358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 575.391205][ T4358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 575.429278][ T4358] device bridge_slave_1 left promiscuous mode [ 575.455637][ T4358] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.508315][ T4358] device bridge_slave_0 left promiscuous mode [ 575.532216][ T4358] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.655897][ T4358] device veth1_macvtap left promiscuous mode [ 575.688766][ T4358] device veth0_macvtap left promiscuous mode [ 575.719674][ T4358] device veth1_vlan left promiscuous mode [ 576.993216][ T4358] device veth0_vlan left promiscuous mode [ 582.192618][ T4358] team0 (unregistering): Port device team_slave_1 removed [ 582.727016][ T4358] team0 (unregistering): Port device team_slave_0 removed [ 582.916379][ T4358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 583.425320][ T4358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 586.532058][ T4358] bond0 (unregistering): Released all slaves [ 586.842902][ T9673] binder: BINDER_SET_CONTEXT_MGR already set [ 586.918358][ T9673] binder: 9672:9673 ioctl 4018620d 200000000100 returned -16 [ 586.975535][ T9675] binder: BINDER_SET_CONTEXT_MGR already set [ 586.993850][ T9677] jffs2: notice: (9677) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 587.054657][ T9675] binder: 9672:9675 ioctl 4018620d 200000004a80 returned -16 [ 589.738524][ T9457] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 589.807028][ T9457] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 589.865313][ T9457] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 589.905552][ T9457] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 589.923192][ T5142] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 590.042908][ T6509] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 590.106547][ T9457] 8021q: adding VLAN 0 to HW filter on device bond0 [ 590.130196][ T5142] usb 5-1: Using ep0 maxpacket: 16 [ 590.146504][ T5142] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 590.206347][ T9457] 8021q: adding VLAN 0 to HW filter on device team0 [ 590.214305][ T5142] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 590.248267][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 590.259621][ T6509] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 590.275745][ T5142] usb 5-1: config 0 interface 0 has no altsetting 0 [ 590.292837][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 590.300705][ T6509] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 590.315202][ T5142] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 590.339651][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 590.357577][ T5142] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.368441][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 590.382716][ T6509] usb 2-1: New USB device found, idVendor=0d49, idProduct=7000, bcdDevice= 0.01 [ 590.409918][ T5142] usb 5-1: config 0 descriptor?? [ 590.415419][ T4358] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.422557][ T4358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 590.434101][ T6509] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.459909][ T6509] usb 2-1: Product: syz [ 590.473804][ T6509] usb 2-1: Manufacturer: syz [ 590.496769][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 590.514315][ T6509] usb 2-1: SerialNumber: syz [ 590.532934][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 590.563300][ T6509] ums-onetouch 2-1:1.0: USB Mass Storage device detected [ 590.593401][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 590.638586][ T6509] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/input/input8 [ 590.658255][ T9701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 590.687834][ T4358] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.696642][ T4358] bridge0: port 2(bridge_slave_1) entered forwarding state [ 590.719427][ T6509] input input8: usb_submit_urb failed [ 590.739042][ T9701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 590.876946][ T6509] input: failed to attach handler kbd to device input8, error: -5 [ 590.896365][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 591.123412][ T3623] input input8: usb_submit_urb failed [ 591.140677][ T6509] scsi host1: usb-storage 2-1:1.0 [ 591.148480][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 591.197554][ T6509] usb 2-1: USB disconnect, device