last executing test programs: 17m48.022126471s ago: executing program 2 (id=820): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e21, 0x8, @loopback, 0x4}}, 0x0, 0x0, 0x2, 0x0, "c5f37081326dd7522df6283901be8b18078b072cc2cce27a675619ed2697db7edc31f32d5569fa033509f3db509c9aad33269479cd3503f15b4291d3e07d92ac46029d5384c936377e56629c4b37cee1"}, 0xd8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000340)='veth1_to_bond\x00', 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4001) sendmsg$NFT_BATCH(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x240088c8}, 0x4000000) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[], 0x7c70}, 0x1, 0x0, 0x0, 0x4004084}, 0x0) 17m45.810699729s ago: executing program 2 (id=824): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x8000, &(0x7f0000000080)=ANY=[], 0x1, 0x28d, &(0x7f00000000c0)="$eJzs3c9qE1EUB+DT/7GbBHQlLgYE6So0fYMgFcSAEMmirhpsC9KEQgoBXdjufBdXgm/iY/gEWRQiTaLJ1CjUtt6YfB8Mc5jJD85kkZnAucn+o/bxwcnp0d79b7FVyGI14vzzRUTEcqxE3tJgW88dOw8A4H9TrzerqXvgbnU61eZaRGz8cqbxKUlDAAAAAAAAAAAA3Njk/H9hNP8fvYjSxPz/0mi/bP4fAOaC+f/51+lUm5uj57c88/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAOr1+v9j/w5a6PwDg9rn/A8Diucb9/0vCNgGAW9TL3euXwvd/AJh/r/Zev6jWarv1LCtEtD92G93GcD88Xz2Kt9GKw9iOYlzE5fPByLB+9ry2u50NlGK/fTbKn3UbK/l8JYpRmp6vDPNZPr8Wm5P5nSjGg+n5nan59dh6PJEvRzG+vomTaMVBXGbH+Q+VLHv6snYlvzF4HQAAAAAAAAAAAAAAAAAAAPwL5eynqev3y+XfnR/mr/H7AFfW16/Gw9W01w4AAAAAAAAAAAAAAAAAAACz4vTd++Nmq3XYSV4sz0YbNyruzdy7qlD8XZH4gwkAAAAAAAAAAAAAAAAAABbQeNHvjyNP0jYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmM////7orU1wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAshu8BAAD//4pD6Wo=") bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000680)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000700)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000780), 0x651, 0x0) recvmmsg(r1, &(0x7f00000007c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000800)=0x6) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000380)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e23, @empty}, 0x2, 0x0, 0x4}}, 0x2e) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000003c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b00000000000600010007"], 0x48}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, 0x0, 0x0) getsockopt(r7, 0x111, 0x2, 0x0, 0x0) r8 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r2) shmat(r8, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmctl$IPC_RMID(r8, 0x0) setxattr$incfs_id(0x0, 0x0, &(0x7f0000000900)={'0000000000000000000000000000000', 0x32}, 0x20, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 17m43.712871586s ago: executing program 2 (id=828): socket$inet6_udp(0xa, 0x2, 0x0) fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000001c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000000480)=""/102392, 0x18ff8) getdents64(0xffffffffffffffff, &(0x7f0000000300)=""/224, 0xe0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x88000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000002c0)={0xefa, 0x7, 0x80, 0x40e0, 0xc}) 17m41.047898391s ago: executing program 2 (id=834): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e21, 0x8, @loopback, 0x4}}, 0x0, 0x0, 0x2, 0x0, "c5f37081326dd7522df6283901be8b18078b072cc2cce27a675619ed2697db7edc31f32d5569fa033509f3db509c9aad33269479cd3503f15b4291d3e07d92ac46029d5384c936377e56629c4b37cee1"}, 0xd8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000340)='veth1_to_bond\x00', 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) sendmsg$NFT_BATCH(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x240088c8}, 0x4000000) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[], 0x7c70}, 0x1, 0x0, 0x0, 0x4004084}, 0x0) 17m38.358268069s ago: executing program 2 (id=841): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102392, 0x18ff8) sched_setaffinity(r0, 0x0, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r2, &(0x7f0000000200)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x7}, 0xa) connect$bt_rfcomm(r2, 0x0, 0x0) 17m36.657648364s ago: executing program 2 (id=843): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000780)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) ioctl(0xffffffffffffffff, 0x400c4d04, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000180)=[{0x6, 0x9, 0x0, 0x7fff8000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 17m21.211258329s ago: executing program 32 (id=843): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000780)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) ioctl(0xffffffffffffffff, 0x400c4d04, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000180)=[{0x6, 0x9, 0x0, 0x7fff8000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 18.592345498s ago: executing program 0 (id=2789): r0 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000000480)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000019480)='fd/3\x00') r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x88000, 0x0) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000280)={0x30000011}) ioctl$TCSETAW(r4, 0x5453, &(0x7f00000002c0)={0xefa, 0x7, 0x80, 0x40e0, 0xc}) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x0, @remote}, 0x1c, 0x0}}], 0x1, 0x8140) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000080), 0x4) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000194c0)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) sendto$inet(0xffffffffffffffff, &(0x7f0000019700)="054dc9cd01000000", 0x8, 0x4044020, &(0x7f0000019740)={0x2, 0xfffd, @remote}, 0x10) 14.530634314s ago: executing program 0 (id=2801): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000006c0)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000700)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@abs={0x0, 0x0, 0x20000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000800), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000840), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000880)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = msgget(0x3, 0x710) msgget(0x2, 0x321) msgget(0x1, 0x240) msgctl$IPC_STAT(0x0, 0x2, 0x0) msgctl$IPC_RMID(r3, 0x0) msgget(0x3, 0x693) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000680)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/syz_tun/napi_defer_hard_irqs\x00', 0x1, 0x106) write(r4, &(0x7f0000000200)='1', 0x1) syz_open_procfs(0x0, &(0x7f00000002c0)='fd/3\x00') syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0xff, 0xfc, 0x11, 0x40, 0xbfd, 0x114, 0x8568, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x7, 0x3e, 0x0, 0x9, "", [{{0x9, 0x4, 0x2e, 0x55, 0x1, 0xae, 0x99, 0xf1, 0x9c, [], [{{0x9, 0x5, 0x5, 0x0, 0x200, 0x99, 0xe1, 0x7}}]}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) 12.343001378s ago: executing program 4 (id=2805): ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)=@multiplanar_mmap={0xed7d, 0x1, 0x4, 0x4000, 0xa, {0x77359400}, {0x1, 0x9, 0x2, 0x6, 0x4, 0x0, "7efd0b9d"}, 0x9, 0x1, {0x0}, 0x1}) 12.158069627s ago: executing program 3 (id=2807): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000019c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001a00)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001a80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, 0x0, 0x24040084) sendmsg$nl_route_sched(r2, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000001c00)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfc, {0x0, 0x0, 0x0, r4, {0xb}, {0xffff, 0xffff}, {0xfff1, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x1, 0x1, {0x2, '\x00', 0x3c0d, 0x5, 0xe4, 0x6b3}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 11.903401153s ago: executing program 3 (id=2808): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000004c0), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000500), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000080)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f0000000180)='./bus\x00') r3 = creat(&(0x7f00000001c0)='./bus\x00', 0xf2) open_by_handle_at(r3, &(0x7f0000000200)=@OVL_FILEID_V1={0x18, 0xf8, {'\x00', {0x0, 0xfb, 0x15, 0x6, 0x5, "a8371f2efe088557001f00"}}}, 0x5f1502) r4 = openat$urandom(0xffffffffffffff9c, 0x0, 0x8100, 0x0) ioctl$RNDADDENTROPY(r4, 0x40085203, &(0x7f0000000500)={0x6}) r5 = syz_open_procfs(0x0, &(0x7f0000000580)='net/fib_triestat\x00') lseek(r5, 0x2000, 0x1) 11.870260846s ago: executing program 4 (id=2809): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x8, 0x80000100008b}, 0x0) lstat(0x0, &(0x7f00000001c0)) mount$9p_unix(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000080), 0x2020001, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000005c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000700), 0x0, 0x0) read$msr(r1, &(0x7f0000000740)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioprio_set$pid(0x1, 0xffffffffffffffff, 0x4007) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000019780)={&(0x7f00000197c0)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x44}}, 0x0) 10.45722235s ago: executing program 3 (id=2810): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/rpc\x00') r3 = openat(r2, &(0x7f0000000100)='auth.unix.ip/channel\x00', 0x80882, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x20000005) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, 0x0) write$UHID_INPUT(r1, &(0x7f00000005c0)={0xfc, {"a2e3ad0e090d07f91b5e1a1887f70706d038e7ff7fc6e5539b0d3e0a8b089b3f32356c030890e0879b0a4cc6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07732f0acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973725b36d5b1b7ddd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fde70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe090064f11e4fe852c3f7c4239963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632bcfaaa5ae6c07a236d9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79ca389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e55fc4a41ea4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c46bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eb0600f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180610117a13638e9a14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0036327bd1f4108b7807fb33b72685ec37a2d3f766413a60459516247e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7d78aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e9fbfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e3897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c675879c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885594ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xffffffffffffff68}}, 0xb76) syz_usb_connect(0x3, 0x63, 0x0, 0x0) 9.886005509s ago: executing program 5 (id=2811): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sec\x00', &(0x7f00000002c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)=' /new_domain\n', 0x15) 9.868348261s ago: executing program 0 (id=2812): r0 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000001c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000000480)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000019480)='fd/3\x00') r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x88000, 0x0) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000280)={0x30000011}) ioctl$TCSETAW(r4, 0x5453, &(0x7f00000002c0)={0xefa, 0x7, 0x80, 0x40e0, 0xc}) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x0, @remote}, 0x1c, 0x0}}], 0x1, 0x8140) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000080), 0x4) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000194c0)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) sendto$inet(0xffffffffffffffff, &(0x7f0000019700)="054dc9cd01000000", 0x8, 0x4044020, &(0x7f0000019740)={0x2, 0xfffd, @remote}, 0x10) 9.825962135s ago: executing program 4 (id=2813): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sec\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)=' /new_domain\n', 0x15) 9.003240219s ago: executing program 0 (id=2814): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x40082, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./sys\x00', &(0x7f0000000580)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000680), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000006c0), 0x2, 0x141102) writev(r1, &(0x7f0000000700)=[{&(0x7f0000000740)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000780)={0xaa, 0x1a5}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f00000007c0)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) connect$inet(r0, &(0x7f0000000800)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x804808, &(0x7f0000000840)=ANY=[@ANYRES32=r3, @ANYRES8=r3, @ANYBLOB="0c2ec34edb42fe4f2c1b832d9141290140e677e53cc188dc41581142590d4e0713f4ae95293dd9ce1c8836b03632dab46a43356a89c37f32b221bf1e737101a03cdb083ffc8585af679581ab62438f23ef4adeb4629413", @ANYRESHEX, @ANYRES32=r3, @ANYRES64, @ANYRESOCT=0x0, @ANYRESDEC, @ANYRES8=r3, @ANYBLOB="b209eb6ac758b26226e3afb394a796baf3c6ce63c6342fceeedece41257e82ae0c182b8db1d9bcee3c8cc711a99a1b9fe2152fc846cdf5b62cf323b61a14c81100aa81ab73f3ed2ef2c4ffd4000435582841d1ec94cab677ebe3c11acdffc890d218a41f668954cb9f57fa7f418649"], 0x2, 0x55e, &(0x7f0000001400)="$eJzs3V1v00oawPHHpV2irNRdLSuEqgJD2ZWKVIKTQFDEldeZpIbEjmwHtVeooimqSGFFWWnbG7Y37K50zofgXJ4Pcb4ROh+BI4+dvuYF6Oup/r+ojGOPPY/TaB6miccCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADEcmu2XbSk6fmdJTWcWwuD1t7TbO8jK+TegWJEuyJW8iO5nNxIV934697m68k/czKbPpuVXFLkZPuP1//85NrkRH//EQF/k5++80ibW9uvV3q97ruTCuQCunl1+LaG9r0o8FpOQysvClS1UrEfLNYjVfeaOlqOYt1SbqidOAjVvHtPFavVstKF5aDjN2pOU/dXPr5fsu2KelpoayeMAv/B00LkLnrNpuc3TJ1kc1LncfJGfObFKtZOS6m19V63PO4EkkrFr6lUGlepZJdKxWKpVKw8qj56bNuTR1bYh8iRGif3psXv0wn23sDxTGT5X5riiS8dWRI18OFKTUIJpDVke6af///+QI9sd3/+72f5G3ubZ8Tk/1vps1vD8v+QWM7usSlbsi2vZUV60pOuvDv3iM720RAtvngSSSCetMQxa1S2RklVKlIRW17IotSnkl9iXTxpipZIliWSWLR5R7kSihZHYgkkFCXz4so9UVKUqlSlLEq0FGRZAumILw2piWOOsibr5nUvi7KGxbhbqTj0NPL9911XSiPOlvyP4zvJ7hs4li/9/A8AAAAAAC4ty/z1fcr83DTP615T2+cdFgAAAAAAOEHmk//ZpDDfzropFuN/AAAAAAAuG8tcY2eJSF5up0trYpnLpfgjAAAAAAAAl4T5/P9WUpg5UG6LtTtdCuN/AAAAAAAuif+NnWM/al+1fvlVwnDK2mkv/c3aMHPzOhtX0v2uHD5iXJ+xprODmKKSFpOTrp61cmml3UkwP2fF2rg4rL0AnN0A/vMtAVyblB/kTlrnzmparmZb/pS2kq97TV1wg+aTojjO9ESsl+J/vVn/t5jT/7/fmrZyst7rFl6+7a2aWHaSo+xsZBMoHplHcUQs7818C+aai4FnPGUuxMjazVuytt7r2u2lq9mRnY2JdGHiYIsfpke0+VHm0lpz2Yy3+f6WtM1c0maxMOzssyiKxzzzj3I3rXN3/m5aDIiiNC6K0v4oBr8Wx4+iPC6K8jGjAIDzsjYmC1lyJO9+Ry93KLsn3d5XZHf5xuz+UebTOvMzpmOdnBnQo9vjenT7mNnt5yP3QBqWY5N2fzyUVT8lO3wa2m7ULFnJS3jl/cY/5frm1vb99Y2VV91X3TelUrliP7TtRyWZMqeRFeQeAMAA+++xYw3M/6PuwvPlS5K7H2aj6p3Do+os4/1l9ysFBXkpb6Unq7JgrjYw3zgY+P+O/L6vISyMGbXmTZpM7/CyMGJU9wdzlUP/uKWRdQ/GUD6LXwUAAGdmbkweHp3/07H7wphx98FcPnp0nN93tzYAAHA6dPjZysf/tcLQa78oVqtFJ17UKgzcZyr0ag2tPD/Wobvo+A2t2mEQB27QTBaeezUdqajTbgdhrOpBqNpB5C2Z6QNVduv3SLccP/bcqN3UTqSVG/ix48aq5kWuanf+0fSiRR2anaO2dr265zqxF/gqCjqhqwtKRVrvq+jVtB97dS9Z9FU79FpOmFPPg2anpVVNR27oteMgPWC/Lc+vB2HLHLZw3i82AAAXxObW9uuVXq/77hQXBjacO/NTBQAAmTFZGgAAAAAAAAAAAAAAAAAAAAAAXABncf0fC5d8oT8V9EWJh4UTWBjbdXw49c4JwKn6LQAA//8FIlBo") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001980)={0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000019c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8040}}, {{&(0x7f0000001a40)=@file={0x1, '\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4080}}], 0x2, 0x400c0) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi4\x00', 0x2481, 0x0) ioctl$COMEDI_CMD(r5, 0x80506409, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x6, 0x4, 0x7, 0x10, 0x6df, 0x20, 0x1, 0x1, 0x1, &(0x7f00000002c0)=[0x0], 0x1, 0x0}) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@nombcache}, {@nogrpid}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt+bH/ved+a93TcznQmgbQ2kf5KIbRHxe0T0ZdnbFxjI3ubnZsZuzs2MJbGw8PbfSWW5G3MzY8WixXpb88yhUkTpsySOJ0vLnbp46cxouTxxPs8PTZ/9cGjq4qXnTp8dPTVxauLcyLFjR48Mv/jCyPNrEmca1429H0/u2/P6u1ffHDtx9b2fvk2rtXt/Nr86jju6WSegOgbSrfbPQkXtvCebqPu9YHtVOulsYUVoSkdEpLurq9L/+6IjFndeX7z2aUsrB6yr9LdpS+PZswvAJpZEq2sAtEbxQ58e/xavDRp6/C9cfzmiO0/Pz82Mzd+KvzNK+fSudSx/ICJOzP77VfqKZs9DAACsQmVs82y98V8pdlfes2sdO/JrKP0RcX9E7IyIByJiV0Q8GFFZ9qGIeDhbeaFvheUP1OSXjn9K1+rWeY2k47+XqsZ+81Xx52/9HXlueyX+ruTk6fLE4XybHIquLWl+eJkyvn/1ty8azase/6WvtPxiLJhX4FpnzQm68dHp0bXaCNcvR+ztrBd/cutKQNoC9kTE3uY+ekeROP30N/saLXTn+JexBteZFr6OeCrb/7NRE38hWf765FBPlCcODxWtYqmff73yVqPy7yr+NXD9wCNZYnH/1yxR1dDK5YnzU82XceWPzxse06y2/Xcn71T65C/vZ9MujE5Pnx+O6E7eqOSLY7rK9JHFdS+MTvem+WL5tP0fOli//+/M10n3f7qV0ka8PyIejYjH8ro/HhEHIuLgMvH/+MoTHywTfxJJtG7/X44Yr/v9d6v99yfV1+tXkeg488N3ja6Yr2z/H43ZyndtpvL9dwcrreBdbj4AAAC4J5QiYlskpcEsPbAtSqXBwex/+HfFfaXy5NT0MycnPzo3nt0j0B9dpeJMV1/V+dDhZDb/xCw/kp8rLuYfyc8bf9nRW8kPjk2Wx1scO7S7rbf3/yj6f+qvjlbXDlh37teC9lXb/0stqgew8Vby++9YADan2/t/T/qnt1V1ATaW439oX/X6/yc1eeN/2JyW9v8/6zyyDtiMjP+hfen/0L70f2hLzdzOH8cbzeqJiGYeC1DcLLD6pwr0rPgO/3ZJFE+8WM+yeuPSme58SpRaFGlHk41tUyTSHrOxhS4+QwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBe9l8AAAD//3ow3kU=") socket$inet_icmp(0x2, 0x2, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) 8.973536102s ago: executing program 5 (id=2815): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) getpriority(0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='100', 0x3) mmap(&(0x7f00003e9000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) 8.69582964s ago: executing program 5 (id=2816): socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/kallsyms\x00', 0x0, 0x0) pread64(r2, &(0x7f00000003c0)=""/103, 0x67, 0x800) 8.122097649s ago: executing program 3 (id=2817): syz_usb_connect(0x5, 0x44, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) 7.794708173s ago: executing program 1 (id=2818): mkdirat(0xffffffffffffffff, 0x0, 0x1ed) socket$inet_tcp(0x2, 0x1, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x8, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000003480)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x1, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) read$char_usb(0xffffffffffffffff, &(0x7f0000000040)=""/236, 0xec) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f00000003c0)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e000000", 0x55}], 0x1) socket(0x10, 0x803, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x80000000, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f0000000280)={0x3, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) add_key(&(0x7f0000000040)='id_legacy\x00', 0x0, &(0x7f0000000580)="c5feb906e9af6c94e4bb228aa1ebeac34b1f1a0704e1e9914a58e6be2bdec72b4bdeba50b709343e747fab8612a3dd2d2468175a25ce9eded3302eac2cee5d0f54e9fca8f0f1d13aa17c0c6edaa877427ead9712a2a839e0af0b79d83eac8a9488b12a4473b9d520c3cb8e3d6ea9501eb40d5895208539158578b9c0b329a0ad1bbdfd4f6406c72399ad2b0fc3f7dabba66d0f9b0d5e4aa16a3ab7d5ebd12660260400000000000000000034ca1c3ee4144da116d35ef302b50f15495731a59376e1432c285c1b9d438a872c6927778835975589101b2ebd08fb43e7770efd6ec582ed174898125c9dae473d1fbe389707110f9335c00228a528d72f94721d7dcd7cf56213e4d2b21445c2e1c98f554feab4cc3fff9c04c8630d4f0644e4a0ed0962d62533a9d460751b7bc006eb9cf6241f89e428db18daa5", 0x139, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000a40)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x1000, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TARGET_MSG(r2, 0xc138fd0e, &(0x7f0000000d00)={0x4, 0x0, 0x0, 0x158, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, {0x0, @stats_create={'@stats_create ', '-', 0x20, '/1'}}}) 6.609540414s ago: executing program 1 (id=2819): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000019c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001a00)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001a80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, 0x0, 0x24040084) sendmsg$nl_route_sched(r2, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000001c00)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfc, {0x0, 0x0, 0x0, r4, {0xb}, {0xffff, 0xffff}, {0xfff1, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x1, 0x1, {0x2, '\x00', 0x3c0d, 0x5, 0xe4, 0x6b3}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 6.334164922s ago: executing program 1 (id=2820): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r0) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x20, r1, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x20}, 0x1, 0x0, 0x0, 0x2004c044}, 0x40) 6.15401651s ago: executing program 1 (id=2821): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000004c0), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000500), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000080)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f0000000180)='./bus\x00') r3 = creat(&(0x7f00000001c0)='./bus\x00', 0xf2) open_by_handle_at(r3, &(0x7f0000000200)=@OVL_FILEID_V1={0x18, 0xf8, {'\x00', {0x0, 0xfb, 0x15, 0x6, 0x5, "a8371f2efe088557001f00"}}}, 0x5f1502) r4 = openat$urandom(0xffffffffffffff9c, 0x0, 0x8100, 0x0) ioctl$RNDADDENTROPY(r4, 0x40085203, &(0x7f0000000500)={0x6}) r5 = syz_open_procfs(0x0, &(0x7f0000000580)='net/fib_triestat\x00') lseek(r5, 0x2000, 0x1) 5.220583246s ago: executing program 1 (id=2822): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000006c0)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000700)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@abs={0x0, 0x0, 