number 14 [ 591.215942][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 591.293653][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 591.350832][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 591.369599][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 591.415301][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 591.459420][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 591.473906][ T5142] usb 5-1: USB disconnect, device number 22 [ 591.634237][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 591.688610][ T9457] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 592.929334][ T9457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 593.190241][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 593.217699][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 593.410274][ T9737] binder: BINDER_SET_CONTEXT_MGR already set [ 593.459082][ T9737] binder: 9736:9737 ioctl 4018620d 200000000100 returned -16 [ 593.534139][ T9738] binder: BINDER_SET_CONTEXT_MGR already set [ 593.601308][ T9738] binder: 9736:9738 ioctl 4018620d 200000004a80 returned -16 [ 594.174748][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 594.207861][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 594.265655][ T9457] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 597.612974][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 597.789942][ T4278] Bluetooth: hci5: command 0x0405 tx timeout [ 598.349310][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 599.279611][ T9457] device veth0_vlan entered promiscuous mode [ 599.384575][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 599.406511][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 599.596313][ T9457] device veth1_vlan entered promiscuous mode [ 599.609349][ T9808] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 599.651751][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 599.683507][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 601.138239][ T9457] device veth0_macvtap entered promiscuous mode [ 601.244963][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 601.253627][ T9808] random: crng reseeded on system resumption [ 602.175261][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 602.256954][ T9457] device veth1_macvtap entered promiscuous mode [ 602.399126][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 602.640537][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 602.746941][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 602.827748][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 602.899280][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 602.989010][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 603.063833][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 603.191351][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 603.257726][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 604.688199][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 604.763416][ T9457] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 604.845476][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 604.899050][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 604.968852][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 605.020191][ T6509] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 605.059168][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.079837][ T9847] binder: BINDER_SET_CONTEXT_MGR already set [ 605.126690][ T9847] binder: 9845:9847 ioctl 4018620d 200000000100 returned -16 [ 605.137914][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 605.193740][ T9849] binder: BINDER_SET_CONTEXT_MGR already set [ 605.202421][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.246275][ T9847] binder: 9845:9847 ioctl c0306201 0 returned -14 [ 605.259772][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 605.296290][ T6509] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 605.325009][ T9849] binder: 9845:9849 ioctl 4018620d 200000004a80 returned -16 [ 605.386577][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.399409][ T6509] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 605.449837][ T9457] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 605.463662][ T6509] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 605.528063][ T9457] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.623781][ T9457] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 605.633749][ T6509] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 605.700629][ T6509] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.719176][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 605.772803][ T4358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 605.800353][ T6509] usb 5-1: Product: syz [ 605.804584][ T6509] usb 5-1: Manufacturer: syz [ 605.809163][ T6509] usb 5-1: SerialNumber: syz [ 606.002011][ T9457] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 606.062268][ T9457] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 606.125779][ T9457] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 606.196701][ T9457] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 606.566936][ T9876] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 606.587083][ T6509] usb 5-1: cannot create comm data receiver. [ 606.645624][ T6509] snd-usb-6fire: probe of 5-1:1.0 failed with error -8 [ 606.691427][ T4726] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 606.699291][ T4726] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 608.178617][ T9876] random: crng reseeded on system resumption [ 608.230855][ T4726] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 608.299568][ T4576] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 608.346653][ T6508] usb 5-1: USB disconnect, device number 23 [ 608.369137][ T4576] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 608.456619][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 610.822240][ T9907] futex_wake_op: syz.5.1436 tries to shift op by 144; fix this program [ 613.457711][ T9917] binder: 9916:9917 ioctl c0306201 0 returned -14 [ 614.599406][ T9934] [ 614.601784][ T9934] ====================================================== [ 614.608799][ T9934] WARNING: possible circular locking dependency detected [ 614.615829][ T9934] syzkaller #0 Not tainted [ 614.620333][ T9934] ------------------------------------------------------ [ 614.627382][ T9934] syz.3.1443/9934 is trying to acquire lock: [ 614.633435][ T9934] ffffffff8d7b02b0 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: configfs_rmdir+0x638/0x980 [ 614.643275][ T9934] [ 614.643275][ T9934] but task is already holding lock: [ 614.650645][ T9934] ffff888050a59590 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: vfs_rmdir+0xea/0x4a0 [ 614.660327][ T9934] [ 614.660327][ T9934] which lock already depends on the new lock. [ 614.660327][ T9934] [ 614.670735][ T9934] [ 614.670735][ T9934] the existing dependency chain (in reverse order) is: [ 614.679829][ T9934] [ 614.679829][ T9934] -> #3 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 614.688594][ T9934] down_write+0x36/0x60 [ 614.693266][ T9934] configfs_depend_item_unlocked+0x14f/0x430 [ 614.699833][ T9934] usbg_make_tpg+0x1dd/0x550 [ 614.705269][ T9934] target_fabric_make_tpg+0xa0/0x6d0 [ 614.711186][ T9934] configfs_mkdir+0x511/0x9e0 [ 614.716388][ T9934] vfs_mkdir+0x386/0x570 [ 614.721246][ T9934] do_mkdirat+0x1d8/0x440 [ 614.726103][ T9934] __x64_sys_mkdirat+0x85/0x90 [ 614.731374][ T9934] do_syscall_64+0x4c/0xa0 [ 614.736297][ T9934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 614.742734][ T9934] [ 614.742734][ T9934] -> #2 (tpg_instances_lock){+.+.}-{3:3}: [ 614.750626][ T9934] __mutex_lock+0x12d/0xae0 [ 614.755642][ T9934] tcm_alloc_inst+0x61/0x190 [ 614.760748][ T9934] usb_get_function_instance+0xd9/0x2e0 [ 614.766803][ T9934] function_make+0x118/0x350 [ 614.771988][ T9934] configfs_mkdir+0x511/0x9e0 [ 614.777195][ T9934] vfs_mkdir+0x386/0x570 [ 614.781973][ T9934] do_mkdirat+0x1d8/0x440 [ 614.786812][ T9934] __x64_sys_mkdirat+0x85/0x90 [ 614.792082][ T9934] do_syscall_64+0x4c/0xa0 [ 614.797015][ T9934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 614.803680][ T9934] [ 614.803680][ T9934] -> #1 (func_lock){+.+.