0x20000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000800), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000840), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000880)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = msgget(0x3, 0x710) msgget(0x2, 0x321) msgget(0x1, 0x240) msgctl$IPC_STAT(0x0, 0x2, 0x0) msgctl$IPC_RMID(r3, 0x0) msgget(0x3, 0x693) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000680)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/syz_tun/napi_defer_hard_irqs\x00', 0x1, 0x106) write(r4, &(0x7f0000000200)='1', 0x1) syz_open_procfs(0x0, &(0x7f00000002c0)='fd/3\x00') syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0xff, 0xfc, 0x11, 0x40, 0xbfd, 0x114, 0x8568, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x7, 0x3e, 0x0, 0x9, "", [{{0x9, 0x4, 0x2e, 0x55, 0x1, 0xae, 0x99, 0xf1, 0x9c, [], [{{0x9, 0x5, 0x5, 0x0, 0x200, 0x99, 0xe1, 0x7}}]}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) 5.158065352s ago: executing program 4 (id=2823): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x8, 0x80000100008b}, 0x0) lstat(0x0, &(0x7f00000001c0)) mount$9p_unix(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000080), 0x2020001, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000005c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000006c0)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000700), 0x0, 0x0) read$msr(r1, &(0x7f0000000740)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioprio_set$pid(0x1, 0xffffffffffffffff, 0x4007) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000019780)={&(0x7f00000197c0)={0x48, 0x2, 0x6, 0x801, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x48}}, 0x0) 5.019898496s ago: executing program 5 (id=2824): r0 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000001c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000000480)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000019480)='fd/3\x00') r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x88000, 0x0) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000280)={0x30000011}) ioctl$TCSETAW(r4, 0x5453, &(0x7f00000002c0)={0xefa, 0x7, 0x80, 0x40e0, 0xc}) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x0, @remote}, 0x1c, 0x0}}], 0x1, 0x8140) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000080), 0x4) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000194c0)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) sendto$inet(0xffffffffffffffff, &(0x7f0000019700)="054dc9cd01000000", 0x8, 0x4044020, &(0x7f0000019740)={0x2, 0xfffd, @remote}, 0x10) 3.061924597s ago: executing program 5 (id=2825): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sec\x00', &(0x7f00000002c0)='securityfs\x00', 0x0, 0x0) setresuid(0xee00, 0xee00, 0x0) write(0xffffffffffffffff, &(0x7f0000000340)=' /new_domain\n', 0x15) 3.032798969s ago: executing program 4 (id=2826): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) getpriority(0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='100', 0x3) mmap(&(0x7f00003e9000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) 2.969479346s ago: executing program 3 (id=2827): socket$kcm(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000600)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) syz_mount_image$f2fs(&(0x7f0000000680), &(0x7f00000006c0)='./file1\x00', 0x10000, &(0x7f0000000700)=ANY=[], 0x1, 0x105ec, &(0x7f0000000740)="$eJzs3M2LG2UcB/Df7Hbb7Yt1EQ/eOiDCLjRLs31Bb1VbVHBLfTt40myShrRJZtmk21gRimfx2H9ET97Fq/+EN/EgeCsomWdSXW1Rumnjtp8PzH5nnnnmN8+EsPDMhAngmbWS//ZrFifjaEQsRsSJiHI9S5FcTPFSRJyKI7EQcX/Jqvb7DYcj4lhEnJwUTzWzatcXd+9s3htvfv7d3V8ufdn48fTcLhqYu1cior+d1m/1UxadlNer9sZut8z+ud0q047+jWq7SHmrvVVWuNWY9muUebaT+hfbN4eTvNZrNCfZ6V4r27cH6YTD3c60TnnA9cZOud1qb5XZHRZldm6ncY2rvD0cpTqtqt5nZfkYjaaZ2tvjdrqe7RtlNgejqj3VLVrt8SR3q6xOF82i1yrHsfXIH/P/3rvdwc1xvtveGXaLQX5+vf7qev1Crb5TtNqj9rlao9+6cC5f7fQm3WqjdqN/sVMUnV57vVn01/LVTrNZq9fz1UvtrW5jkNfr62fXz9TOr1Vrp/O3rnyU91r56iTf6A5ujrq9YX6t2MnTEWv5xvrZ19byl+v5B5tX86vvX768efXDTy59fOX1zXferDr9Y1j56saZjY1a/Uxto77m+vdjeX+H86zL9m4em9c4AA6Qcv5/NB40///z3+qe+X+Y/wP7Zv5v/h/mv4/v+pfjQFz/f5v/39nfSXh6ZfMeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8/LT0jdvlysrafu9H1I+VzW9UPXLImIhIn5/gMU4vKfmYkQcj4ilh/RfmnY8kuL7LMoKWdU0WY5FxMVquff8g8d+aPYfBwAAADx1vr1z6us0W09/VuY9IB6HhYe0p5s2Cyc+ndF5sohYWvl5RtXKUb84o2Ll9/tQjGdUrbyBtTyjYuWtsid8L2txTyz/JbIUD/vOAAAAB9jemYAn6gAAAE+vr+Y9AOYji+mjzOmz4OkP8qsHgkc9CAQAAICDLpv3AAAAAIDHrpz///39f8ernU/k/X+VR33/HwAAAPDv0vv/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5g535yUgfiOID/2tL3eP/yiHHvVdzBMTyCS5eEA3gJjoBX8AKcAXfeQAOGtkRqMBoZiiGfT9JOpyFfpoTNb6YZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO6aGcje7GF7f75ixX+0nzNAAAAMAui3I2qi4Gdf9Pc/9fc+us6WcRkUfErtq9iB+tzKLJKd/5fPlmDPcRVcL6O342x++IuGyO5/+H/hUAAADgdM0n02FdrdenwbEHRJfqSZv871WivCwiysFjorR8fTpPFFb9v3txkyitmsDqJwqrp9x6qdI+pWg1/a0mq5u80+EAAACdaFcC3VYhAAAAdOl663p8xHHQsSw2S5mbteDqzfvXBcFfrR4AAADwDT19sLVe1u1wAAAAgCOo6n/7/wEAAMBpq/f/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4JAW5Ww0n0yH++YsV19TNG2apwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAF/bnHQVCIAzCYO/6zmTuf1hp0NTUpAqEj78xGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB487u//J+YGmeSudfG0vNIsnZqbJ0ae+fG0R/G168BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC42J+XFAiBIIiCOeN/J33/w0qCnkGECGh4VFGLBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL7od7/8n5gaZ5K508bS8UiydtXYumrsPWgcPRhv/wYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC42Lmf1ziqOADgb2Z3tk1BukYJ1INWLFQUmmz9heClByF4EDyJx5CmEF1/0OZgSzzk4kHxP/CiHjz0IgQEqYh/QQ+e7LFeKsgeKgh6Wnnzo06aVKa2O7tdPx948747vJ35vklY9jtvEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKqMz4XgVd+KmX8Rpue/nm9vrsb92Wx/dWLt8LLYYJ+2m/cDpxmu0NO0sAAAAmHedqr4PIVzPdldjn/Zj/f/pD49/VOyPNf/2Q0Vc1fO31/1VX9X+sV35/ss3bp2oX5wnCyF82x9urLQ4x1l2ouG4ow3G5PcSijs0nfzHlr6288goy6968tnVq6/28vDQvWUMANwPp6q+DM5tFt+PYj+YZmIAzK1u2UKt/u/0p5sTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBtGO+HZKk5CCI91/4mjaze31w/qb6xdPla1o289+nH9mPEQWQjh3OZwY6XFucyyEw3HXbh46Z214XDj/F0FT/ynd+0Nknt7u6CFIKTFb8n9PXLy53g8uZzjJ8kMXLoHPpjkpxMAAPMmK1v8Nn49212N+5LFEMZf7K3/T9bi0LD+/3Hzysn6uer1/6C1Gc62pvX/8ta7HyxfuHipV75+7/Tg+cFLKy+/MHhxOb+fsuyuCgAAAHfWK1u9/k8X96//H6nFoWH9/9Ovb/5WP1dH/b/P3a//TzghAACA/7GHj//xe3LA/qTXCx+ubW2dHxTbW69PF9t/O+Z4PLl872ihWj0Oh6vgUNnq9X9ncQq5AQAAAK0b7SR71v/P1uLQcP3/u2f++rx+zE4IYaFc/z+1/v7wbHvTmVn71//7B45r48+JW5guAAAAU7JQtvr6f5Y//58+WY1JQwhPP1XE5b8BbFT/v9L95Ez9XPXn/59rb4ozKV0qrkeT5//zsUshdJdaSAwAAIC5dDi2r77O41+y3dW3vznyes/z/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA3+3NvmzAQxnH49SVR4jYZIb2VwAw0VAhG4ENCsuQZGICFaKhoLRaBFUCCc01nKJ6n+f+KK+4FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICXd3n44i0iikhdpkjjzc/pPSI+Im3bdvR5y2J3PjZf95ztD5Oc3zH9LSOijKKPcwAAeld1m2O1rpd/ef/zDvIO81bzpl4889MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXNmBAwEAAAAAIP/XRqiqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrCDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsIOHAsAAAAACPO3TqNjAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMYKAAD//9ltZfQ=") openat(0xffffffffffffff9c, 0x0, 0x48101, 0x1ef) r1 = openat(0xffffffffffffff9c, &(0x7f0000010d40)='./bus\x00', 0x40, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000010d80)='./bus\x00', 0x1c1002, 0x12) write(r2, &(0x7f0000010dc0)="c7", 0x1) sendfile(r2, r1, 0x0, 0x2fffe) sendfile(r2, r1, 0x0, 0x7ffff000) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x0) 2.076461447s ago: executing program 1 (id=2828): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2505000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000180), 0x651, 0x0) recvmmsg(r1, &(0x7f00000001c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sec\x00', &(0x7f00000002c0)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000180), 0x4003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000001c0)={0x7, 0x1, 0x1}) 825.566906ms ago: executing program 3 (id=2829): mkdirat(0xffffffffffffffff, 0x0, 0x1ed) socket$inet_tcp(0x2, 0x1, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x8, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000003480)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x1, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) read$char_usb(0xffffffffffffffff, &(0x7f0000000040)=""/236, 0xec) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f00000003c0)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e000000", 0x55}], 0x1) socket(0x10, 0x803, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x80000000, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f0000000280)={0x3, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) add_key(&(0x7f0000000040)='id_legacy\x00', 0x0, &(0x7f0000000580)="c5feb906e9af6c94e4bb228aa1ebeac34b1f1a0704e1e9914a58e6be2bdec72b4bdeba50b709343e747fab8612a3dd2d2468175a25ce9eded3302eac2cee5d0f54e9fca8f0f1d13aa17c0c6edaa877427ead9712a2a839e0af0b79d83eac8a9488b12a4473b9d520c3cb8e3d6ea9501eb40d5895208539158578b9c0b329a0ad1bbdfd4f6406c72399ad2b0fc3f7dabba66d0f9b0d5e4aa16a3ab7d5ebd12660260400000000000000000034ca1c3ee4144da116d35ef302b50f15495731a59376e1432c285c1b9d438a872c6927778835975589101b2ebd08fb43e7770efd6ec582ed174898125c9dae473d1fbe389707110f9335c00228a528d72f94721d7dcd7cf56213e4d2b21445c2e1c98f554feab4cc3fff9c04c8630d4f0644e4a0ed0962d62533a9d460751b7bc006eb9cf6241f89e428db18daa5", 0x139, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000a40)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x1000, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TARGET_MSG(r2, 0xc138fd0e, &(0x7f0000000d00)={0x4, 0x0, 0x0, 0x158, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, {0x0, @stats_create={'@stats_create ', '-', 0x20, '/1'}}}) 637.375715ms ago: executing program 0 (id=2830): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000019c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001a00)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001a80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, 0x0, 0x24040084) sendmsg$nl_route_sched(r2, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000001c00)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfc, {0x0, 0x0, 0x0, r4, {0xb}, {0xffff, 0xffff}, {0xfff1, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x1, 0x1, {0x2, '\x00', 0x3c0d, 0x5, 0xe4, 0x6b3}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 116.317708ms ago: executing program 0 (id=2831): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000000c0)={0x0, 0x0}, 0x8) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000100)=r0, 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r1}, 0x8) readv(r2, &(0x7f00000002c0)=[{0x0}], 0x1) 18.045468ms ago: executing program 5 (id=2832): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000004c0), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000500), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f0000000180)='./bus\x00') r3 = creat(&(0x7f00000001c0)='./bus\x00', 0xf2) open_by_handle_at(r3, &(0x7f0000000200)=@OVL_FILEID_V1={0x18, 0xf8, {'\x00', {0x0, 0xfb, 0x15, 0x6, 0x5, "a8371f2efe088557001f00"}}}, 0x5f1502) r4 = openat$urandom(0xffffffffffffff9c, 0x0, 0x8100, 0x0) ioctl$RNDADDENTROPY(r4, 0x40085203, &(0x7f0000000500)={0x6}) r5 = syz_open_procfs(0x0, &(0x7f0000000580)='net/fib_triestat\x00') lseek(r5, 0x2000, 0x1) 0s ago: executing program 4 (id=2833): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sec\x00', &(0x7f00000002c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000340)=' /new_domain\n', 0x15) kernel console output (not intermixed with test programs): parent+0x121/0x3e0 [ 710.366200][ T4286] device_add+0x470/0x1050 [ 710.370641][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 710.375598][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 710.380990][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 710.387245][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 710.392370][ T4286] ? memcpy+0x3c/0x60 [ 710.396366][ T4286] ? skb_pull_data+0xec/0x1f0 [ 710.401071][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 710.406646][ T4286] hci_event_packet+0x61f/0xe60 [ 710.411526][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 710.417621][ T4286] ? bis_list+0x280/0x280 [ 710.421970][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 710.427888][ T4286] ? kcov_remote_start+0x50f/0x810 [ 710.433012][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 710.438227][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 710.443447][ T4286] hci_rx_work+0x3eb/0xd40 [ 710.447878][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 710.452753][ T4286] ? process_one_work+0x7b4/0x1160 [ 710.457886][ T4286] process_one_work+0x8ab/0x1160 [ 710.462865][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 710.468526][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 710.473575][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 710.479144][ T4286] ? wq_worker_running+0x97/0x190 [ 710.484187][ T4286] worker_thread+0xaf5/0x12a0 [ 710.488912][ T4286] kthread+0x29d/0x330 [ 710.493001][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 710.498017][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 710.502596][ T4286] ret_from_fork+0x1f/0x30 [ 710.507038][ T4286] [ 710.518086][ T4286] kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 710.531755][ T4286] Bluetooth: hci4: failed to register connection device [ 711.108835][ T9294] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1128'. [ 711.634546][ T4285] EXT4-fs (loop4): unmounting filesystem. [ 711.954201][ T9301] loop4: detected capacity change from 0 to 64 [ 712.553391][ T4286] Bluetooth: hci4: command 0x2016 tx timeout [ 714.232984][ T9300] input: syz1 as /devices/virtual/input/input17 [ 714.680280][ T9306] overlayfs: missing 'lowerdir' [ 715.377510][ T9312] loop4: detected capacity change from 0 to 32768 [ 715.384775][ T9312] XFS: ikeep mount option is deprecated. [ 717.063559][ T9312] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 717.075139][ T9312] XFS (loop4): Mounting V5 Filesystem [ 717.297471][ T9312] XFS (loop4): Ending clean mount [ 717.309538][ T9312] XFS (loop4): Quotacheck needed: Please wait. [ 717.322419][ T48] XFS (loop4): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 717.493339][ T48] XFS (loop4): Unmount and run xfs_repair [ 717.499172][ T48] XFS (loop4): First 128 bytes of corrupted metadata buffer: [ 717.538314][ T48] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 717.576467][ T48] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 717.735812][ T48] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 717.762003][ T48] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 717.772324][ T48] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 717.782467][ T48] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 718.058176][ T48] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 718.127275][ T48] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 718.178879][ T48] XFS (loop4): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 718.246610][ T9312] XFS (loop4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 718.474676][ T4285] XFS (loop4): Unmounting Filesystem [ 718.576538][ T9340] random: crng reseeded on system resumption [ 720.579296][ T9349] loop5: detected capacity change from 0 to 2048 [ 720.628609][ T9349] EXT4-fs: Ignoring removed nobh option [ 720.638575][ T9352] loop1: detected capacity change from 0 to 512 [ 720.690846][ T9349] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 720.773710][ T9349] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 720.966714][ T9349] EXT4-fs (loop5): Remounting filesystem read-only [ 721.036822][ T9360] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1140'. [ 721.630422][ T7910] EXT4-fs (loop5): unmounting filesystem. [ 722.159804][ T7377] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 724.143419][ T7377] usb 2-1: Using ep0 maxpacket: 16 [ 724.233659][ T7377] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 724.258983][ T7377] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 724.283401][ T7377] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.291441][ T7377] usb 2-1: Product: syz [ 724.323418][ T7377] usb 2-1: Manufacturer: syz [ 724.328065][ T7377] usb 2-1: SerialNumber: syz [ 724.369855][ T7377] usb 2-1: config 0 descriptor?? [ 724.387175][ T7377] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 724.433377][ T7377] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 724.476038][ T7504] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 724.486037][ T7504] CPU: 1 PID: 7504 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 724.493613][ T7504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 724.503682][ T7504] Workqueue: hci1 hci_rx_work [ 724.508382][ T7504] Call Trace: [ 724.511668][ T7504] [ 724.514606][ T7504] dump_stack_lvl+0x188/0x24e [ 724.519312][ T7504] ? show_regs_print_info+0x12/0x12 [ 724.524532][ T7504] ? load_image+0x410/0x410 [ 724.529064][ T7504] sysfs_create_dir_ns+0x26a/0x290 [ 724.534197][ T7504] ? __lock_acquire+0x7ea0/0x7ea0 [ 724.539240][ T7504] ? sysfs_warn_dup+0xa0/0xa0 [ 724.543943][ T7504] ? do_raw_spin_unlock+0x11d/0x230 [ 724.549160][ T7504] kobject_add_internal+0x617/0xca0 [ 724.554396][ T7504] kobject_add+0x160/0x230 [ 724.558836][ T7504] ? kobject_init+0x1c0/0x1c0 [ 724.563533][ T7504] ? __raw_spin_lock_init+0x41/0x100 [ 724.568829][ T7504] ? klist_children_get+0x50/0x50 [ 724.573875][ T7504] ? get_device_parent+0x121/0x3e0 [ 724.579010][ T7504] device_add+0x470/0x1050 [ 724.583451][ T7504] hci_conn_add_sysfs+0xd1/0x1e0 [ 724.588415][ T7504] le_conn_complete_evt+0x10db/0x17c0 [ 724.593858][ T7504] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 724.600133][ T7504] ? __copy_skb_header+0x3ba/0x4f0 [ 724.605245][ T7504] ? memcpy+0x3c/0x60 [ 724.609228][ T7504] ? skb_pull_data+0xec/0x1f0 [ 724.613911][ T7504] hci_le_conn_complete_evt+0x183/0x440 [ 724.619458][ T7504] hci_event_packet+0x61f/0xe60 [ 724.624308][ T7504] ? hci_remote_host_features_evt+0x230/0x230 [ 724.630364][ T7504] ? bis_list+0x280/0x280 [ 724.634689][ T7504] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 724.640580][ T7504] ? kcov_remote_start+0x50f/0x810 [ 724.645687][ T7504] ? lockdep_hardirqs_on+0x94/0x140 [ 724.650880][ T7504] ? hci_send_to_monitor+0x9c/0x4a0 [ 724.656077][ T7504] hci_rx_work+0x3eb/0xd40 [ 724.660491][ T7504] ? _raw_spin_unlock+0x40/0x40 [ 724.665339][ T7504] ? process_one_work+0x7b4/0x1160 [ 724.670446][ T7504] process_one_work+0x8ab/0x1160 [ 724.675392][ T7504] ? worker_detach_from_pool+0x240/0x240 [ 724.681022][ T7504] ? _raw_spin_lock_irq+0xb7/0xf0 [ 724.686041][ T7504] ? _raw_spin_lock_irqsave+0x100/0x100 [ 724.691582][ T7504] ? wq_worker_running+0x97/0x190 [ 724.696601][ T7504] worker_thread+0xaf5/0x12a0 [ 724.701285][ T7504] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 724.707181][ T7504] kthread+0x29d/0x330 [ 724.711240][ T7504] ? worker_clr_flags+0x1a0/0x1a0 [ 724.716255][ T7504] ? kthread_blkcg+0xd0/0xd0 [ 724.720837][ T7504] ret_from_fork+0x1f/0x30 [ 724.725261][ T7504] [ 724.742156][ T7504] kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 724.758590][ T7504] Bluetooth: hci1: failed to register connection device [ 725.087977][ T9379] loop3: detected capacity change from 0 to 512 [ 725.166465][ T9210] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 725.186963][ T7377] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 726.793645][ T7504] Bluetooth: hci1: command 0x2016 tx timeout [ 726.873071][ T9396] loop4: detected capacity change from 0 to 512 [ 727.385456][ T7377] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 727.468541][ T9403] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1151'. [ 727.790922][ T7377] em28xx 2-1:0.0: board has no eeprom [ 728.107433][ T7377] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 728.142687][ T7377] em28xx 2-1:0.0: dvb set to bulk mode. [ 728.756063][ T4354] em28xx 2-1:0.0: Binding DVB extension [ 728.976824][ T7377] usb 2-1: USB disconnect, device number 4 [ 729.097117][ T7377] em28xx 2-1:0.0: Disconnecting em28xx [ 729.366704][ T4354] em28xx 2-1:0.0: Registering input extension [ 729.384522][ T7377] em28xx 2-1:0.0: Closing input extension [ 729.421959][ T7377] em28xx 2-1:0.0: Freeing device [ 730.699692][ T9426] loop3: detected capacity change from 0 to 64 [ 732.034529][ T9428] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1159'. [ 732.044136][ T9428] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1159'. [ 733.837185][ T9443] loop5: detected capacity change from 0 to 256 [ 737.542030][ T9456] random: crng reseeded on system resumption [ 738.080541][ T9459] loop4: detected capacity change from 0 to 512 [ 738.384630][ T9461] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1164'. [ 739.201811][ T9464] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 739.201811][ T9464] [ 739.215619][ T9464] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 739.228413][ T9464] CIFS: Attempting to mount \\127.0.0.1\share [ 739.247006][ T9464] CIFS: VFS: Error connecting to socket. Aborting operation. [ 739.270314][ T9464] CIFS: VFS: cifs_mount failed w/return code = -111 [ 740.205149][ T9467] loop5: detected capacity change from 0 to 8 [ 740.843339][ T5081] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 741.034085][ T5081] usb 4-1: Using ep0 maxpacket: 16 [ 741.116922][ T5081] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 741.206252][ T5081] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 741.233344][ T5081] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.313327][ T5081] usb 4-1: Product: syz [ 741.317564][ T5081] usb 4-1: Manufacturer: syz [ 741.363392][ T5081] usb 4-1: SerialNumber: syz [ 741.374733][ T5081] usb 4-1: config 0 descriptor?? [ 741.417000][ T5081] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 741.454311][ T9482] loop5: detected capacity change from 0 to 256 [ 741.463479][ T5081] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 743.971606][ T5081] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 744.911013][ T5081] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 744.984293][ T5081] em28xx 4-1:0.0: board has no eeprom [ 745.353365][ T5081] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 745.366946][ T5081] em28xx 4-1:0.0: dvb set to bulk mode. [ 745.409146][ T5081] em28xx 4-1:0.0: Binding DVB extension [ 745.533033][ T5080] usb 4-1: USB disconnect, device number 9 [ 745.557768][ T5080] em28xx 4-1:0.0: Disconnecting em28xx [ 745.658706][ T9508] loop3: detected capacity change from 0 to 512 [ 745.775510][ T9415] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 746.200403][ T9513] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1180'. [ 746.443516][ T5081] em28xx 4-1:0.0: Registering input extension [ 746.537751][ T5080] em28xx 4-1:0.0: Closing input extension [ 746.565419][ T5080] em28xx 4-1:0.0: Freeing device [ 747.707337][ T9517] loop3: detected capacity change from 0 to 32768 [ 747.714592][ T9517] XFS: ikeep mount option is deprecated. [ 747.723749][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.730064][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.833762][ T9517] XFS (loop3): DAX unsupported by block device. Turning off DAX. [ 747.842235][ T9517] XFS (loop3): Mounting V5 Filesystem [ 747.980795][ T9517] XFS (loop3): Ending clean mount [ 747.992855][ T9517] XFS (loop3): Quotacheck needed: Please wait. [ 748.033754][ T4357] XFS (loop3): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 749.022158][ T4357] XFS (loop3): Unmount and run xfs_repair [ 749.119679][ T9537] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 749.160748][ T9537] loop5: detected capacity change from 0 to 128 [ 749.277196][ T4357] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 749.426621][ T4357] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 749.433442][ T9210] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 749.575873][ T4357] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 749.623310][ T4357] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 749.632306][ T4357] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 749.645606][ T9540] loop5: detected capacity change from 0 to 8 [ 749.657786][ T9210] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 749.684655][ T4357] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 749.693482][ T9210] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 749.728641][ T9210] Buffer I/O error on dev loop5, logical block 0, async page read [ 749.730134][ T4357] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 749.813048][ T4357] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 749.850800][ T4357] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 749.896863][ T4357] XFS (loop3): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 749.954263][ T9517] XFS (loop3): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 750.034891][ T4274] XFS (loop3): Unmounting Filesystem [ 752.343418][ T9267] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 753.203349][ T9267] usb 6-1: Using ep0 maxpacket: 16 [ 753.254611][ T9267] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 753.310321][ T9267] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 753.340430][ T9267] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.360713][ T9267] usb 6-1: Product: syz [ 753.370778][ T9267] usb 6-1: Manufacturer: syz [ 753.383376][ T9267] usb 6-1: SerialNumber: syz [ 753.401780][ T9267] usb 6-1: config 0 descriptor?? [ 753.421963][ T9267] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 753.451811][ T9267] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 754.460352][ T9267] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 755.593696][ T9267] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 755.601747][ T9267] em28xx 6-1:0.0: board has no eeprom [ 755.703650][ T9267] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 755.730885][ T9267] em28xx 6-1:0.0: dvb set to bulk mode. [ 755.760594][ T9267] usb 6-1: USB disconnect, device number 3 [ 755.777422][ T9267] em28xx 6-1:0.0: Disconnecting em28xx [ 755.800403][ T9268] em28xx 6-1:0.0: Binding DVB extension [ 756.046006][ T9581] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 756.086367][ T9581] loop3: detected capacity change from 0 to 128 [ 757.123197][ T9584] loop4: detected capacity change from 0 to 32768 [ 757.130163][ T9584] XFS: ikeep mount option is deprecated. [ 757.153781][ T9210] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 757.307660][ T9584] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 757.316356][ T9584] XFS (loop4): Mounting V5 Filesystem [ 757.389581][ T9268] em28xx 6-1:0.0: Registering input extension [ 757.400250][ T9267] em28xx 6-1:0.0: Closing input extension [ 757.403812][ T9584] XFS (loop4): Ending clean mount [ 757.412883][ T9584] XFS (loop4): Quotacheck needed: Please wait. [ 757.854272][ T9267] em28xx 6-1:0.0: Freeing device [ 759.041840][ T9268] XFS (loop4): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 759.058519][ T9268] XFS (loop4): Unmount and run xfs_repair [ 759.068576][ T9268] XFS (loop4): First 128 bytes of corrupted metadata buffer: [ 759.090400][ T9268] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 759.875316][ T9268] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 759.904940][ T9268] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 759.917108][ T9268] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 759.934972][ T9268] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 759.988612][ T9268] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 760.013379][ T9268] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 760.068412][ T9268] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 760.107354][ T4405] XFS (loop4): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 760.151267][ T9584] XFS (loop4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 760.278860][ T4285] XFS (loop4): Unmounting Filesystem [ 760.552503][ T9615] loop1: detected capacity change from 0 to 512 [ 761.587298][ T9619] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1191'. [ 762.378606][ T9625] loop3: detected capacity change from 0 to 256 [ 763.073347][ T4351] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 763.305338][ T4351] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 764.203226][ T4351] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.213193][ T4351] usb 2-1: Product: syz [ 764.230981][ T4351] usb 2-1: Manufacturer: syz [ 764.241102][ T4351] usb 2-1: SerialNumber: syz [ 764.304695][ T9641] loop3: detected capacity change from 0 to 736 [ 764.928147][ T9640] block device autoloading is deprecated and will be removed. [ 764.949464][ T9641] rock: directory entry would overflow storage [ 764.955761][ T9641] rock: sig=0x3b10, size=4, remaining=3 [ 765.252957][ T4351] ums-karma 2-1:1.0: USB Mass Storage device detected [ 765.427055][ T9647] loop3: detected capacity change from 0 to 512 [ 765.465270][ T4351] ums-karma 2-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 765.465270][ T4351] Please send a copy of this message to and [ 765.718456][ T9653] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1211'. [ 767.917973][ T9662] loop4: detected capacity change from 0 to 512 [ 767.983923][ T9663] loop3: detected capacity change from 0 to 32768 [ 767.991047][ T9663] XFS: ikeep mount option is deprecated. [ 767.998538][ T4351] ums-karma: probe of 2-1:1.0 failed with error -5 [ 768.010125][ T4351] usb 2-1: USB disconnect, device number 5 [ 768.280866][ T9663] XFS (loop3): DAX unsupported by block device. Turning off DAX. [ 768.299654][ T9663] XFS (loop3): Mounting V5 Filesystem [ 768.441225][ T9663] XFS (loop3): Ending clean mount [ 768.448458][ T9663] XFS (loop3): Quotacheck needed: Please wait. [ 768.520580][ T4351] XFS (loop3): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 768.579128][ T4351] XFS (loop3): Unmount and run xfs_repair [ 768.670591][ T4351] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 768.791986][ T4351] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 768.930518][ T4351] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 769.071640][ T4351] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 769.218806][ T4351] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 769.360457][ T4351] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 769.461371][ T4351] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 769.511968][ T4351] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 769.580439][ T4351] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 769.618757][ T4405] XFS (loop3): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 769.663659][ T9663] XFS (loop3): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 769.712440][ T9660] syz.3.1215 (9660): drop_caches: 2 [ 769.912566][ T9267] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 769.936675][ T4274] XFS (loop3): Unmounting Filesystem [ 770.110620][ T9267] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 770.122767][ T9267] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.133010][ T9267] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 770.142224][ T9267] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 770.154825][ T9267] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 770.171799][ T9267] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 770.188268][ T9267] usb 6-1: Product: syz [ 770.196707][ T9267] usb 6-1: Manufacturer: syz [ 770.212779][ T9267] cdc_wdm 6-1:1.0: skipping garbage [ 770.224524][ T9267] cdc_wdm 6-1:1.0: skipping garbage [ 771.435808][ T9267] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 771.441798][ T9267] cdc_wdm 6-1:1.0: Unknown control protocol [ 771.496581][ T9267] usb 6-1: USB disconnect, device number 4 [ 771.610125][ T9694] block device autoloading is deprecated and will be removed. [ 771.620213][ T9694] md: md4 stopped. [ 772.693448][ T9267] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 773.147822][ T9712] loop5: detected capacity change from 0 to 512 [ 773.471191][ T9715] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1225'. [ 776.677183][ T9727] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1227'. [ 777.818428][ T9735] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1232'. [ 779.528781][ T9738] xt_CT: You must specify a L4 protocol and not use inversions on it [ 779.540274][ T26] audit: type=1800 audit(1793650655.700:112): pid=9734 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1231" name="attr_allow_any_host" dev="configfs" ino=45554 res=0 errno=0 [ 780.236124][ T9795] cgroup: fork rejected by pids controller in /syz3 [ 782.598077][ T9833] loop1: detected capacity change from 0 to 512 [ 782.614294][ T9791] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.919010][ T9836] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1240'. [ 783.737304][ T4286] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 783.749640][ T4286] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 783.769640][ T4286] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 783.792049][ T4288] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 783.810542][ T4286] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 783.820117][ T4286] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 783.856561][ T9791] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.798168][ T9840] rxe_eth0 speed is unknown, defaulting to 1000 [ 784.948574][ T9791] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 785.132650][ T9791] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 785.710390][ T9840] chnl_net:caif_netlink_parms(): no params data found [ 785.915671][ T4286] Bluetooth: hci0: command 0x0409 tx timeout [ 785.965232][ T9840] bridge0: port 1(bridge_slave_0) entered blocking state [ 785.972502][ T9840] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.987158][ T9840] device bridge_slave_0 entered promiscuous mode [ 786.894921][ T9854] xt_CT: You must specify a L4 protocol and not use inversions on it [ 786.905301][ T26] audit: type=1800 audit(1793650663.070:113): pid=9854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1245" name="attr_allow_any_host" dev="configfs" ino=46876 res=0 errno=0 [ 787.128732][ T9840] bridge0: port 2(bridge_slave_1) entered blocking state [ 787.137081][ T9840] bridge0: port 2(bridge_slave_1) entered disabled state [ 787.172385][ T9840] device bridge_slave_1 entered promiscuous mode [ 787.337546][ T9840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 788.054366][ T4286] Bluetooth: hci0: command 0x041b tx timeout [ 788.244030][ T9840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 788.338589][ T9840] team0: Port device team_slave_0 added [ 788.445102][ T9840] team0: Port device team_slave_1 added [ 788.463628][ T4353] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 788.578931][ T9840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 788.600752][ T9840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 788.678603][ T9840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 788.697870][ T4353] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 788.716572][ T4353] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 788.731318][ T4353] usb 6-1: Product: syz [ 788.740448][ T4353] usb 6-1: Manufacturer: syz [ 788.748611][ T4353] usb 6-1: SerialNumber: syz [ 788.789968][ T9840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 788.806562][ T9840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 788.853208][ T9840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 789.548277][ T9881] sctp: [Deprecated]: syz.1.1250 (pid 9881) Use of struct sctp_assoc_value in delayed_ack socket option. [ 789.548277][ T9881] Use struct sctp_sack_info instead [ 790.044815][ T4353] rtl8150 6-1:1.0: couldn't reset the device [ 790.063560][ T4353] rtl8150: probe of 6-1:1.0 failed with error -5 [ 790.083662][ T4286] Bluetooth: hci0: command 0x040f tx timeout [ 791.324754][ T9840] device hsr_slave_0 entered promiscuous mode [ 791.369488][ T9840] device hsr_slave_1 entered promiscuous mode [ 791.377384][ T9840] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 791.408493][ T9840] Cannot create hsr debugfs directory [ 791.603875][ T9268] usb 6-1: USB disconnect, device number 6 [ 792.173292][ T4286] Bluetooth: hci0: command 0x0419 tx timeout [ 792.259617][ T9893] loop5: detected capacity change from 0 to 1024 [ 792.266878][ T9893] ext3: Unknown parameter 'appraise_type' [ 793.378253][ T9903] xt_CT: You must specify a L4 protocol and not use inversions on it [ 793.951666][ T26] audit: type=1800 audit(1793650669.550:114): pid=9903 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1256" name="attr_allow_any_host" dev="configfs" ino=45718 res=0 errno=0 [ 794.995002][ T9914] loop1: detected capacity change from 0 to 8 [ 796.083170][ T9791] device hsr_slave_0 left promiscuous mode [ 796.119028][ T9791] device hsr_slave_1 left promiscuous mode [ 796.130708][ T9791] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 796.169810][ T9791] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 796.227887][ T9791] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 796.244739][ T9791] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 796.274362][ T9791] device bridge_slave_1 left promiscuous mode [ 796.290652][ T9791] bridge0: port 2(bridge_slave_1) entered disabled state [ 797.661347][ T9791] device bridge_slave_0 left promiscuous mode [ 797.676331][ T9791] bridge0: port 1(bridge_slave_0) entered disabled state [ 797.688737][ T9936] loop1: detected capacity change from 0 to 512 [ 797.695659][ T9936] EXT4-fs: Ignoring removed bh option [ 797.701565][ T9936] EXT4-fs: quotafile must be on filesystem root [ 797.745263][ T9819] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 797.759015][ T9936] loop1: detected capacity change from 0 to 512 [ 797.808616][ T9936] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.1261: iget: bad i_size value: 38620345925642 [ 797.821860][ T9936] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1261: couldn't read orphan inode 15 (err -117) [ 797.835392][ T9936] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 798.245373][ T9799] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm kworker/u4:32: bg 0: block 5: invalid block bitmap [ 798.280157][ T9799] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 798.317044][ T9799] EXT4-fs (loop1): This should not happen!! Data will be lost [ 798.317044][ T9799] [ 798.330869][ T9791] device veth1_macvtap left promiscuous mode [ 798.338231][ T9791] device veth0_macvtap left promiscuous mode [ 798.363845][ T9791] device veth1_vlan left promiscuous mode [ 798.371916][ T9799] EXT4-fs (loop1): Total free blocks count 0 [ 798.387208][ T9791] device veth0_vlan left promiscuous mode [ 798.396313][ T9799] EXT4-fs (loop1): Free/Dirty block details [ 798.414625][ T9799] EXT4-fs (loop1): free_blocks=0 [ 798.430205][ T9799] EXT4-fs (loop1): dirty_blocks=16000 [ 798.470917][ T9799] EXT4-fs (loop1): Block reservation details [ 798.495751][ T9799] EXT4-fs (loop1): i_reserved_data_blocks=16000 [ 799.428707][ T9938] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 799.573687][ T9950] loop5: detected capacity change from 0 to 64 [ 800.594685][ T9952] process 'syz.4.1263' launched './file0' with NULL argv: empty string added [ 801.466235][ T4355] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 801.653332][ T4355] usb 5-1: Using ep0 maxpacket: 8 [ 801.664636][ T4355] usb 5-1: unable to get BOS descriptor or descriptor too short [ 801.678872][ T4355] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 801.691262][ T4355] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 801.703032][ T4355] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 801.724827][ T4355] usb 5-1: New USB device found, idVendor=0bda, idProduct=4014, bcdDevice= 0.40 [ 801.734040][ T4355] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.742480][ T4355] usb 5-1: Product: syz [ 801.749382][ T4355] usb 5-1: Manufacturer: syz [ 801.755579][ T4355] usb 5-1: SerialNumber: syz [ 802.089154][ T4355] usb 5-1: 1:1 : no UAC_FORMAT_TYPE desc [ 802.099673][ T4355] usb 5-1: 0:2 : does not exist [ 802.287727][ T4355] usb 5-1: USB disconnect, device number 4 [ 802.329808][ T9819] udevd[9819]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 802.467952][ T9791] team0 (unregistering): Port device team_slave_1 removed [ 802.519126][ T9791] team0 (unregistering): Port device team_slave_0 removed [ 802.565266][ T9791] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 802.643833][ T9791] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 802.956781][ T9962] xt_CT: You must specify a L4 protocol and not use inversions on it [ 803.509019][ T26] audit: type=1800 audit(1793650679.130:115): pid=9962 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1268" name="attr_allow_any_host" dev="configfs" ino=45769 res=0 errno=0 [ 803.516860][ T9964] syz.1.1267: attempt to access beyond end of device [ 803.516860][ T9964] nbd1: rw=0, sector=0, nr_sectors = 8 limit=0 [ 803.547974][ T9964] F2FS-fs (nbd1): Unable to read 1th superblock [ 803.623750][ T9964] syz.1.1267: attempt to access beyond end of device [ 803.623750][ T9964] nbd1: rw=0, sector=8, nr_sectors = 8 limit=0 [ 803.653574][ T9964] F2FS-fs (nbd1): Unable to read 2th superblock [ 803.823185][ T9968] loop1: detected capacity change from 0 to 64 [ 804.149795][ T9791] bond0 (unregistering): Released all slaves [ 804.268265][ T9928] tipc: Started in network mode [ 804.273573][ T9928] tipc: Node identity 1001001, cluster identity 4711 [ 804.290443][ T9928] tipc: Node number set to 16781313 [ 804.431811][ T9974] loop4: detected capacity change from 0 to 512 [ 805.628545][ T9819] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 805.882065][ T9982] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1272'. [ 806.130720][ T9970] loop1: detected capacity change from 0 to 40427 [ 806.232470][ T9970] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 806.254355][ T9970] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 806.292104][ T9970] F2FS-fs (loop1): invalid crc value [ 806.807290][ T9840] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 806.816881][ T9970] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 806.831907][ T9840] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 806.951299][ T9840] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 806.994507][ T9840] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 807.104514][ T9970] F2FS-fs (loop1): Start checkpoint disabled! [ 807.243609][ T9840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 807.303186][ T9840] 8021q: adding VLAN 0 to HW filter on device team0 [ 807.343722][ T9791] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 807.370900][ T9791] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 807.403411][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 807.424357][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 807.556911][T10001] xt_CT: You must specify a L4 protocol and not use inversions on it [ 808.194066][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 808.201208][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 808.273359][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 808.288167][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 808.312050][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 808.338657][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 808.345826][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 808.380546][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 808.404555][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 808.476839][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.481668][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 808.483149][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.533485][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 808.583948][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 808.628119][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 808.651166][T10009] vivid-000: ================= START STATUS ================= [ 808.693359][T10009] vivid-000: FM Deviation: 75000 [ 808.698365][T10009] vivid-000: ================== END STATUS ================== [ 808.734174][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 808.804000][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 808.857723][ T9840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 808.900690][T10009] loop5: detected capacity change from 0 to 512 [ 808.943934][T10009] EXT4-fs: Ignoring removed bh option [ 808.973485][T10009] EXT4-fs: quotafile must be on filesystem root [ 808.981290][ T9840] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 809.068654][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 809.085223][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 809.209914][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 812.486424][T10039] loop5: detected capacity change from 0 to 64 [ 813.925873][ T9774] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 813.971346][ T9774] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 814.028513][ T9840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 814.256342][T10046] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1287'. [ 814.264831][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 814.368337][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 814.466971][ T9791] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 814.522735][ T9791] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 814.600996][ T9791] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 814.641619][ T9791] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 814.716460][ T9840] device veth0_vlan entered promiscuous mode [ 814.804062][ T9840] device veth1_vlan entered promiscuous mode [ 814.935703][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 814.997556][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 815.019848][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 815.077473][ T9840] device veth0_macvtap entered promiscuous mode [ 815.589572][ T9840] device veth1_macvtap entered promiscuous mode [ 815.628511][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 815.744717][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 815.798066][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 815.851130][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 815.893724][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 815.943296][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 815.982757][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 816.023967][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.064864][ T9840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 816.123817][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 816.136004][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 816.164328][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 816.213106][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 816.241309][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 816.282494][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.197513][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.233523][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.274730][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.476667][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.531561][ T9840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 817.689548][ T9840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 818.229673][ T9840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 818.284914][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 818.323667][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 818.377536][ T9840] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.449829][ T9840] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.472452][ T9840] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.487757][ T9840] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.729454][T10093] loop1: detected capacity change from 0 to 64 [ 820.407318][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 820.707476][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 820.958203][ T9787] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 821.006608][ T9783] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 821.021087][ T9783] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 821.029656][ T9793] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 821.319233][T10107] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1299'. [ 822.846605][T10119] netem: change failed [ 822.943790][T10125] device syzkaller0 entered promiscuous mode [ 822.971113][T10119] tipc: Started in network mode [ 822.994103][T10119] tipc: Node identity 8ab48d6da7b5, cluster identity 4711 [ 823.071216][T10119] tipc: Enabled bearer , priority 0 [ 823.129850][T10119] tipc: Resetting bearer [ 823.238894][T10116] tipc: Resetting bearer [ 824.158304][T10116] tipc: Disabling bearer [ 824.306538][ T4355] tipc: Node number set to 755076461 [ 824.872207][T10143] FAULT_INJECTION: forcing a failure. [ 824.872207][T10143] name failslab, interval 1, probability 0, space 0, times 0 [ 824.891173][T10143] CPU: 1 PID: 10143 Comm: syz.5.1308 Not tainted syzkaller #0 [ 824.898688][T10143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 824.908760][T10143] Call Trace: [ 824.912052][T10143] [ 824.914995][T10143] dump_stack_lvl+0x188/0x24e [ 824.919706][T10143] ? show_regs_print_info+0x12/0x12 [ 824.924924][T10143] ? load_image+0x410/0x410 [ 824.929448][T10143] ? __lock_acquire+0x7ea0/0x7ea0 [ 824.934497][T10143] ? preempt_schedule_common+0xa5/0xd0 [ 824.940083][T10143] should_fail_ex+0x390/0x4c0 [ 824.944794][T10143] should_failslab+0x5/0x20 [ 824.949321][T10143] slab_pre_alloc_hook+0x59/0x300 [ 824.954367][T10143] ? preempt_schedule_thunk+0x16/0x18 [ 824.959772][T10143] ? throtl_pd_alloc+0x9a/0x5f0 [ 824.964731][T10143] __kmem_cache_alloc_node+0x4f/0x270 [ 824.970126][T10143] ? throtl_pd_alloc+0x9a/0x5f0 [ 824.974998][T10143] kmalloc_node_trace+0x22/0xe0 [ 824.979873][T10143] throtl_pd_alloc+0x9a/0x5f0 [ 824.984577][T10143] ? blkg_rwstat_recursive_sum+0x810/0x810 [ 824.990406][T10143] blkg_alloc+0x659/0x7d0 [ 824.994766][T10143] blkg_conf_prep+0x83d/0x1010 [ 824.999552][T10143] ? blkg_conf_prep+0xe7/0x1010 [ 825.004435][T10143] tg_set_conf+0xdb/0x3c0 [ 825.008789][T10143] ? trace_raw_output_contention_end+0xd0/0xd0 [ 825.014961][T10143] ? tg_prfill_conf_u64+0x80/0x80 [ 825.020016][T10143] ? tg_print_conf_uint+0xe0/0xe0 [ 825.025057][T10143] cgroup_file_write+0x2c9/0x6a0 [ 825.030105][T10143] ? cgroup_seqfile_stop+0xd0/0xd0 [ 825.035239][T10143] ? __virt_addr_valid+0x188/0x540 [ 825.040452][T10143] ? __virt_addr_valid+0x188/0x540 [ 825.045604][T10143] ? cgroup_seqfile_stop+0xd0/0xd0 [ 825.050745][T10143] kernfs_fop_write_iter+0x3a0/0x520 [ 825.056067][T10143] vfs_write+0x482/0x9a0 [ 825.060332][T10143] ? file_end_write+0x250/0x250 [ 825.065199][T10143] ? __fget_files+0x3fc/0x460 [ 825.069943][T10143] ? __fdget_pos+0x2ae/0x360 [ 825.074557][T10143] ? ksys_write+0x70/0x260 [ 825.078989][T10143] ksys_write+0x14d/0x260 [ 825.083338][T10143] ? __ia32_sys_read+0x80/0x80 [ 825.088124][T10143] ? lockdep_hardirqs_on+0x94/0x140 [ 825.093346][T10143] do_syscall_64+0x4c/0xa0 [ 825.097784][T10143] ? clear_bhb_loop+0x60/0xb0 [ 825.102478][T10143] ? clear_bhb_loop+0x60/0xb0 [ 825.107174][T10143] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 825.113087][T10143] RIP: 0033:0x7f1264d9fb19 [ 825.117514][T10143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 825.137138][T10143] RSP: 002b:00007f1265bbf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 825.145570][T10143] RAX: ffffffffffffffda RBX: 00007f1265025fa0 RCX: 00007f1264d9fb19 [ 825.153561][T10143] RDX: 0000000000000006 RSI: 00002000000001c0 RDI: 0000000000000003 [ 825.161549][T10143] RBP: 00007f1264e37af8 R08: 0000000000000000 R09: 0000000000000000 [ 825.169539][T10143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 825.177524][T10143] R13: 00007f1265026038 R14: 00007f1265025fa0 R15: 00007ffc876c2178 [ 825.185529][T10143] [ 825.742513][T10150] input: syz1 as /devices/virtual/input/input22 [ 826.981485][T10156] ip_tables: iptables: counters copy to user failed while replacing table [ 830.651944][T10181] loop4: detected capacity change from 0 to 512 [ 830.758469][T10182] loop3: detected capacity change from 0 to 64 [ 832.371397][T10183] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1312'. [ 840.257839][T10236] loop4: detected capacity change from 0 to 64 [ 843.563326][ T4353] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 844.485836][ T4353] usb 4-1: config 0 has no interfaces? [ 844.495060][ T4353] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 844.533447][ T4353] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 844.541577][ T4353] usb 4-1: Product: syz [ 844.573281][ T4353] usb 4-1: Manufacturer: syz [ 844.577931][ T4353] usb 4-1: SerialNumber: syz [ 844.633998][ T4353] usb 4-1: config 0 descriptor?? [ 844.894890][ T4354] usb 4-1: USB disconnect, device number 10 [ 845.137122][T10266] loop4: detected capacity change from 0 to 8 [ 845.304793][T10267] fuse: Unknown parameter 'grou00000000000000000000' [ 848.843967][T10284] loop1: detected capacity change from 0 to 512 [ 849.119543][T10287] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1336'. [ 851.313045][T10301] FAULT_INJECTION: forcing a failure. [ 851.313045][T10301] name failslab, interval 1, probability 0, space 0, times 0 [ 851.384449][T10301] CPU: 0 PID: 10301 Comm: syz.4.1342 Not tainted syzkaller #0 [ 851.391966][T10301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 851.402029][T10301] Call Trace: [ 851.405320][T10301] [ 851.408255][T10301] dump_stack_lvl+0x188/0x24e [ 851.412964][T10301] ? show_regs_print_info+0x12/0x12 [ 851.418178][T10301] ? load_image+0x410/0x410 [ 851.422699][T10301] ? __might_sleep+0xd0/0xd0 [ 851.427307][T10301] ? __lock_acquire+0x7ea0/0x7ea0 [ 851.432355][T10301] should_fail_ex+0x390/0x4c0 [ 851.437049][T10301] should_failslab+0x5/0x20 [ 851.441569][T10301] slab_pre_alloc_hook+0x59/0x300 [ 851.446618][T10301] ? __rdma_create_id+0x65/0x620 [ 851.451683][T10301] __kmem_cache_alloc_node+0x4f/0x270 [ 851.457071][T10301] ? __rdma_create_id+0x65/0x620 [ 851.462030][T10301] kmalloc_trace+0x26/0xe0 [ 851.466467][T10301] ? ucma_alloc_ctx+0x2d0/0x2d0 [ 851.471398][T10301] ? ucma_alloc_ctx+0x2d0/0x2d0 [ 851.476265][T10301] __rdma_create_id+0x65/0x620 [ 851.481055][T10301] ? do_raw_spin_unlock+0x11d/0x230 [ 851.486267][T10301] ? ucma_alloc_ctx+0x2d0/0x2d0 [ 851.491139][T10301] rdma_create_user_id+0x7d/0xc0 [ 851.496098][T10301] ucma_create_id+0x227/0x370 [ 851.500789][T10301] ? __lock_acquire+0x7ea0/0x7ea0 [ 851.505829][T10301] ? ucma_close+0x170/0x170 [ 851.510347][T10301] ? __might_fault+0xa6/0x120 [ 851.515032][T10301] ? __might_fault+0xc2/0x120 [ 851.519804][T10301] ? __might_fault+0xa6/0x120 [ 851.524495][T10301] ucma_write+0x24e/0x2f0 [ 851.528842][T10301] ? ucma_get_global_nl_info+0x70/0x70 [ 851.534320][T10301] ? common_file_perm+0x171/0x1c0 [ 851.539432][T10301] ? fsnotify_perm+0x5a/0x550 [ 851.544196][T10301] ? security_file_permission+0x75/0xa0 [ 851.549756][T10301] ? ucma_get_global_nl_info+0x70/0x70 [ 851.555231][T10301] vfs_write+0x2dc/0x9a0 [ 851.559491][T10301] ? file_end_write+0x250/0x250 [ 851.564352][T10301] ? __fget_files+0x28/0x460 [ 851.568961][T10301] ? __fget_files+0x3fc/0x460 [ 851.573663][T10301] ? __fdget_pos+0x1d4/0x360 [ 851.578263][T10301] ? ksys_write+0x70/0x260 [ 851.582692][T10301] ksys_write+0x14d/0x260 [ 851.587028][T10301] ? __ia32_sys_read+0x80/0x80 [ 851.591803][T10301] ? lockdep_hardirqs_on+0x94/0x140 [ 851.597012][T10301] do_syscall_64+0x4c/0xa0 [ 851.601442][T10301] ? clear_bhb_loop+0x60/0xb0 [ 851.606129][T10301] ? clear_bhb_loop+0x60/0xb0 [ 851.610839][T10301] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 851.616744][T10301] RIP: 0033:0x7f17dbb9fb19 [ 851.621170][T10301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 851.640786][T10301] RSP: 002b:00007f17dc9dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 851.649216][T10301] RAX: ffffffffffffffda RBX: 00007f17dbe25fa0 RCX: 00007f17dbb9fb19 [ 851.657199][T10301] RDX: 0000000000000020 RSI: 00002000000009c0 RDI: 0000000000000003 [ 851.665175][T10301] RBP: 00007f17dbc37af8 R08: 0000000000000000 R09: 0000000000000000 [ 851.673160][T10301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 851.681138][T10301] R13: 00007f17dbe26038 R14: 00007f17dbe25fa0 R15: 00007ffd75c3f508 [ 851.689136][T10301] [ 859.276904][T10342] loop1: detected capacity change from 0 to 512 [ 859.454448][T10343] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1358'. [ 867.148964][T10380] fuse: Bad value for 'fd' [ 867.407666][T10365] loop3: detected capacity change from 0 to 32768 [ 869.918312][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.924677][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.008323][T10396] loop1: detected capacity change from 0 to 512 [ 870.283130][T10394] loop3: detected capacity change from 0 to 32768 [ 870.291944][T10400] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1373'. [ 871.515977][T10394] JBD2: Ignoring recovery information on journal [ 871.762845][T10394] JBD2: recovery failed [ 871.790035][T10394] (syz.3.1376,10394,0):ocfs2_journal_load:1135 ERROR: Failed to load journal! [ 872.443287][T10394] (syz.3.1376,10394,1):ocfs2_check_volume:2431 ERROR: ocfs2 journal load failed! -5 [ 872.461389][T10394] (syz.3.1376,10394,1):ocfs2_check_volume:2487 ERROR: status = -5 [ 872.499347][T10394] (syz.3.1376,10394,1):ocfs2_mount_volume:1821 ERROR: status = -5 [ 874.006383][T10394] (syz.3.1376,10394,1):ocfs2_fill_super:1176 ERROR: status = -5 [ 874.580513][T10425] loop3: detected capacity change from 0 to 512 [ 875.429633][T10437] loop5: detected capacity change from 0 to 2048 [ 875.474040][T10437] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 877.079016][T10445] fuse: Bad value for 'fd' [ 878.987140][T10455] loop4: detected capacity change from 0 to 512 [ 879.342776][T10457] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1391'. [ 881.046133][T10465] 9pnet_fd: Insufficient options for proto=fd [ 881.374679][T10469] loop1: detected capacity change from 0 to 736 [ 882.516625][T10469] rock: directory entry would overflow storage [ 882.522873][T10469] rock: sig=0x3b10, size=4, remaining=3 [ 883.589922][T10480] loop1: detected capacity change from 0 to 2048 [ 883.603559][T10480] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 884.850453][T10484] loop3: detected capacity change from 0 to 512 [ 884.928458][T10484] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 885.088872][T10484] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1399: invalid indirect mapped block 9 (level 0) [ 885.885933][T10484] EXT4-fs (loop3): 1 truncate cleaned up [ 885.892443][T10484] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 885.972549][T10484] syz.3.1399 (pid 10484) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 886.129504][ T9840] EXT4-fs (loop3): unmounting filesystem. [ 886.268635][T10492] loop3: detected capacity change from 0 to 512 [ 886.594057][T10496] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1402'. [ 889.377501][T10495] loop5: detected capacity change from 0 to 32768 [ 889.446879][T10495] JBD2: Ignoring recovery information on journal [ 889.516996][T10495] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 890.470725][ T7910] ocfs2: Unmounting device (7,5) on (node local) [ 891.934428][T10530] loop5: detected capacity change from 0 to 736 [ 891.965100][T10530] rock: directory entry would overflow storage [ 891.971295][T10530] rock: sig=0x3b10, size=4, remaining=3 [ 892.393745][T10532] 9pnet_fd: Insufficient options for proto=fd [ 894.860083][T10553] loop4: detected capacity change from 0 to 512 [ 894.908267][T10553] EXT4-fs: Ignoring removed bh option [ 894.948281][T10553] EXT4-fs (loop4): Test dummy encryption mode enabled [ 895.015447][T10553] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: comm syz.4.1415: inode #1: comm syz.4.1415: iget: illegal inode # [ 895.113284][T10553] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.1415: error while reading EA inode 1 err=-117 [ 895.182344][T10534] loop1: detected capacity change from 0 to 32768 [ 895.182374][T10553] EXT4-fs (loop4): 1 orphan inode deleted [ 895.205966][T10553] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 895.241036][T10534] JBD2: Ignoring recovery information on journal [ 895.318053][ T4285] EXT4-fs (loop4): unmounting filesystem. [ 895.353314][T10560] loop3: detected capacity change from 0 to 8 [ 895.462202][T10534] JBD2: recovery failed [ 896.217784][T10534] (syz.1.1405,10534,0):ocfs2_journal_load:1135 ERROR: Failed to load journal! [ 896.227131][T10534] (syz.1.1405,10534,0):ocfs2_check_volume:2431 ERROR: ocfs2 journal load failed! -5 [ 896.236814][T10534] (syz.1.1405,10534,0):ocfs2_check_volume:2487 ERROR: status = -5 [ 896.244943][T10534] (syz.1.1405,10534,0):ocfs2_mount_volume:1821 ERROR: status = -5 [ 896.264749][T10534] (syz.1.1405,10534,0):ocfs2_fill_super:1176 ERROR: status = -5 [ 896.999265][T10558] ip_tables: iptables: counters copy to user failed while replacing table [ 898.704389][T10574] loop3: detected capacity change from 0 to 32768 [ 898.729427][T10578] loop5: detected capacity change from 0 to 736 [ 898.794003][T10578] rock: directory entry would overflow storage [ 898.800241][T10578] rock: sig=0x3b10, size=4, remaining=3 [ 898.816871][T10574] JBD2: Ignoring recovery information on journal [ 899.796825][T10574] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 901.081191][ T9840] ocfs2: Unmounting device (7,3) on (node local) [ 901.370162][T10593] loop4: detected capacity change from 0 to 64 [ 901.383844][T10595] loop3: detected capacity change from 0 to 512 [ 901.656299][T10598] loop4: detected capacity change from 0 to 512 [ 901.870631][T10598] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1428'. [ 902.044554][T10603] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1429'. [ 904.668088][T10620] loop4: detected capacity change from 0 to 32768 [ 904.756317][T10620] XFS (loop4): Mounting V5 Filesystem [ 904.943323][T10620] XFS (loop4): Ending clean mount [ 905.009357][ T26] audit: type=1800 audit(1793650781.170:116): pid=10620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1431" name="file1" dev="loop4" ino=4422 res=0 errno=0 [ 905.184459][ T4285] XFS (loop4): Unmounting Filesystem [ 906.857086][T10642] loop3: detected capacity change from 0 to 32768 [ 907.895773][ T4286] Bluetooth: hci0: command 0x0406 tx timeout [ 907.982297][T10642] JBD2: Ignoring recovery information on journal [ 908.144654][T10662] loop5: detected capacity change from 0 to 512 [ 908.154727][T10642] JBD2: recovery failed [ 908.158918][T10642] (syz.3.1436,10642,1):ocfs2_journal_load:1135 ERROR: Failed to load journal! [ 908.279671][T10662] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1441'. [ 908.331955][T10642] (syz.3.1436,10642,0):ocfs2_check_volume:2431 ERROR: ocfs2 journal load failed! -5 [ 908.342031][ T4354] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 908.366581][T10642] (syz.3.1436,10642,0):ocfs2_check_volume:2487 ERROR: status = -5 [ 908.400834][T10642] (syz.3.1436,10642,0):ocfs2_mount_volume:1821 ERROR: status = -5 [ 908.459711][T10642] (syz.3.1436,10642,0):ocfs2_fill_super:1176 ERROR: status = -5 [ 908.534666][ T4354] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 908.658855][ T4354] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 908.992676][ T4354] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 909.073475][ T4354] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 909.126935][ T4354] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 910.239990][ T4354] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.277751][T10677] fuse: Unknown parameter 'group_id00000000000000000000' [ 911.703938][ T4354] gud 5-1:1.0: USB-1: Failed to add TV modes (ret=-71) [ 911.720125][ T4354] gud 5-1:1.0: USB-1: Failed to add properties (ret=-71) [ 911.727640][ T4354] gud 5-1:1.0: Failed to get connectors (error=-71) [ 911.734504][ T4354] gud: probe of 5-1:1.0 failed with error -71 [ 911.754561][ T4354] usb 5-1: USB disconnect, device number 5 [ 912.564789][T10683] input: syz1 as /devices/virtual/input/input23 [ 914.260662][T10680] loop1: detected capacity change from 0 to 32768 [ 914.397432][T10680] XFS (loop1): Mounting V5 Filesystem [ 914.504237][T10680] XFS (loop1): Ending clean mount [ 914.519330][T10680] XFS (loop1): Quotacheck needed: Please wait. [ 915.512779][T10680] XFS (loop1): Quotacheck: Done. [ 915.591551][T10713] loop4: detected capacity change from 0 to 512 [ 915.774115][ T4277] XFS (loop1): Unmounting Filesystem [ 915.782244][T10713] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1453'. [ 917.618093][T10727] input: syz1 as /devices/virtual/input/input24 [ 919.017526][T10732] ip_tables: iptables: counters copy to user failed while replacing table [ 920.305234][T10738] fuse: Unknown parameter 'group_id00000000000000000000' [ 925.673569][T10773] ip_tables: iptables: counters copy to user failed while replacing table [ 926.346126][T10776] loop5: detected capacity change from 0 to 64 [ 928.676537][T10796] loop4: detected capacity change from 0 to 512 [ 928.943435][T10801] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1467'. [ 931.356542][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.362931][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.382329][T10821] loop1: detected capacity change from 0 to 512 [ 932.346146][T10833] loop4: detected capacity change from 0 to 64 [ 934.319018][T10848] loop4: detected capacity change from 0 to 512 [ 934.536782][T10850] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1486'. [ 939.103931][T10875] loop5: detected capacity change from 0 to 4096 [ 939.160099][T10875] NILFS (loop5): invalid segment: Checksum error in segment payload [ 939.220160][T10875] NILFS (loop5): trying rollback from an earlier position [ 939.289551][T10875] NILFS (loop5): recovery complete [ 939.346270][T10883] loop1: detected capacity change from 0 to 64 [ 939.429779][T10882] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 941.013216][T10892] loop3: detected capacity change from 0 to 512 [ 941.277053][T10894] vivid-002: ================= START STATUS ================= [ 941.287306][T10894] vivid-002: FM Deviation: 75000 [ 941.292984][T10894] vivid-002: ================== END STATUS ================== [ 941.343039][T10894] loop1: detected capacity change from 0 to 512 [ 941.351399][T10894] EXT4-fs: Ignoring removed bh option [ 941.357352][T10894] EXT4-fs: quotafile must be on filesystem root [ 941.427099][T10894] loop1: detected capacity change from 0 to 512 [ 941.530279][T10894] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.1499: iget: bad i_size value: 38620345925642 [ 941.545946][T10894] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1499: couldn't read orphan inode 15 (err -117) [ 941.567001][T10894] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 942.723877][T10896] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 942.866214][ T11] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 943.027747][T10904] loop5: detected capacity change from 0 to 512 [ 943.045591][ T11] EXT4-fs (loop1): This should not happen!! Data will be lost [ 943.045591][ T11] [ 943.055526][ T11] EXT4-fs (loop1): Total free blocks count 0 [ 943.061604][ T11] EXT4-fs (loop1): Free/Dirty block details [ 943.072273][ T11] EXT4-fs (loop1): free_blocks=0 [ 943.077298][ T11] EXT4-fs (loop1): dirty_blocks=3792 [ 943.082713][ T11] EXT4-fs (loop1): Block reservation details [ 943.088762][ T11] EXT4-fs (loop1): i_reserved_data_blocks=3792 [ 943.124910][ T11] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 1740 with error 28 [ 943.290397][T10909] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1500'. [ 947.236303][T10931] fuse: Bad value for 'user_id' [ 948.277869][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 948.290448][ T4286] CPU: 0 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 948.298034][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 948.308098][ T4286] Workqueue: hci4 hci_rx_work [ 948.312784][ T4286] Call Trace: [ 948.316053][ T4286] [ 948.318975][ T4286] dump_stack_lvl+0x188/0x24e [ 948.323657][ T4286] ? show_regs_print_info+0x12/0x12 [ 948.328850][ T4286] ? load_image+0x410/0x410 [ 948.333366][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 948.338486][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 948.343508][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 948.348180][ T4286] ? preempt_schedule_thunk+0x16/0x18 [ 948.353552][ T4286] kobject_add_internal+0x617/0xca0 [ 948.358751][ T4286] kobject_add+0x160/0x230 [ 948.363183][ T4286] ? kobject_init+0x1c0/0x1c0 [ 948.367861][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 948.373138][ T4286] ? klist_children_get+0x50/0x50 [ 948.378160][ T4286] ? get_device_parent+0x121/0x3e0 [ 948.383265][ T4286] device_add+0x470/0x1050 [ 948.387679][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 948.392620][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 948.397992][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 948.404225][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 948.409855][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 948.415045][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 948.420675][ T4286] ? skb_pull_data+0xec/0x1f0 [ 948.425349][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 948.430891][ T4286] hci_event_packet+0x61f/0xe60 [ 948.435739][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 948.441794][ T4286] ? bis_list+0x280/0x280 [ 948.446123][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 948.452012][ T4286] ? kcov_remote_start+0x50f/0x810 [ 948.457140][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 948.462335][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 948.467528][ T4286] hci_rx_work+0x3eb/0xd40 [ 948.471944][ T4286] ? process_one_work+0x7b4/0x1160 [ 948.477064][ T4286] process_one_work+0x8ab/0x1160 [ 948.482002][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 948.487628][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 948.492643][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 948.498183][ T4286] ? wq_worker_running+0x97/0x190 [ 948.503200][ T4286] worker_thread+0xaf5/0x12a0 [ 948.507893][ T4286] kthread+0x29d/0x330 [ 948.511953][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 948.516967][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 948.521549][ T4286] ret_from_fork+0x1f/0x30 [ 948.525970][ T4286] [ 948.541874][ T4286] kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 948.556110][ T4286] Bluetooth: hci4: failed to register connection device [ 949.074914][T10946] loop5: detected capacity change from 0 to 512 [ 949.083090][T10935] loop3: detected capacity change from 0 to 32768 [ 951.463877][ T4286] Bluetooth: hci4: command 0x2016 tx timeout [ 951.547288][T10962] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1513'. [ 954.489720][T10975] FAULT_INJECTION: forcing a failure. [ 954.489720][T10975] name failslab, interval 1, probability 0, space 0, times 0 [ 954.513543][T10975] CPU: 0 PID: 10975 Comm: syz.1.1516 Not tainted syzkaller #0 [ 954.521047][T10975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 954.531115][T10975] Call Trace: [ 954.534388][T10975] [ 954.537310][T10975] dump_stack_lvl+0x188/0x24e [ 954.541989][T10975] ? show_regs_print_info+0x12/0x12 [ 954.547182][T10975] ? load_image+0x410/0x410 [ 954.551681][T10975] ? __might_sleep+0xd0/0xd0 [ 954.556262][T10975] ? __lock_acquire+0x7ea0/0x7ea0 [ 954.561286][T10975] should_fail_ex+0x390/0x4c0 [ 954.565961][T10975] should_failslab+0x5/0x20 [ 954.570453][T10975] slab_pre_alloc_hook+0x59/0x300 [ 954.575471][T10975] ? trace_raw_output_contention_end+0xd0/0xd0 [ 954.581621][T10975] ? alloc_tty_struct+0xa3/0x780 [ 954.586635][T10975] __kmem_cache_alloc_node+0x4f/0x270 [ 954.592005][T10975] ? alloc_tty_struct+0xa3/0x780 [ 954.596932][T10975] kmalloc_trace+0x26/0xe0 [ 954.601339][T10975] alloc_tty_struct+0xa3/0x780 [ 954.606093][T10975] ? tty_open+0x204/0xd80 [ 954.610413][T10975] ? tty_init_dev+0x4c0/0x4c0 [ 954.615089][T10975] tty_init_dev+0x55/0x4c0 [ 954.619492][T10975] ? tty_open+0x7c9/0xd80 [ 954.623811][T10975] tty_open+0x7d8/0xd80 [ 954.627963][T10975] ? __lock_acquire+0x7ea0/0x7ea0 [ 954.632987][T10975] ? tty_compat_ioctl+0x5a0/0x5a0 [ 954.638000][T10975] ? memset+0x1e/0x40 [ 954.641974][T10975] ? do_raw_spin_unlock+0x11d/0x230 [ 954.647162][T10975] chrdev_open+0x585/0x5f0 [ 954.651572][T10975] ? cd_forget+0x160/0x160 [ 954.656012][T10975] ? fsnotify_perm+0x39b/0x550 [ 954.660775][T10975] ? cd_forget+0x160/0x160 [ 954.665184][T10975] do_dentry_open+0x7dd/0x10b0 [ 954.670123][T10975] path_openat+0x2674/0x2f10 [ 954.674719][T10975] ? kasan_set_track+0x60/0x70 [ 954.679487][T10975] ? verify_lock_unused+0x140/0x140 [ 954.684679][T10975] ? do_sys_openat2+0xdd/0x4f0 [ 954.689440][T10975] ? do_filp_open+0x420/0x420 [ 954.694119][T10975] do_filp_open+0x1ee/0x420 [ 954.698616][T10975] ? vfs_tmpfile+0x490/0x490 [ 954.703217][T10975] ? _raw_spin_unlock+0x24/0x40 [ 954.708068][T10975] ? alloc_fd+0x590/0x640 [ 954.712400][T10975] do_sys_openat2+0x14b/0x4f0 [ 954.717079][T10975] ? do_sys_open+0xe0/0xe0 [ 954.721514][T10975] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 954.727492][T10975] ? lock_chain_count+0x20/0x20 [ 954.732345][T10975] __x64_sys_openat+0x135/0x160 [ 954.737197][T10975] do_syscall_64+0x4c/0xa0 [ 954.741610][T10975] ? clear_bhb_loop+0x60/0xb0 [ 954.746302][T10975] ? clear_bhb_loop+0x60/0xb0 [ 954.750972][T10975] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 954.756859][T10975] RIP: 0033:0x7f2fdb76034e [ 954.761267][T10975] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 954.780866][T10975] RSP: 002b:00007f2fdc5a5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 954.789270][T10975] RAX: ffffffffffffffda RBX: 00007f2fdc5a66c0 RCX: 00007f2fdb76034e [ 954.797260][T10975] RDX: 0000000000000002 RSI: 00007f2fdc5a5c00 RDI: ffffffffffffff9c [ 954.805221][T10975] RBP: 00007f2fdb837af8 R08: 0000000000000000 R09: 0000000000000000 [ 954.813186][T10975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 954.821151][T10975] R13: 00007f2fdba26038 R14: 00007f2fdba25fa0 R15: 00007ffff8b6ba48 [ 954.829148][T10975] [ 954.839876][T10978] loop4: detected capacity change from 0 to 736 [ 954.882896][T10978] rock: directory entry would overflow storage [ 954.889970][T10978] rock: sig=0x3b10, size=4, remaining=3 [ 956.963920][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 956.974513][ T4286] CPU: 0 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 956.982082][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 956.992145][ T4286] Workqueue: hci3 hci_rx_work [ 956.996843][ T4286] Call Trace: [ 957.000125][ T4286] [ 957.003061][ T4286] dump_stack_lvl+0x188/0x24e [ 957.007770][ T4286] ? show_regs_print_info+0x12/0x12 [ 957.012983][ T4286] ? load_image+0x410/0x410 [ 957.017512][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 957.022640][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 957.027679][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 957.032364][ T4286] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 957.038365][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 957.043579][ T4286] kobject_add_internal+0x617/0xca0 [ 957.048794][ T4286] kobject_add+0x160/0x230 [ 957.053226][ T4286] ? kobject_init+0x1c0/0x1c0 [ 957.057922][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 957.063215][ T4286] ? klist_children_get+0x50/0x50 [ 957.068266][ T4286] ? get_device_parent+0x121/0x3e0 [ 957.073398][ T4286] device_add+0x470/0x1050 [ 957.077836][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 957.082790][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 957.088183][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 957.094440][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 957.099567][ T4286] ? memcpy+0x3c/0x60 [ 957.103561][ T4286] ? skb_pull_data+0xec/0x1f0 [ 957.108259][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 957.113825][ T4286] hci_event_packet+0x61f/0xe60 [ 957.118692][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 957.124766][ T4286] ? bis_list+0x280/0x280 [ 957.129105][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 957.134321][ T4286] ? hci_rx_work+0x18c/0xd40 [ 957.138925][ T4286] hci_rx_work+0x3eb/0xd40 [ 957.143366][ T4286] ? process_one_work+0x7b4/0x1160 [ 957.148491][ T4286] process_one_work+0x8ab/0x1160 [ 957.153454][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 957.159103][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 957.164140][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 957.169697][ T4286] ? wq_worker_running+0x97/0x190 [ 957.174733][ T4286] worker_thread+0xaf5/0x12a0 [ 957.179453][ T4286] kthread+0x29d/0x330 [ 957.183525][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 957.188560][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 957.193335][ T4286] ret_from_fork+0x1f/0x30 [ 957.197778][ T4286] [ 957.243996][ T4286] kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 957.267156][ T4286] Bluetooth: hci3: failed to register connection device [ 957.699213][T10989] loop3: detected capacity change from 0 to 32768 [ 957.800176][T10989] JBD2: Ignoring recovery information on journal [ 957.878294][T10989] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 958.014937][ T9840] ocfs2: Unmounting device (7,3) on (node local) [ 959.830051][ T4286] Bluetooth: hci3: command 0x2016 tx timeout [ 960.235661][T11016] loop1: detected capacity change from 0 to 512 [ 960.623882][T11019] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1531'. [ 961.128645][T11024] ip_tables: iptables: counters copy to user failed while replacing table [ 964.013776][T11031] Bluetooth: MGMT ver 1.22 [ 964.158716][T11034] loop4: detected capacity change from 0 to 8 [ 964.190204][T11035] loop5: detected capacity change from 0 to 512 [ 965.136544][T11039] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 965.264144][T11045] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1530'. [ 965.975060][ T7504] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 965.985097][ T7504] CPU: 0 PID: 7504 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 965.992664][ T7504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 966.002734][ T7504] Workqueue: hci4 hci_rx_work [ 966.007443][ T7504] Call Trace: [ 966.010724][ T7504] [ 966.013659][ T7504] dump_stack_lvl+0x188/0x24e [ 966.018360][ T7504] ? show_regs_print_info+0x12/0x12 [ 966.023573][ T7504] ? load_image+0x410/0x410 [ 966.028186][ T7504] sysfs_create_dir_ns+0x26a/0x290 [ 966.033315][ T7504] ? __lock_acquire+0x7ea0/0x7ea0 [ 966.038357][ T7504] ? sysfs_warn_dup+0xa0/0xa0 [ 966.043054][ T7504] ? do_raw_spin_unlock+0x11d/0x230 [ 966.048273][ T7504] kobject_add_internal+0x617/0xca0 [ 966.053501][ T7504] kobject_add+0x160/0x230 [ 966.057939][ T7504] ? kobject_init+0x1c0/0x1c0 [ 966.062633][ T7504] ? __raw_spin_lock_init+0x41/0x100 [ 966.067927][ T7504] ? klist_children_get+0x50/0x50 [ 966.072971][ T7504] ? get_device_parent+0x121/0x3e0 [ 966.078098][ T7504] device_add+0x470/0x1050 [ 966.082533][ T7504] hci_conn_add_sysfs+0xd1/0x1e0 [ 966.087492][ T7504] le_conn_complete_evt+0x10db/0x17c0 [ 966.092886][ T7504] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 966.099150][ T7504] ? __copy_skb_header+0x3ba/0x4f0 [ 966.104278][ T7504] ? memcpy+0x3c/0x60 [ 966.108277][ T7504] ? skb_pull_data+0xec/0x1f0 [ 966.112972][ T7504] hci_le_conn_complete_evt+0x183/0x440 [ 966.118540][ T7504] hci_event_packet+0x61f/0xe60 [ 966.123429][ T7504] ? hci_remote_host_features_evt+0x230/0x230 [ 966.129506][ T7504] ? bis_list+0x280/0x280 [ 966.133844][ T7504] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 966.139755][ T7504] ? kcov_remote_start+0x50f/0x810 [ 966.144883][ T7504] ? lockdep_hardirqs_on+0x94/0x140 [ 966.150098][ T7504] ? hci_send_to_monitor+0x9c/0x4a0 [ 966.155318][ T7504] hci_rx_work+0x3eb/0xd40 [ 966.159765][ T7504] ? process_one_work+0x7b4/0x1160 [ 966.164891][ T7504] process_one_work+0x8ab/0x1160 [ 966.169942][ T7504] ? worker_detach_from_pool+0x240/0x240 [ 966.175593][ T7504] ? _raw_spin_lock_irq+0xb7/0xf0 [ 966.180632][ T7504] ? _raw_spin_lock_irqsave+0x100/0x100 [ 966.186191][ T7504] ? wq_worker_running+0x97/0x190 [ 966.191228][ T7504] worker_thread+0xaf5/0x12a0 [ 966.195932][ T7504] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 966.201855][ T7504] kthread+0x29d/0x330 [ 966.205932][ T7504] ? worker_clr_flags+0x1a0/0x1a0 [ 966.210964][ T7504] ? kthread_blkcg+0xd0/0xd0 [ 966.215561][ T7504] ret_from_fork+0x1f/0x30 [ 966.220010][ T7504] [ 966.282235][ T7504] kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 966.297797][ T7504] Bluetooth: hci4: failed to register connection device [ 967.582656][T11064] loop4: detected capacity change from 0 to 64 [ 968.393377][ T7504] Bluetooth: hci4: command 0x2016 tx timeout [ 969.968693][T11070] loop4: detected capacity change from 0 to 256 [ 970.064942][T11070] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x204323ec, utbl_chksum : 0xe619d30d) [ 970.446600][T11080] random: crng reseeded on system resumption [ 971.603300][ T7377] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 971.825154][ T7377] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 971.859990][ T7377] usb 4-1: config 0 interface 0 has no altsetting 0 [ 971.902078][ T7377] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 971.935897][ T7377] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 971.963264][ T7377] usb 4-1: Product: syz [ 971.981386][ T7377] usb 4-1: Manufacturer: syz [ 971.997713][ T7377] usb 4-1: SerialNumber: syz [ 972.052954][ T7377] usb 4-1: config 0 descriptor?? [ 972.080665][ T7377] usb 4-1: selecting invalid altsetting 0 [ 972.280729][ T7377] usb 4-1: USB disconnect, device number 11 [ 973.199122][T11093] loop5: detected capacity change from 0 to 1024 [ 973.398729][T11093] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 974.240024][T11098] loop3: detected capacity change from 0 to 512 [ 975.362767][ T7910] EXT4-fs (loop5): unmounting filesystem. [ 975.370281][T11109] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1552'. [ 976.323080][ T4286] Bluetooth: hci5: command 0x2016 tx timeout [ 976.805105][T11119] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1548'. [ 978.281775][T11127] fuse: Bad value for 'fd' [ 979.370429][T11134] loop5: detected capacity change from 0 to 64 [ 980.971302][T11140] random: crng reseeded on system resumption [ 983.327052][T11152] loop4: detected capacity change from 0 to 2048 [ 983.602063][T11152] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 983.837695][T11158] loop3: detected capacity change from 0 to 1024 [ 983.953808][T11158] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 985.314270][ T9840] EXT4-fs (loop3): unmounting filesystem. [ 986.194912][T11177] loop3: detected capacity change from 0 to 8 [ 986.633370][ T4286] Bluetooth: hci0: command 0x2016 tx timeout [ 987.048303][T11183] loop4: detected capacity change from 0 to 512 [ 987.472220][T11135] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 988.669635][T11194] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1571'. [ 991.418217][T11208] loop3: detected capacity change from 0 to 512 [ 991.864458][T11213] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1577'. [ 992.808154][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.817191][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.112095][T11220] loop5: detected capacity change from 0 to 131072 [ 994.120498][T11220] F2FS-fs (loop5): invalid crc value [ 994.771154][T11220] F2FS-fs (loop5): Found nat_bits in checkpoint [ 994.809336][T11220] F2FS-fs (loop5): Cannot turn on quotas: -2 on 2 [ 994.843963][T11220] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 995.045051][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 995.055756][ T4286] CPU: 0 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 995.063330][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 995.073395][ T4286] Workqueue: hci1 hci_rx_work [ 995.078090][ T4286] Call Trace: [ 995.081372][ T4286] [ 995.084311][ T4286] dump_stack_lvl+0x188/0x24e [ 995.089011][ T4286] ? show_regs_print_info+0x12/0x12 [ 995.094224][ T4286] ? load_image+0x410/0x410 [ 995.098753][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 995.103880][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 995.108920][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 