}-{3:3}: [ 614.810787][ T9934] __mutex_lock+0x12d/0xae0 [ 614.815832][ T9934] usb_get_function_instance+0x2a/0x2e0 [ 614.822201][ T9934] function_make+0x118/0x350 [ 614.827491][ T9934] configfs_mkdir+0x511/0x9e0 [ 614.833069][ T9934] vfs_mkdir+0x386/0x570 [ 614.838164][ T9934] do_mkdirat+0x1d8/0x440 [ 614.843642][ T9934] __x64_sys_mkdirat+0x85/0x90 [ 614.849109][ T9934] do_syscall_64+0x4c/0xa0 [ 614.854070][ T9934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 614.860503][ T9934] [ 614.860503][ T9934] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 614.868938][ T9934] __lock_acquire+0x2d18/0x7c40 [ 614.874516][ T9934] lock_acquire+0x1bb/0x4a0 [ 614.880008][ T9934] __mutex_lock+0x12d/0xae0 [ 614.885917][ T9934] configfs_rmdir+0x638/0x980 [ 614.891369][ T9934] vfs_rmdir+0x34e/0x4a0 [ 614.896407][ T9934] do_rmdir+0x29a/0x5c0 [ 614.901172][ T9934] __x64_sys_unlinkat+0xc0/0xe0 [ 614.906530][ T9934] do_syscall_64+0x4c/0xa0 [ 614.911451][ T9934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 614.917873][ T9934] [ 614.917873][ T9934] other info that might help us debug this: [ 614.917873][ T9934] [ 614.928103][ T9934] Chain exists of: [ 614.928103][ T9934] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#21 [ 614.928103][ T9934] [ 614.943061][ T9934] Possible unsafe locking scenario: [ 614.943061][ T9934] [ 614.950675][ T9934] CPU0 CPU1 [ 614.956024][ T9934] ---- ---- [ 614.961375][ T9934] lock(&sb->s_type->i_mutex_key#21); [ 614.966823][ T9934] lock(tpg_instances_lock); [ 614.974023][ T9934] lock(&sb->s_type->i_mutex_key#21); [ 614.982099][ T9934] lock(gadget_subsys.su_mutex); [ 614.987184][ T9934] [ 614.987184][ T9934] *** DEADLOCK *** [ 614.987184][ T9934] [ 614.995412][ T9934] 3 locks held by syz.3.1443/9934: [ 615.000525][ T9934] #0: ffff888147e94460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 615.009778][ T9934] #1: ffff888071d03900 (&default_group_class[depth - 1]#2/1){+.+.}-{3:3}, at: do_rmdir+0x1b7/0x5c0 [ 615.021383][ T9934] #2: ffff888050a59590 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: vfs_rmdir+0xea/0x4a0 [ 615.031570][ T9934] [ 615.031570][ T9934] stack backtrace: [ 615.037449][ T9934] CPU: 0 PID: 9934 Comm: syz.3.1443 Not tainted syzkaller #0 [ 615.044822][ T9934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 615.054895][ T9934] Call Trace: [ 615.058163][ T9934] [ 615.061082][ T9934] dump_stack_lvl+0x188/0x24e [ 615.065751][ T9934] ? load_image+0x410/0x410 [ 615.070278][ T9934] ? show_regs_print_info+0x12/0x12 [ 615.075569][ T9934] ? print_circular_bug+0x12b/0x1a0 [ 615.080769][ T9934] check_noncircular+0x296/0x330 [ 615.085762][ T9934] ? add_chain_block+0x9b0/0x9b0 [ 615.090805][ T9934] ? lockdep_lock+0xf1/0x1f0 [ 615.095504][ T9934] ? _find_first_zero_bit+0xd2/0x100 [ 615.100822][ T9934] __lock_acquire+0x2d18/0x7c40 [ 615.106108][ T9934] ? mark_lock+0x94/0x320 [ 615.110444][ T9934] ? verify_lock_unused+0x140/0x140 [ 615.115993][ T9934] ? __lock_acquire+0x138a/0x7c40 [ 615.121174][ T9934] ? verify_lock_unused+0x140/0x140 [ 615.126457][ T9934] lock_acquire+0x1bb/0x4a0 [ 615.131013][ T9934] ? configfs_rmdir+0x638/0x980 [ 615.135985][ T9934] ? __might_sleep+0xd0/0xd0 [ 615.140624][ T9934] ? read_lock_is_recursive+0x10/0x10 [ 615.146042][ T9934] __mutex_lock+0x12d/0xae0 [ 615.150578][ T9934] ? configfs_rmdir+0x638/0x980 [ 615.155433][ T9934] ? configfs_rmdir+0x638/0x980 [ 615.160293][ T9934] ? dput+0x37/0x1d0 [ 615.164200][ T9934] ? mutex_lock_nested+0x10/0x10 [ 615.169154][ T9934] ? __lock_acquire+0x7c40/0x7c40 [ 615.174322][ T9934] ? lockref_put_or_lock+0x6e/0xb0 [ 615.179456][ T9934] ? dput+0x37/0x1d0 [ 615.183362][ T9934] ? dput+0x37/0x1d0 [ 615.187247][ T9934] configfs_rmdir+0x638/0x980 [ 615.191920][ T9934] vfs_rmdir+0x34e/0x4a0 [ 615.196155][ T9934] do_rmdir+0x29a/0x5c0 [ 615.200307][ T9934] ? d_delete_notify+0x150/0x150 [ 615.205254][ T9934] ? getname_flags+0x206/0x500 [ 615.210006][ T9934] __x64_sys_unlinkat+0xc0/0xe0 [ 615.214952][ T9934] do_syscall_64+0x4c/0xa0 [ 615.219369][ T9934] ? clear_bhb_loop+0x60/0xb0 [ 615.224143][ T9934] ? clear_bhb_loop+0x60/0xb0 [ 615.229095][ T9934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 615.235108][ T9934] RIP: 0033:0x7fc677f9e159 [ 615.239513][ T9934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 615.259128][ T9934] RSP: 002b:00007fc678f35028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 615.267615][ T9934] RAX: ffffffffffffffda RBX: 00007fc678225fa0 RCX: 00007fc677f9e159 [ 615.275589][ T9934] RDX: 0000000000000200 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 615.283545][ T9934] RBP: 00007fc67803506b R08: 0000000000000000 R09: 0000000000000000 [ 615.291502][ T9934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 615.300438][ T9934] R13: 00007fc678226038 R14: 00007fc678225fa0 R15: 00007ffd96ecec38 [ 615.308591][ T9934] [ 624.432614][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.439219][ T1280] ieee802154 phy1 wpan1: encryption failed: -22