995.113614][ T4286] ? preempt_schedule_thunk+0x16/0x18 [ 995.119011][ T4286] kobject_add_internal+0x617/0xca0 [ 995.124227][ T4286] kobject_add+0x160/0x230 [ 995.128661][ T4286] ? kobject_init+0x1c0/0x1c0 [ 995.133365][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 995.138659][ T4286] ? klist_children_get+0x50/0x50 [ 995.143710][ T4286] ? get_device_parent+0x121/0x3e0 [ 995.148840][ T4286] device_add+0x470/0x1050 [ 995.153274][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 995.158230][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 995.163614][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 995.168834][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 995.175088][ T4286] ? __copy_skb_header+0x30f/0x4f0 [ 995.180212][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 995.185335][ T4286] ? memcpy+0x3c/0x60 [ 995.189331][ T4286] ? skb_pull_data+0xec/0x1f0 [ 995.194029][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 995.199600][ T4286] hci_event_packet+0x61f/0xe60 [ 995.204473][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 995.210549][ T4286] ? bis_list+0x280/0x280 [ 995.214889][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 995.220801][ T4286] ? kcov_remote_start+0x50f/0x810 [ 995.225924][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 995.231136][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 995.236352][ T4286] hci_rx_work+0x3eb/0xd40 [ 995.240780][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 995.245657][ T4286] ? process_one_work+0x7b4/0x1160 [ 995.250788][ T4286] process_one_work+0x8ab/0x1160 [ 995.255762][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 995.261413][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 995.266449][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 995.272006][ T4286] ? wq_worker_running+0x97/0x190 [ 995.277043][ T4286] worker_thread+0xaf5/0x12a0 [ 995.281760][ T4286] kthread+0x29d/0x330 [ 995.285835][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 995.290872][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 995.295472][ T4286] ret_from_fork+0x1f/0x30 [ 995.299919][ T4286] [ 995.346874][ T4286] kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 995.362335][ T4286] Bluetooth: hci1: failed to register connection device [ 997.433401][ T7504] Bluetooth: hci1: command 0x2016 tx timeout [ 998.554932][T11256] random: crng reseeded on system resumption [ 1001.894965][T11274] loop1: detected capacity change from 0 to 512 [ 1002.348433][T11277] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1595'. [ 1003.109385][T11282] loop4: detected capacity change from 0 to 512 [ 1003.184529][T11275] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1003.455659][T11288] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1591'. [ 1003.755881][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1003.765353][ T4286] CPU: 1 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1003.772910][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1003.782971][ T4286] Workqueue: hci1 hci_rx_work [ 1003.787668][ T4286] Call Trace: [ 1003.790952][ T4286] [ 1003.793888][ T4286] dump_stack_lvl+0x188/0x24e [ 1003.798586][ T4286] ? show_regs_print_info+0x12/0x12 [ 1003.803801][ T4286] ? load_image+0x410/0x410 [ 1003.808327][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1003.813487][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1003.818529][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1003.823225][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 1003.828435][ T4286] kobject_add_internal+0x617/0xca0 [ 1003.833658][ T4286] kobject_add+0x160/0x230 [ 1003.838095][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1003.842786][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 1003.848076][ T4286] ? klist_children_get+0x50/0x50 [ 1003.853111][ T4286] ? get_device_parent+0x121/0x3e0 [ 1003.858235][ T4286] device_add+0x470/0x1050 [ 1003.862667][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1003.867620][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1003.873013][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1003.879268][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1003.884935][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1003.890503][ T4286] hci_event_packet+0x61f/0xe60 [ 1003.895371][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1003.901445][ T4286] ? bis_list+0x280/0x280 [ 1003.905785][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1003.911693][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1003.916815][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1003.922026][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1003.927241][ T4286] hci_rx_work+0x3eb/0xd40 [ 1003.931673][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 1003.936543][ T4286] ? process_one_work+0x7b4/0x1160 [ 1003.941669][ T4286] process_one_work+0x8ab/0x1160 [ 1003.946630][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1003.952279][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1003.957318][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1003.962884][ T4286] ? wq_worker_running+0x97/0x190 [ 1003.967924][ T4286] worker_thread+0xaf5/0x12a0 [ 1003.972642][ T4286] kthread+0x29d/0x330 [ 1003.976715][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1003.981746][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1003.986347][ T4286] ret_from_fork+0x1f/0x30 [ 1003.990793][ T4286] [ 1004.058645][ T4286] kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1004.074805][ T4286] Bluetooth: hci1: failed to register connection device [ 1006.779254][ T4286] Bluetooth: hci1: command 0x2016 tx timeout [ 1007.087582][T11315] fuse: Invalid rootmode [ 1007.687144][T11320] FAULT_INJECTION: forcing a failure. [ 1007.687144][T11320] name failslab, interval 1, probability 0, space 0, times 0 [ 1007.753439][T11320] CPU: 0 PID: 11320 Comm: syz.3.1605 Not tainted syzkaller #0 [ 1007.760950][T11320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1007.771023][T11320] Call Trace: [ 1007.774318][T11320] [ 1007.777258][T11320] dump_stack_lvl+0x188/0x24e [ 1007.781959][T11320] ? show_regs_print_info+0x12/0x12 [ 1007.787185][T11320] ? load_image+0x410/0x410 [ 1007.791705][T11320] ? __lock_acquire+0x7ea0/0x7ea0 [ 1007.796761][T11320] should_fail_ex+0x390/0x4c0 [ 1007.801456][T11320] should_failslab+0x5/0x20 [ 1007.805970][T11320] slab_pre_alloc_hook+0x59/0x300 [ 1007.811011][T11320] ? do_dentry_open+0x7dd/0x10b0 [ 1007.815964][T11320] ? path_openat+0x2674/0x2f10 [ 1007.820746][T11320] ? do_filp_open+0x1ee/0x420 [ 1007.825442][T11320] kmem_cache_alloc_node+0x5a/0x310 [ 1007.830657][T11320] ? alloc_vmap_area+0x194/0x1b10 [ 1007.835703][T11320] alloc_vmap_area+0x194/0x1b10 [ 1007.840593][T11320] ? vm_map_ram+0xab0/0xab0 [ 1007.845130][T11320] ? rcu_is_watching+0x11/0xa0 [ 1007.850032][T11320] __get_vm_area_node+0x158/0x330 [ 1007.855080][T11320] __vmalloc_node_range+0x357/0x1380 [ 1007.860382][T11320] ? n_tty_open+0x19/0x150 [ 1007.864816][T11320] ? lockdep_hardirqs_on+0x94/0x140 [ 1007.870043][T11320] ? free_vm_area+0x50/0x50 [ 1007.874563][T11320] ? __might_sleep+0xd0/0xd0 [ 1007.879167][T11320] ? n_tty_open+0x19/0x150 [ 1007.883600][T11320] vzalloc+0x75/0x80 [ 1007.887513][T11320] ? n_tty_open+0x19/0x150 [ 1007.891941][T11320] n_tty_open+0x19/0x150 [ 1007.896207][T11320] tty_ldisc_setup+0xbf/0x250 [ 1007.900921][T11320] tty_init_dev+0x274/0x4c0 [ 1007.905452][T11320] tty_open+0x7d8/0xd80 [ 1007.909631][T11320] ? __lock_acquire+0x7ea0/0x7ea0 [ 1007.914681][T11320] ? tty_compat_ioctl+0x5a0/0x5a0 [ 1007.919717][T11320] ? memset+0x1e/0x40 [ 1007.923715][T11320] ? do_raw_spin_unlock+0x11d/0x230 [ 1007.928931][T11320] chrdev_open+0x585/0x5f0 [ 1007.933374][T11320] ? cd_forget+0x160/0x160 [ 1007.937809][T11320] ? fsnotify_perm+0x39b/0x550 [ 1007.942594][T11320] ? cd_forget+0x160/0x160 [ 1007.947023][T11320] do_dentry_open+0x7dd/0x10b0 [ 1007.951823][T11320] path_openat+0x2674/0x2f10 [ 1007.956448][T11320] ? kasan_set_track+0x60/0x70 [ 1007.961250][T11320] ? verify_lock_unused+0x140/0x140 [ 1007.966470][T11320] ? do_sys_openat2+0xdd/0x4f0 [ 1007.971259][T11320] ? do_filp_open+0x420/0x420 [ 1007.975979][T11320] do_filp_open+0x1ee/0x420 [ 1007.980500][T11320] ? vfs_tmpfile+0x490/0x490 [ 1007.985128][T11320] ? _raw_spin_unlock+0x24/0x40 [ 1007.989999][T11320] ? alloc_fd+0x590/0x640 [ 1007.994359][T11320] do_sys_openat2+0x14b/0x4f0 [ 1007.999061][T11320] ? do_sys_open+0xe0/0xe0 [ 1008.003497][T11320] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1008.009495][T11320] ? lock_chain_count+0x20/0x20 [ 1008.014370][T11320] __x64_sys_openat+0x135/0x160 [ 1008.019252][T11320] do_syscall_64+0x4c/0xa0 [ 1008.023683][T11320] ? clear_bhb_loop+0x60/0xb0 [ 1008.028372][T11320] ? clear_bhb_loop+0x60/0xb0 [ 1008.033067][T11320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1008.038990][T11320] RIP: 0033:0x7f456bb6034e [ 1008.043419][T11320] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1008.063042][T11320] RSP: 002b:00007f456c9e3b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1008.071477][T11320] RAX: ffffffffffffffda RBX: 00007f456c9e46c0 RCX: 00007f456bb6034e [ 1008.079469][T11320] RDX: 0000000000000002 RSI: 00007f456c9e3c00 RDI: ffffffffffffff9c [ 1008.087453][T11320] RBP: 00007f456bc37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1008.095438][T11320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1008.103420][T11320] R13: 00007f456be26038 R14: 00007f456be25fa0 R15: 00007fff888c4608 [ 1008.111417][T11320] [ 1008.283899][T11320] syz.3.1605: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 1008.324438][T11320] CPU: 1 PID: 11320 Comm: syz.3.1605 Not tainted syzkaller #0 [ 1008.331940][T11320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1008.342006][T11320] Call Trace: [ 1008.345291][T11320] [ 1008.348234][T11320] dump_stack_lvl+0x188/0x24e [ 1008.352938][T11320] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 1008.359373][T11320] ? show_regs_print_info+0x12/0x12 [ 1008.364597][T11320] ? load_image+0x410/0x410 [ 1008.369125][T11320] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 1008.375557][T11320] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 1008.382073][T11320] warn_alloc+0x242/0x330 [ 1008.386418][T11320] ? slab_free_freelist_hook+0x133/0x1b0 [ 1008.392092][T11320] ? zone_watermark_ok_safe+0x270/0x270 [ 1008.397637][T11320] ? __get_vm_area_node+0x16d/0x330 [ 1008.402833][T11320] ? __get_vm_area_node+0x16d/0x330 [ 1008.408027][T11320] __vmalloc_node_range+0x37c/0x1380 [ 1008.413311][T11320] ? lockdep_hardirqs_on+0x94/0x140 [ 1008.418533][T11320] ? free_vm_area+0x50/0x50 [ 1008.423045][T11320] ? __might_sleep+0xd0/0xd0 [ 1008.427653][T11320] ? n_tty_open+0x19/0x150 [ 1008.432071][T11320] vzalloc+0x75/0x80 [ 1008.435965][T11320] ? n_tty_open+0x19/0x150 [ 1008.440378][T11320] n_tty_open+0x19/0x150 [ 1008.444624][T11320] tty_ldisc_setup+0xbf/0x250 [ 1008.449319][T11320] tty_init_dev+0x274/0x4c0 [ 1008.453828][T11320] tty_open+0x7d8/0xd80 [ 1008.457987][T11320] ? __lock_acquire+0x7ea0/0x7ea0 [ 1008.463015][T11320] ? tty_compat_ioctl+0x5a0/0x5a0 [ 1008.468037][T11320] ? memset+0x1e/0x40 [ 1008.472014][T11320] ? do_raw_spin_unlock+0x11d/0x230 [ 1008.477211][T11320] chrdev_open+0x585/0x5f0 [ 1008.481628][T11320] ? cd_forget+0x160/0x160 [ 1008.486038][T11320] ? fsnotify_perm+0x39b/0x550 [ 1008.490798][T11320] ? cd_forget+0x160/0x160 [ 1008.495208][T11320] do_dentry_open+0x7dd/0x10b0 [ 1008.499979][T11320] path_openat+0x2674/0x2f10 [ 1008.504574][T11320] ? kasan_set_track+0x60/0x70 [ 1008.509331][T11320] ? verify_lock_unused+0x140/0x140 [ 1008.514523][T11320] ? do_sys_openat2+0xdd/0x4f0 [ 1008.519283][T11320] ? do_filp_open+0x420/0x420 [ 1008.523966][T11320] do_filp_open+0x1ee/0x420 [ 1008.528465][T11320] ? vfs_tmpfile+0x490/0x490 [ 1008.533061][T11320] ? _raw_spin_unlock+0x24/0x40 [ 1008.537902][T11320] ? alloc_fd+0x590/0x640 [ 1008.542239][T11320] do_sys_openat2+0x14b/0x4f0 [ 1008.546921][T11320] ? do_sys_open+0xe0/0xe0 [ 1008.551333][T11320] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1008.557307][T11320] ? lock_chain_count+0x20/0x20 [ 1008.562154][T11320] __x64_sys_openat+0x135/0x160 [ 1008.567001][T11320] do_syscall_64+0x4c/0xa0 [ 1008.571419][T11320] ? clear_bhb_loop+0x60/0xb0 [ 1008.576089][T11320] ? clear_bhb_loop+0x60/0xb0 [ 1008.580759][T11320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1008.586641][T11320] RIP: 0033:0x7f456bb6034e [ 1008.591045][T11320] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1008.610639][T11320] RSP: 002b:00007f456c9e3b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1008.619042][T11320] RAX: ffffffffffffffda RBX: 00007f456c9e46c0 RCX: 00007f456bb6034e [ 1008.627005][T11320] RDX: 0000000000000002 RSI: 00007f456c9e3c00 RDI: ffffffffffffff9c [ 1008.634966][T11320] RBP: 00007f456bc37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1008.642924][T11320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1008.650883][T11320] R13: 00007f456be26038 R14: 00007f456be25fa0 R15: 00007fff888c4608 [ 1008.658861][T11320] [ 1008.880135][T11320] Mem-Info: [ 1008.884237][T11320] active_anon:14619 inactive_anon:10613 isolated_anon:0 [ 1008.884237][T11320] active_file:21118 inactive_file:40324 isolated_file:0 [ 1008.884237][T11320] unevictable:768 dirty:184 writeback:0 [ 1008.884237][T11320] slab_reclaimable:18590 slab_unreclaimable:97137 [ 1008.884237][T11320] mapped:33328 shmem:20132 pagetables:838 [ 1008.884237][T11320] sec_pagetables:0 bounce:0 [ 1008.884237][T11320] kernel_misc_reclaimable:0 [ 1008.884237][T11320] free:1290945 free_pcp:10400 free_cma:0 [ 1009.161970][T11328] loop1: detected capacity change from 0 to 32768 [ 1009.169159][T11328] XFS: ikeep mount option is deprecated. [ 1009.192109][T11320] Node 0 active_anon:69776kB inactive_anon:42452kB active_file:84472kB inactive_file:161092kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:139712kB dirty:736kB writeback:0kB shmem:89892kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11772kB pagetables:3352kB sec_pagetables:0kB all_unreclaimable? no [ 1009.241417][T11320] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1009.337879][T11328] XFS (loop1): DAX unsupported by block device. Turning off DAX. [ 1009.346469][T11328] XFS (loop1): Mounting V5 Filesystem [ 1009.400275][T11320] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1009.472706][T11328] XFS (loop1): Ending clean mount [ 1009.479694][T11328] XFS (loop1): Quotacheck needed: Please wait. [ 1009.516209][ T7377] XFS (loop1): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1009.528206][T11320] lowmem_reserve[]: 0 2509 2510 2510 2510 [ 1009.534384][T11320] Node 0 DMA32 free:1226920kB boost:0kB min:34540kB low:43172kB high:51804kB reserved_highatomic:0KB active_anon:66032kB inactive_anon:42452kB active_file:84472kB inactive_file:161392kB unevictable:1536kB writepending:736kB present:3129332kB managed:2574604kB mlocked:0kB bounce:0kB free_pcp:32536kB local_pcp:13980kB free_cma:0kB [ 1009.551576][ T7377] XFS (loop1): Unmount and run xfs_repair [ 1009.572849][ T7377] XFS (loop1): First 128 bytes of corrupted metadata buffer: [ 1009.586054][ T7377] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1009.597037][ T7377] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1009.611754][T11320] lowmem_reserve[]: 0 0 1 1 1 [ 1009.612164][ T7377] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1009.625430][T11320] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:1424kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1009.625520][T11320] lowmem_reserve[]: 0 0 0 0 0 [ 1009.664813][T11320] Node 1 Normal free:3900408kB boost:0kB min:55344kB low:69180kB high:83016kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:20280kB local_pcp:8452kB free_cma:0kB [ 1009.698056][T11320] lowmem_reserve[]: 0 0 0 0 0 [ 1009.702895][T11320] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1009.703409][ T7377] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1009.724563][T11320] Node 0 DMA32: 155*4kB (UME) 572*8kB (UME) 1196*16kB (UME) 1065*32kB (UME) 578*64kB (UME) 410*128kB (UME) 316*256kB (UME) 169*512kB (UME) 88*1024kB (UME) 25*2048kB (UM) 187*4096kB (UM) = 1222572kB [ 1009.743188][ T7377] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1009.749930][T11320] Node 0 [ 1009.752925][ T7377] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1009.752942][ T7377] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1009.752953][ T7377] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1009.775190][T11320] Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1009.795976][T11320] Node 1 Normal: 182*4kB (UME) 22*8kB (UME) 35*16kB (UME) 28*32kB (UE) 15*64kB (UME) 10*128kB (UME) 2*256kB (UM) 2*512kB (ME) 1*1024kB (E) 1*2048kB (E) 950*4096kB (M) = 3900408kB [ 1009.814419][T11320] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1009.824591][T11320] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1009.830997][ T4405] XFS (loop1): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1009.835311][T11320] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1009.861341][T11320] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1009.871786][T11328] XFS (loop1): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1009.916524][T11328] syz.1.1606 (11328): drop_caches: 2 [ 1009.945131][T11320] 85465 total pagecache pages [ 1009.970102][T11320] 4 pages in swap cache [ 1009.974586][T11320] Free swap = 99496kB [ 1010.615023][T11320] Total swap = 124996kB [ 1010.620017][T11320] 2097051 pages RAM [ 1010.632188][T11320] 0 pages HighMem/MovableOnly [ 1010.632499][ T4277] XFS (loop1): Unmounting Filesystem [ 1010.637052][T11320] 419799 pages reserved [ 1010.648533][T11320] 0 pages cma reserved [ 1010.652885][T11320] tty tty1: ldisc open failed (-12), clearing slot 0 [ 1010.661731][T11345] ttyS ttyS3: ldisc open failed (-12), clearing slot 3 [ 1010.745483][T11355] loop3: detected capacity change from 0 to 8 [ 1012.545274][T11358] loop4: detected capacity change from 0 to 1024 [ 1013.873531][T11358] EXT4-fs: error -4 creating inode table initialization thread [ 1013.923736][T11358] EXT4-fs (loop4): mount failed [ 1015.481780][T11378] vivid-008: ================= START STATUS ================= [ 1015.489877][T11378] vivid-008: FM Deviation: 75000 [ 1015.495453][T11378] vivid-008: ================== END STATUS ================== [ 1015.539356][T11378] loop4: detected capacity change from 0 to 512 [ 1015.550211][T11378] EXT4-fs: Ignoring removed bh option [ 1015.555988][T11378] EXT4-fs: quotafile must be on filesystem root [ 1016.657974][T11383] loop4: detected capacity change from 0 to 64 [ 1019.318675][T11393] loop4: detected capacity change from 0 to 32768 [ 1019.325702][T11393] XFS: ikeep mount option is deprecated. [ 1019.829301][T11401] loop1: detected capacity change from 0 to 512 [ 1019.841206][T11393] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 1019.849763][T11393] XFS (loop4): Mounting V5 Filesystem [ 1020.143492][T11393] XFS (loop4): Ending clean mount [ 1020.150450][T11393] XFS (loop4): Quotacheck needed: Please wait. [ 1020.168579][T10092] XFS (loop4): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1020.180077][T11411] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1617'. [ 1020.237717][T10092] XFS (loop4): Unmount and run xfs_repair [ 1020.273655][T10092] XFS (loop4): First 128 bytes of corrupted metadata buffer: [ 1020.353293][T10092] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1020.362193][T10092] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1020.443287][T10092] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1020.513272][T10092] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1020.547443][T10092] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1020.593859][T10092] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1020.622619][T10092] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1020.681953][T10092] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1020.730441][ T7525] XFS (loop4): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1020.827319][T11393] XFS (loop4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1020.862064][T11391] syz.4.1620 (11391): drop_caches: 2 [ 1021.096522][ T4285] XFS (loop4): Unmounting Filesystem [ 1022.056645][T11424] FAULT_INJECTION: forcing a failure. [ 1022.056645][T11424] name failslab, interval 1, probability 0, space 0, times 0 [ 1022.070593][T11424] CPU: 0 PID: 11424 Comm: syz.5.1621 Not tainted syzkaller #0 [ 1022.078083][T11424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1022.088151][T11424] Call Trace: [ 1022.091435][T11424] [ 1022.094374][T11424] dump_stack_lvl+0x188/0x24e [ 1022.099071][T11424] ? show_regs_print_info+0x12/0x12 [ 1022.104290][T11424] ? load_image+0x410/0x410 [ 1022.108809][T11424] ? __lock_acquire+0x7ea0/0x7ea0 [ 1022.113858][T11424] should_fail_ex+0x390/0x4c0 [ 1022.118552][T11424] should_failslab+0x5/0x20 [ 1022.123062][T11424] slab_pre_alloc_hook+0x59/0x300 [ 1022.128094][T11424] ? do_dentry_open+0x7dd/0x10b0 [ 1022.133037][T11424] ? path_openat+0x2674/0x2f10 [ 1022.137792][T11424] ? do_filp_open+0x1ee/0x420 [ 1022.142461][T11424] kmem_cache_alloc_node+0x5a/0x310 [ 1022.147652][T11424] ? alloc_vmap_area+0x194/0x1b10 [ 1022.152675][T11424] alloc_vmap_area+0x194/0x1b10 [ 1022.157534][T11424] ? vm_map_ram+0xab0/0xab0 [ 1022.162030][T11424] ? rcu_is_watching+0x11/0xa0 [ 1022.166796][T11424] __get_vm_area_node+0x158/0x330 [ 1022.171818][T11424] __vmalloc_node_range+0x357/0x1380 [ 1022.177095][T11424] ? n_tty_open+0x19/0x150 [ 1022.181521][T11424] ? lockdep_hardirqs_on+0x94/0x140 [ 1022.186724][T11424] ? free_vm_area+0x50/0x50 [ 1022.191221][T11424] ? __might_sleep+0xd0/0xd0 [ 1022.195809][T11424] ? n_tty_open+0x19/0x150 [ 1022.200217][T11424] vzalloc+0x75/0x80 [ 1022.204105][T11424] ? n_tty_open+0x19/0x150 [ 1022.208518][T11424] n_tty_open+0x19/0x150 [ 1022.212751][T11424] tty_ldisc_setup+0xbf/0x250 [ 1022.217422][T11424] tty_init_dev+0x274/0x4c0 [ 1022.221915][T11424] tty_open+0x7d8/0xd80 [ 1022.226074][T11424] ? __lock_acquire+0x7ea0/0x7ea0 [ 1022.231103][T11424] ? tty_compat_ioctl+0x5a0/0x5a0 [ 1022.236127][T11424] ? memset+0x1e/0x40 [ 1022.240100][T11424] ? do_raw_spin_unlock+0x11d/0x230 [ 1022.245298][T11424] chrdev_open+0x585/0x5f0 [ 1022.249712][T11424] ? cd_forget+0x160/0x160 [ 1022.254129][T11424] ? fsnotify_perm+0x39b/0x550 [ 1022.258892][T11424] ? cd_forget+0x160/0x160 [ 1022.263302][T11424] do_dentry_open+0x7dd/0x10b0 [ 1022.268069][T11424] path_openat+0x2674/0x2f10 [ 1022.272663][T11424] ? kasan_set_track+0x60/0x70 [ 1022.277424][T11424] ? verify_lock_unused+0x140/0x140 [ 1022.282617][T11424] ? do_sys_openat2+0xdd/0x4f0 [ 1022.287380][T11424] ? do_filp_open+0x420/0x420 [ 1022.292059][T11424] do_filp_open+0x1ee/0x420 [ 1022.296563][T11424] ? vfs_tmpfile+0x490/0x490 [ 1022.301164][T11424] ? _raw_spin_unlock+0x24/0x40 [ 1022.306024][T11424] ? alloc_fd+0x590/0x640 [ 1022.310354][T11424] do_sys_openat2+0x14b/0x4f0 [ 1022.315030][T11424] ? do_sys_open+0xe0/0xe0 [ 1022.319440][T11424] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1022.325417][T11424] ? lock_chain_count+0x20/0x20 [ 1022.330264][T11424] __x64_sys_openat+0x135/0x160 [ 1022.335116][T11424] do_syscall_64+0x4c/0xa0 [ 1022.339526][T11424] ? clear_bhb_loop+0x60/0xb0 [ 1022.344201][T11424] ? clear_bhb_loop+0x60/0xb0 [ 1022.348871][T11424] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1022.354757][T11424] RIP: 0033:0x7f1264d6034e [ 1022.359165][T11424] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1022.378764][T11424] RSP: 002b:00007f1265bbeb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1022.387180][T11424] RAX: ffffffffffffffda RBX: 00007f1265bbf6c0 RCX: 00007f1264d6034e [ 1022.395142][T11424] RDX: 0000000000000002 RSI: 00007f1265bbec00 RDI: ffffffffffffff9c [ 1022.403105][T11424] RBP: 00007f1264e37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1022.411152][T11424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.419115][T11424] R13: 00007f1265026038 R14: 00007f1265025fa0 R15: 00007ffc876c2178 [ 1022.427090][T11424] [ 1022.435253][T11424] syz.5.1621: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz5,mems_allowed=0-1 [ 1022.450718][T11424] CPU: 1 PID: 11424 Comm: syz.5.1621 Not tainted syzkaller #0 [ 1022.458237][T11424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1022.468304][T11424] Call Trace: [ 1022.471616][T11424] [ 1022.474557][T11424] dump_stack_lvl+0x188/0x24e [ 1022.479268][T11424] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 1022.485688][T11424] ? show_regs_print_info+0x12/0x12 [ 1022.490899][T11424] ? load_image+0x410/0x410 [ 1022.495399][T11424] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 1022.501808][T11424] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 1022.508303][T11424] warn_alloc+0x242/0x330 [ 1022.512631][T11424] ? slab_free_freelist_hook+0x133/0x1b0 [ 1022.518261][T11424] ? zone_watermark_ok_safe+0x270/0x270 [ 1022.523803][T11424] ? __get_vm_area_node+0x16d/0x330 [ 1022.528999][T11424] ? __get_vm_area_node+0x16d/0x330 [ 1022.534197][T11424] __vmalloc_node_range+0x37c/0x1380 [ 1022.539478][T11424] ? lockdep_hardirqs_on+0x94/0x140 [ 1022.544680][T11424] ? free_vm_area+0x50/0x50 [ 1022.549176][T11424] ? __might_sleep+0xd0/0xd0 [ 1022.553767][T11424] ? n_tty_open+0x19/0x150 [ 1022.558172][T11424] vzalloc+0x75/0x80 [ 1022.562060][T11424] ? n_tty_open+0x19/0x150 [ 1022.566468][T11424] n_tty_open+0x19/0x150 [ 1022.570702][T11424] tty_ldisc_setup+0xbf/0x250 [ 1022.575376][T11424] tty_init_dev+0x274/0x4c0 [ 1022.579874][T11424] tty_open+0x7d8/0xd80 [ 1022.584024][T11424] ? __lock_acquire+0x7ea0/0x7ea0 [ 1022.589047][T11424] ? tty_compat_ioctl+0x5a0/0x5a0 [ 1022.594060][T11424] ? memset+0x1e/0x40 [ 1022.598035][T11424] ? do_raw_spin_unlock+0x11d/0x230 [ 1022.603225][T11424] chrdev_open+0x585/0x5f0 [ 1022.607637][T11424] ? cd_forget+0x160/0x160 [ 1022.612046][T11424] ? fsnotify_perm+0x39b/0x550 [ 1022.616807][T11424] ? cd_forget+0x160/0x160 [ 1022.621213][T11424] do_dentry_open+0x7dd/0x10b0 [ 1022.625980][T11424] path_openat+0x2674/0x2f10 [ 1022.630572][T11424] ? kasan_set_track+0x60/0x70 [ 1022.635338][T11424] ? verify_lock_unused+0x140/0x140 [ 1022.640526][T11424] ? do_sys_openat2+0xdd/0x4f0 [ 1022.645286][T11424] ? do_filp_open+0x420/0x420 [ 1022.649970][T11424] do_filp_open+0x1ee/0x420 [ 1022.654471][T11424] ? vfs_tmpfile+0x490/0x490 [ 1022.659072][T11424] ? _raw_spin_unlock+0x24/0x40 [ 1022.663918][T11424] ? alloc_fd+0x590/0x640 [ 1022.668247][T11424] do_sys_openat2+0x14b/0x4f0 [ 1022.672924][T11424] ? do_sys_open+0xe0/0xe0 [ 1022.677336][T11424] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1022.683313][T11424] ? lock_chain_count+0x20/0x20 [ 1022.688161][T11424] __x64_sys_openat+0x135/0x160 [ 1022.693011][T11424] do_syscall_64+0x4c/0xa0 [ 1022.697440][T11424] ? clear_bhb_loop+0x60/0xb0 [ 1022.702128][T11424] ? clear_bhb_loop+0x60/0xb0 [ 1022.706798][T11424] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1022.712769][T11424] RIP: 0033:0x7f1264d6034e [ 1022.717175][T11424] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1022.736768][T11424] RSP: 002b:00007f1265bbeb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1022.745257][T11424] RAX: ffffffffffffffda RBX: 00007f1265bbf6c0 RCX: 00007f1264d6034e [ 1022.753219][T11424] RDX: 0000000000000002 RSI: 00007f1265bbec00 RDI: ffffffffffffff9c [ 1022.761180][T11424] RBP: 00007f1264e37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1022.769142][T11424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.777104][T11424] R13: 00007f1265026038 R14: 00007f1265025fa0 R15: 00007ffc876c2178 [ 1022.785080][T11424] [ 1022.987928][T11424] Mem-Info: [ 1022.991100][T11424] active_anon:22407 inactive_anon:10613 isolated_anon:0 [ 1022.991100][T11424] active_file:21118 inactive_file:40338 isolated_file:0 [ 1022.991100][T11424] unevictable:768 dirty:100 writeback:0 [ 1022.991100][T11424] slab_reclaimable:18531 slab_unreclaimable:97535 [ 1022.991100][T11424] mapped:32635 shmem:27824 pagetables:862 [ 1022.991100][T11424] sec_pagetables:0 bounce:0 [ 1022.991100][T11424] kernel_misc_reclaimable:0 [ 1022.991100][T11424] free:1282424 free_pcp:9794 free_cma:0 [ 1024.105628][T11424] Node 0 active_anon:174768kB inactive_anon:42452kB active_file:84472kB inactive_file:161108kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:142036kB dirty:308kB writeback:100kB shmem:194796kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11632kB pagetables:3396kB sec_pagetables:0kB all_unreclaimable? no [ 1024.173364][T11424] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1024.233479][T11424] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1024.308739][T11424] lowmem_reserve[]: 0 2509 2510 2510 2510 [ 1024.468980][T11424] Node 0 DMA32 free:1142664kB boost:0kB min:34540kB low:43172kB high:51804kB reserved_highatomic:0KB active_anon:138568kB inactive_anon:42452kB active_file:84472kB inactive_file:161108kB unevictable:1536kB writepending:308kB present:3129332kB managed:2574604kB mlocked:0kB bounce:0kB free_pcp:40684kB local_pcp:21540kB free_cma:0kB [ 1024.526438][T11435] loop1: detected capacity change from 0 to 1024 [ 1024.569750][T11424] lowmem_reserve[]: 0 0 1 1 1 [ 1024.601239][T11424] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:1424kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1024.668895][T11435] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 1024.686962][T11424] lowmem_reserve[]: 0 0 0 0 0 [ 1026.036628][T11424] Node 1 Normal free:3900408kB boost:0kB min:55344kB low:69180kB high:83016kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:20280kB local_pcp:8452kB free_cma:0kB [ 1026.068383][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1026.077726][ T4286] CPU: 1 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1026.085286][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1026.095355][ T4286] Workqueue: hci3 hci_rx_work [ 1026.100054][ T4286] Call Trace: [ 1026.103349][ T4286] [ 1026.106301][ T4286] dump_stack_lvl+0x188/0x24e [ 1026.111005][ T4286] ? show_regs_print_info+0x12/0x12 [ 1026.116228][ T4286] ? load_image+0x410/0x410 [ 1026.120766][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1026.125901][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1026.127826][T11424] lowmem_reserve[]: [ 1026.130942][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1026.139112][T11424] 0 [ 1026.139443][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 1026.147171][ T4286] kobject_add_internal+0x617/0xca0 [ 1026.152420][ T4286] kobject_add+0x160/0x230 [ 1026.156846][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1026.161529][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 1026.166810][ T4286] ? klist_children_get+0x50/0x50 [ 1026.171838][ T4286] ? get_device_parent+0x121/0x3e0 [ 1026.176957][ T4286] device_add+0x470/0x1050 [ 1026.181373][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1026.186314][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1026.191693][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1026.197931][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 1026.203040][ T4286] ? memcpy+0x3c/0x60 [ 1026.207017][ T4286] ? skb_pull_data+0xec/0x1f0 [ 1026.211692][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1026.217248][ T4286] hci_event_packet+0x61f/0xe60 [ 1026.222099][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1026.228153][ T4286] ? bis_list+0x280/0x280 [ 1026.232480][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1026.238370][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1026.243474][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1026.248663][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1026.253858][ T4286] hci_rx_work+0x3eb/0xd40 [ 1026.258272][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 1026.263120][ T4286] ? process_one_work+0x7b4/0x1160 [ 1026.268233][ T4286] process_one_work+0x8ab/0x1160 [ 1026.273177][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1026.278806][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1026.283824][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1026.289364][ T4286] ? wq_worker_running+0x97/0x190 [ 1026.294380][ T4286] worker_thread+0xaf5/0x12a0 [ 1026.299071][ T4286] kthread+0x29d/0x330 [ 1026.303130][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1026.308153][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1026.312738][ T4286] ret_from_fork+0x1f/0x30 [ 1026.317161][ T4286] [ 1026.370276][ T4286] kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1026.383805][ T4286] Bluetooth: hci3: failed to register connection device [ 1026.384758][ T4277] EXT4-fs (loop1): unmounting filesystem. [ 1026.393830][T11424] 0 0 0 0 [ 1026.399623][T11424] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1026.412401][T11424] Node 0 DMA32: 207*4kB (UME) 1183*8kB (UME) 403*16kB (UME) 268*32kB (UME) 128*64kB (UME) 38*128kB (UE) 221*256kB (UME) 161*512kB (UME) 89*1024kB (UME) 29*2048kB (UM) 187*4096kB (UM) = 1093860kB [ 1026.431724][T11424] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1026.443642][T11424] Node 1 Normal: 182*4kB (UME) 22*8kB (UME) 35*16kB (UME) 28*32kB (UE) 15*64kB (UME) 10*128kB (UME) 2*256kB (UM) 2*512kB (ME) 1*1024kB (E) 1*2048kB (E) 950*4096kB (M) = 3900408kB [ 1026.461597][T11424] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1026.473409][T11424] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1026.483195][T11424] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1026.492768][T11424] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1026.508697][T11424] 116626 total pagecache pages [ 1026.522789][T11424] 4 pages in swap cache [ 1026.528114][T11424] Free swap = 99496kB [ 1026.532211][T11424] Total swap = 124996kB [ 1026.540577][T11424] 2097051 pages RAM [ 1026.546024][T11424] 0 pages HighMem/MovableOnly [ 1026.550799][T11424] 419799 pages reserved [ 1026.559681][T11424] 0 pages cma reserved [ 1026.566612][T11424] tty tty1: ldisc open failed (-12), clearing slot 0 [ 1026.578471][T11427] ttyS ttyS3: ldisc open failed (-12), clearing slot 3 [ 1027.997633][T11460] loop5: detected capacity change from 0 to 2048 [ 1028.029317][T11460] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 1029.371021][ T4286] Bluetooth: hci3: command 0x2016 tx timeout [ 1030.300866][T11475] loop3: detected capacity change from 0 to 8 [ 1031.401699][T11480] loop4: detected capacity change from 0 to 1024 [ 1031.405465][T11482] random: crng reseeded on system resumption [ 1031.519906][T11480] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 1032.472543][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 1032.482341][ T4286] CPU: 1 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1032.489908][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1032.499970][ T4286] Workqueue: hci4 hci_rx_work [ 1032.504671][ T4286] Call Trace: [ 1032.507965][ T4286] [ 1032.510902][ T4286] dump_stack_lvl+0x188/0x24e [ 1032.515600][ T4286] ? show_regs_print_info+0x12/0x12 [ 1032.520987][ T4286] ? load_image+0x410/0x410 [ 1032.525515][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1032.530641][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1032.535691][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1032.540390][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 1032.545604][ T4286] kobject_add_internal+0x617/0xca0 [ 1032.550819][ T4286] kobject_add+0x160/0x230 [ 1032.555253][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1032.559942][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 1032.565233][ T4286] ? klist_children_get+0x50/0x50 [ 1032.570270][ T4286] ? get_device_parent+0x121/0x3e0 [ 1032.575398][ T4286] device_add+0x470/0x1050 [ 1032.579833][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1032.584792][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1032.590187][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1032.596448][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1032.602094][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1032.607306][ T4286] ? skb_pull_data+0xec/0x1f0 [ 1032.612005][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1032.617573][ T4286] hci_event_packet+0x61f/0xe60 [ 1032.622446][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1032.628526][ T4286] ? bis_list+0x280/0x280 [ 1032.632867][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1032.638776][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1032.643900][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1032.649111][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1032.654344][ T4286] hci_rx_work+0x3eb/0xd40 [ 1032.658781][ T4286] ? process_one_work+0x7b4/0x1160 [ 1032.663907][ T4286] process_one_work+0x8ab/0x1160 [ 1032.668868][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1032.674521][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1032.679556][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1032.685115][ T4286] ? wq_worker_running+0x97/0x190 [ 1032.690150][ T4286] worker_thread+0xaf5/0x12a0 [ 1032.694867][ T4286] kthread+0x29d/0x330 [ 1032.698941][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1032.703976][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1032.708582][ T4286] ret_from_fork+0x1f/0x30 [ 1032.713027][ T4286] [ 1032.855495][ T4286] kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1032.869640][ T4286] Bluetooth: hci4: failed to register connection device [ 1032.894807][T11493] vivid-002: ================= START STATUS ================= [ 1032.902599][T11493] vivid-002: FM Deviation: 75000 [ 1032.907726][T11493] vivid-002: ================== END STATUS ================== [ 1032.949466][T11493] loop1: detected capacity change from 0 to 512 [ 1032.957748][T11493] EXT4-fs: Ignoring removed bh option [ 1032.963415][T11493] EXT4-fs: quotafile must be on filesystem root [ 1033.770921][ T4285] EXT4-fs (loop4): unmounting filesystem. [ 1035.129781][ T4286] Bluetooth: hci4: command 0x2016 tx timeout [ 1035.884575][T11506] loop5: detected capacity change from 0 to 32768 [ 1035.891465][T11506] XFS: ikeep mount option is deprecated. [ 1036.571531][T11506] XFS (loop5): DAX unsupported by block device. Turning off DAX. [ 1036.581882][T11506] XFS (loop5): Mounting V5 Filesystem [ 1036.639951][T11506] XFS (loop5): Ending clean mount [ 1036.649686][T11506] XFS (loop5): Quotacheck needed: Please wait. [ 1036.662852][ T5080] XFS (loop5): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1036.674642][ T5080] XFS (loop5): Unmount and run xfs_repair [ 1036.680356][ T5080] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 1036.690346][ T5080] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1036.699492][ T5080] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1036.709343][ T5080] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1036.718784][ T5080] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1036.727906][ T5080] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1036.737027][ T5080] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1036.746331][ T5080] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1036.755520][ T5080] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1036.773196][ T9793] XFS (loop5): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1036.828507][T11506] XFS (loop5): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1036.859112][T11506] syz.5.1635 (11506): drop_caches: 2 [ 1037.071778][T11522] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1638'. [ 1037.650351][T11525] ip_tables: iptables: counters copy to user failed while replacing table [ 1038.488629][ T7910] XFS (loop5): Unmounting Filesystem [ 1039.221526][T11530] loop4: detected capacity change from 0 to 2048 [ 1039.275322][T11530] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 1041.161701][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1041.171342][ T4286] CPU: 1 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1041.178911][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1041.188976][ T4286] Workqueue: hci1 hci_rx_work [ 1041.193675][ T4286] Call Trace: [ 1041.196957][ T4286] [ 1041.199898][ T4286] dump_stack_lvl+0x188/0x24e [ 1041.204600][ T4286] ? show_regs_print_info+0x12/0x12 [ 1041.209815][ T4286] ? load_image+0x410/0x410 [ 1041.214363][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1041.219492][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1041.224541][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1041.229239][ T4286] ? preempt_schedule_thunk+0x16/0x18 [ 1041.234633][ T4286] kobject_add_internal+0x617/0xca0 [ 1041.239850][ T4286] kobject_add+0x160/0x230 [ 1041.244289][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1041.248980][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 1041.254272][ T4286] ? klist_children_get+0x50/0x50 [ 1041.259311][ T4286] ? get_device_parent+0x121/0x3e0 [ 1041.264438][ T4286] device_add+0x470/0x1050 [ 1041.268875][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1041.273836][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1041.279232][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1041.285491][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1041.291140][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1041.296353][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1041.302004][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1041.307571][ T4286] hci_event_packet+0x61f/0xe60 [ 1041.312444][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1041.318522][ T4286] ? bis_list+0x280/0x280 [ 1041.322860][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1041.328778][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1041.333902][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1041.339115][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1041.344330][ T4286] hci_rx_work+0x3eb/0xd40 [ 1041.348758][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 1041.353624][ T4286] ? process_one_work+0x7b4/0x1160 [ 1041.358744][ T4286] process_one_work+0x8ab/0x1160 [ 1041.363706][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1041.369354][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1041.374448][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1041.380024][ T4286] ? wq_worker_running+0x97/0x190 [ 1041.385067][ T4286] worker_thread+0xaf5/0x12a0 [ 1041.389788][ T4286] kthread+0x29d/0x330 [ 1041.393881][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1041.398917][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1041.403519][ T4286] ret_from_fork+0x1f/0x30 [ 1041.407964][ T4286] [ 1041.453726][ T4286] kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1041.468599][ T4286] Bluetooth: hci1: failed to register connection device [ 1042.281792][T11548] random: crng reseeded on system resumption [ 1043.921596][ T4286] Bluetooth: hci1: command 0x2016 tx timeout [ 1046.057001][T11566] loop4: detected capacity change from 0 to 32768 [ 1046.064251][T11566] XFS: ikeep mount option is deprecated. [ 1046.181838][T11566] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 1046.190769][T11566] XFS (loop4): Mounting V5 Filesystem [ 1046.324461][T11566] XFS (loop4): Ending clean mount [ 1046.339686][T11566] XFS (loop4): Quotacheck needed: Please wait. [ 1046.409712][ T7] XFS (loop4): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1046.431749][ T7] XFS (loop4): Unmount and run xfs_repair [ 1046.465369][ T7] XFS (loop4): First 128 bytes of corrupted metadata buffer: [ 1046.493087][ T7] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1046.536640][ T7] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1046.572185][ T7] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1046.611657][ T7] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1046.652109][ T7] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1046.687470][ T7] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1046.727370][ T7] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1046.761542][ T7] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1046.874897][ T9] XFS (loop4): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1046.895079][T11566] XFS (loop4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1046.929777][T11565] syz.4.1657 (11565): drop_caches: 2 [ 1047.127603][ T4285] XFS (loop4): Unmounting Filesystem [ 1047.292396][T11583] ip_tables: iptables: counters copy to user failed while replacing table [ 1048.082739][T11588] loop5: detected capacity change from 0 to 2048 [ 1048.149354][T11588] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 1050.665007][T11599] loop3: detected capacity change from 0 to 1024 [ 1050.682933][T11600] fuse: Bad value for 'rootmode' [ 1051.148265][T11603] loop1: detected capacity change from 0 to 512 [ 1051.205006][T11599] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1051.559616][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 1051.570292][ T4286] CPU: 0 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1051.577872][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1051.587941][ T4286] Workqueue: hci0 hci_rx_work [ 1051.592643][ T4286] Call Trace: [ 1051.595925][ T4286] [ 1051.598866][ T4286] dump_stack_lvl+0x188/0x24e [ 1051.603567][ T4286] ? show_regs_print_info+0x12/0x12 [ 1051.608781][ T4286] ? load_image+0x410/0x410 [ 1051.613323][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1051.618456][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1051.623495][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1051.628188][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 1051.633403][ T4286] kobject_add_internal+0x617/0xca0 [ 1051.638619][ T4286] kobject_add+0x160/0x230 [ 1051.643045][ T4286] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1051.648698][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1051.653403][ T4286] ? get_device_parent+0x86/0x3e0 [ 1051.658460][ T4286] ? get_device_parent+0x121/0x3e0 [ 1051.664039][ T4286] device_add+0x470/0x1050 [ 1051.668509][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1051.673477][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1051.678878][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1051.685138][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 1051.690269][ T4286] ? memcpy+0x3c/0x60 [ 1051.694266][ T4286] ? skb_pull_data+0xec/0x1f0 [ 1051.698966][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1051.704535][ T4286] hci_event_packet+0x61f/0xe60 [ 1051.709405][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1051.715478][ T4286] ? bis_list+0x280/0x280 [ 1051.719839][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1051.725759][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1051.730887][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1051.736107][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1051.741327][ T4286] hci_rx_work+0x3eb/0xd40 [ 1051.745765][ T4286] ? process_one_work+0x7b4/0x1160 [ 1051.750895][ T4286] process_one_work+0x8ab/0x1160 [ 1051.755870][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1051.761524][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1051.766562][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1051.772122][ T4286] ? wq_worker_running+0x97/0x190 [ 1051.777159][ T4286] worker_thread+0xaf5/0x12a0 [ 1051.781882][ T4286] kthread+0x29d/0x330 [ 1051.785961][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1051.790998][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1051.795596][ T4286] ret_from_fork+0x1f/0x30 [ 1051.800041][ T4286] [ 1051.846338][ T4286] kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1051.860032][ T4286] Bluetooth: hci0: failed to register connection device [ 1052.541930][T11614] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1659'. [ 1052.682776][T11619] loop5: detected capacity change from 0 to 64 [ 1052.746226][ T9840] EXT4-fs (loop3): unmounting filesystem. [ 1052.952006][T11623] overlayfs: failed to clone upperpath [ 1053.914799][ T4286] Bluetooth: hci0: command 0x2016 tx timeout [ 1054.892319][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.898815][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.956921][T11637] loop4: detected capacity change from 0 to 32768 [ 1055.963905][T11637] XFS: ikeep mount option is deprecated. [ 1056.004383][T11642] random: crng reseeded on system resumption [ 1056.930681][T11643] ip_tables: iptables: counters copy to user failed while replacing table [ 1057.715223][T11637] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 1057.723605][T11637] XFS (loop4): Mounting V5 Filesystem [ 1057.887584][T11637] XFS (loop4): Ending clean mount [ 1057.896127][T11637] XFS (loop4): Quotacheck needed: Please wait. [ 1057.916163][ T9] XFS (loop4): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1057.938213][ T9] XFS (loop4): Unmount and run xfs_repair [ 1057.946008][ T9] XFS (loop4): First 128 bytes of corrupted metadata buffer: [ 1057.958999][ T9] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1057.969962][T11661] loop1: detected capacity change from 0 to 8 [ 1057.983915][ T9] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1058.043614][ T9] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1058.079011][ T9] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1058.203062][ T9] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1058.284035][ T9] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1058.365386][ T9] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1058.823427][ T9] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1058.832333][ T9] XFS (loop4): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1058.847544][T11637] XFS (loop4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1058.989011][ T4285] XFS (loop4): Unmounting Filesystem [ 1059.174038][T11665] loop1: detected capacity change from 0 to 1024 [ 1059.459914][T11665] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 1059.726260][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1059.736909][ T4286] CPU: 0 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1059.744486][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1059.754549][ T4286] Workqueue: hci3 hci_rx_work [ 1059.759245][ T4286] Call Trace: [ 1059.762528][ T4286] [ 1059.765466][ T4286] dump_stack_lvl+0x188/0x24e [ 1059.770163][ T4286] ? show_regs_print_info+0x12/0x12 [ 1059.775379][ T4286] ? load_image+0x410/0x410 [ 1059.779907][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1059.785035][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1059.790075][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1059.794766][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1059.799982][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 1059.805191][ T4286] kobject_add_internal+0x617/0xca0 [ 1059.810408][ T4286] kobject_add+0x160/0x230 [ 1059.814839][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1059.819532][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 1059.824826][ T4286] ? klist_children_get+0x50/0x50 [ 1059.829865][ T4286] ? get_device_parent+0x121/0x3e0 [ 1059.834993][ T4286] device_add+0x470/0x1050 [ 1059.839428][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1059.844382][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1059.849781][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1059.856042][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 1059.861166][ T4286] ? memcpy+0x3c/0x60 [ 1059.865164][ T4286] ? skb_pull_data+0xec/0x1f0 [ 1059.869862][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1059.875431][ T4286] hci_event_packet+0x61f/0xe60 [ 1059.880302][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1059.886376][ T4286] ? bis_list+0x280/0x280 [ 1059.890715][ T4286] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 1059.896712][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1059.901833][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1059.907044][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1059.912260][ T4286] hci_rx_work+0x3eb/0xd40 [ 1059.916687][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 1059.921558][ T4286] ? process_one_work+0x7b4/0x1160 [ 1059.926689][ T4286] process_one_work+0x8ab/0x1160 [ 1059.931656][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1059.937303][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1059.942338][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1059.947902][ T4286] ? wq_worker_running+0x97/0x190 [ 1059.952940][ T4286] worker_thread+0xaf5/0x12a0 [ 1059.957665][ T4286] kthread+0x29d/0x330 [ 1059.961738][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1059.966774][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1059.971373][ T4286] ret_from_fork+0x1f/0x30 [ 1059.975823][ T4286] [ 1060.037287][ T4286] kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1060.051467][ T4286] Bluetooth: hci3: failed to register connection device [ 1060.539657][T11681] fuse: Bad value for 'rootmode' [ 1060.616757][ T4277] EXT4-fs (loop1): unmounting filesystem. [ 1062.351627][ T4286] Bluetooth: hci3: command 0x2016 tx timeout [ 1062.524612][T11697] loop1: detected capacity change from 0 to 8 [ 1062.623352][ T4351] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1063.567619][T11702] ip_tables: iptables: counters copy to user failed while replacing table [ 1064.194025][T11706] random: crng reseeded on system resumption [ 1064.290864][ T4351] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1065.476998][ T4351] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1065.597330][ T4351] usb 5-1: string descriptor 0 read error: -71 [ 1065.613392][ T4351] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1065.623027][ T4351] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1065.646160][ T4351] usb 5-1: config 0 descriptor?? [ 1065.663554][ T4351] usb 5-1: can't set config #0, error -71 [ 1065.694292][ T4351] usb 5-1: USB disconnect, device number 6 [ 1066.094887][T11726] loop1: detected capacity change from 0 to 1024 [ 1066.193004][T11726] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 1066.959934][ T4286] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1066.969347][ T4286] CPU: 1 PID: 4286 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 1066.976900][ T4286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1066.986967][ T4286] Workqueue: hci3 hci_rx_work [ 1066.991650][ T4286] Call Trace: [ 1066.994932][ T4286] [ 1066.997860][ T4286] dump_stack_lvl+0x188/0x24e [ 1067.002538][ T4286] ? show_regs_print_info+0x12/0x12 [ 1067.007729][ T4286] ? load_image+0x410/0x410 [ 1067.012233][ T4286] sysfs_create_dir_ns+0x26a/0x290 [ 1067.017346][ T4286] ? __lock_acquire+0x7ea0/0x7ea0 [ 1067.022373][ T4286] ? sysfs_warn_dup+0xa0/0xa0 [ 1067.027049][ T4286] ? do_raw_spin_unlock+0x11d/0x230 [ 1067.032244][ T4286] kobject_add_internal+0x617/0xca0 [ 1067.037437][ T4286] kobject_add+0x160/0x230 [ 1067.041849][ T4286] ? kobject_init+0x1c0/0x1c0 [ 1067.046520][ T4286] ? __raw_spin_lock_init+0x41/0x100 [ 1067.051794][ T4286] ? klist_children_get+0x50/0x50 [ 1067.056815][ T4286] ? get_device_parent+0x121/0x3e0 [ 1067.061927][ T4286] device_add+0x470/0x1050 [ 1067.066356][ T4286] hci_conn_add_sysfs+0xd1/0x1e0 [ 1067.071294][ T4286] le_conn_complete_evt+0x10db/0x17c0 [ 1067.076679][ T4286] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1067.082920][ T4286] ? __copy_skb_header+0x3ba/0x4f0 [ 1067.088035][ T4286] ? memcpy+0x3c/0x60 [ 1067.092014][ T4286] ? skb_pull_data+0xec/0x1f0 [ 1067.096687][ T4286] hci_le_conn_complete_evt+0x183/0x440 [ 1067.102233][ T4286] hci_event_packet+0x61f/0xe60 [ 1067.107084][ T4286] ? hci_remote_host_features_evt+0x230/0x230 [ 1067.113145][ T4286] ? bis_list+0x280/0x280 [ 1067.117469][ T4286] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1067.123357][ T4286] ? kcov_remote_start+0x50f/0x810 [ 1067.128463][ T4286] ? lockdep_hardirqs_on+0x94/0x140 [ 1067.133654][ T4286] ? hci_send_to_monitor+0x9c/0x4a0 [ 1067.138846][ T4286] hci_rx_work+0x3eb/0xd40 [ 1067.143257][ T4286] ? _raw_spin_unlock+0x40/0x40 [ 1067.148112][ T4286] ? process_one_work+0x7b4/0x1160 [ 1067.153223][ T4286] process_one_work+0x8ab/0x1160 [ 1067.158160][ T4286] ? worker_detach_from_pool+0x240/0x240 [ 1067.163791][ T4286] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1067.168807][ T4286] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1067.174345][ T4286] ? wq_worker_running+0x97/0x190 [ 1067.179362][ T4286] worker_thread+0xaf5/0x12a0 [ 1067.184052][ T4286] kthread+0x29d/0x330 [ 1067.188112][ T4286] ? worker_clr_flags+0x1a0/0x1a0 [ 1067.193131][ T4286] ? kthread_blkcg+0xd0/0xd0 [ 1067.197716][ T4286] ret_from_fork+0x1f/0x30 [ 1067.202138][ T4286] [ 1067.228691][ T4286] kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1067.241777][ T4286] Bluetooth: hci3: failed to register connection device [ 1067.486658][T11740] loop3: detected capacity change from 0 to 2048 [ 1067.510987][T11740] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 1067.875779][ T4277] EXT4-fs (loop1): unmounting filesystem. [ 1069.412648][ T4286] Bluetooth: hci3: command 0x2016 tx timeout [ 1071.877087][T11764] loop5: detected capacity change from 0 to 256 [ 1071.888501][T11764] exfat: Deprecated parameter 'utf8' [ 1071.893874][T11764] exfat: Deprecated parameter 'utf8' [ 1071.899258][T11764] exfat: Deprecated parameter 'namecase' [ 1071.935185][T11764] exfat: Deprecated parameter 'utf8' [ 1071.940569][T11764] exfat: Deprecated parameter 'namecase' [ 1071.987626][T11764] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001fe89, chksum : 0x8f0af947, utbl_chksum : 0xe619d30d) [ 1072.076916][T11766] 9pnet_fd: p9_fd_create_unix (11766): problem connecting socket: ./file0: -111 [ 1072.258351][T11769] FAULT_INJECTION: forcing a failure. [ 1072.258351][T11769] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1072.332780][T11769] CPU: 0 PID: 11769 Comm: syz.1.1701 Not tainted syzkaller #0 [ 1072.340290][T11769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1072.350355][T11769] Call Trace: [ 1072.353627][T11769] [ 1072.356543][T11769] dump_stack_lvl+0x188/0x24e [ 1072.361212][T11769] ? show_regs_print_info+0x12/0x12 [ 1072.366412][T11769] ? load_image+0x410/0x410 [ 1072.370921][T11769] ? stack_trace_save+0xa6/0xf0 [ 1072.375845][T11769] ? __stack_depot_save+0x35/0x480 [ 1072.381022][T11769] should_fail_ex+0x390/0x4c0 [ 1072.385697][T11769] get_futex_key+0x1a6/0xe70 [ 1072.390285][T11769] ? futex_setup_timer+0xc0/0xc0 [ 1072.395224][T11769] futex_wake+0x123/0x4f0 [ 1072.399545][T11769] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1072.405522][T11769] ? futex_wake_mark+0x150/0x150 [ 1072.410460][T11769] ? lockdep_hardirqs_on+0x94/0x140 [ 1072.415669][T11769] do_futex+0x2e2/0x320 [ 1072.419835][T11769] ? __ia32_sys_get_robust_list+0x100/0x100 [ 1072.425735][T11769] __se_sys_futex+0x381/0x410 [ 1072.430517][T11769] ? __x64_sys_futex+0xf0/0xf0 [ 1072.435291][T11769] ? __x64_sys_futex+0x1d/0xf0 [ 1072.440077][T11769] do_syscall_64+0x4c/0xa0 [ 1072.444512][T11769] ? clear_bhb_loop+0x60/0xb0 [ 1072.449190][T11769] ? clear_bhb_loop+0x60/0xb0 [ 1072.453867][T11769] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1072.459756][T11769] RIP: 0033:0x7f2fdb79fb19 [ 1072.464167][T11769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1072.483769][T11769] RSP: 002b:00007f2fdc5a60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1072.492179][T11769] RAX: ffffffffffffffda RBX: 00007f2fdba25fa8 RCX: 00007f2fdb79fb19 [ 1072.500142][T11769] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f2fdba25fac [ 1072.508103][T11769] RBP: 00007f2fdba25fa0 R08: 000da22e31c0fab8 R09: 0000000000000000 [ 1072.516072][T11769] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 1072.524036][T11769] R13: 00007f2fdba26038 R14: 00007ffff8b6b960 R15: 00007ffff8b6ba48 [ 1072.532012][T11769] [ 1072.768590][T11773] vivid-008: ================= START STATUS ================= [ 1072.776358][T11773] vivid-008: FM Deviation: 75000 [ 1072.781289][T11773] vivid-008: ================== END STATUS ================== [ 1072.800087][T11773] loop4: detected capacity change from 0 to 512 [ 1072.807008][T11773] EXT4-fs: Ignoring removed bh option [ 1072.812415][T11773] EXT4-fs: quotafile must be on filesystem root [ 1072.830186][T11775] random: crng reseeded on system resumption [ 1072.859922][T11577] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1072.883947][T11773] loop4: detected capacity change from 0 to 512 [ 1073.829177][T11773] EXT4-fs error (device loop4): ext4_orphan_get:1409: inode #15: comm syz.4.1699: iget: bad i_size value: 38620345925642 [ 1073.843742][T11773] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.1699: couldn't read orphan inode 15 (err -117) [ 1073.856475][T11773] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 1074.045208][T11787] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm syz.4.1699: bg 0: block 5: invalid block bitmap [ 1074.064688][T11787] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 1074.403387][T11789] ip_tables: iptables: counters copy to user failed while replacing table [ 1075.187599][T11787] EXT4-fs (loop4): This should not happen!! Data will be lost [ 1075.187599][T11787] [ 1075.282789][T11795] loop1: detected capacity change from 0 to 8 [ 1075.313544][T11787] EXT4-fs (loop4): Total free blocks count 0 [ 1075.333219][T11787] EXT4-fs (loop4): Free/Dirty block details [ 1075.349616][T11787] EXT4-fs (loop4): free_blocks=0 [ 1075.358294][T11787] EXT4-fs (loop4): dirty_blocks=6756 [ 1075.463419][T11787] EXT4-fs (loop4): Block reservation details [ 1076.426435][T11787] EXT4-fs (loop4): i_reserved_data_blocks=6756 [ 1077.050087][T11802] loop1: detected capacity change from 0 to 32768 [ 1077.057192][T11802] XFS: ikeep mount option is deprecated. [ 1077.109017][T11802] XFS (loop1): DAX unsupported by block device. Turning off DAX. [ 1077.117338][T11802] XFS (loop1): Mounting V5 Filesystem [ 1077.126638][ T7525] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 1077.253339][T11802] XFS (loop1): Ending clean mount [ 1077.265124][T11802] XFS (loop1): Quotacheck needed: Please wait. [ 1077.322690][ T4406] XFS (loop1): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1077.436340][ T4406] XFS (loop1): Unmount and run xfs_repair [ 1077.442118][ T4406] XFS (loop1): First 128 bytes of corrupted metadata buffer: [ 1077.480335][ T4406] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1077.510699][ T4406] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1077.603223][ T4406] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1077.612120][ T4406] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1077.673780][ T4406] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1077.682686][ T4406] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1077.763179][ T4406] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1077.772846][ T4406] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1077.828724][ T4406] XFS (loop1): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1077.888553][T11802] XFS (loop1): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1077.915020][T11802] syz.1.1710 (11802): drop_caches: 2 [ 1078.017524][ T4277] XFS (loop1): Unmounting Filesystem [ 1080.218460][T11839] loop4: detected capacity change from 0 to 8 [ 1080.313541][ T7] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1081.334909][ T7] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1081.345374][T11846] random: crng reseeded on system resumption [ 1081.363529][ T7] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1081.438791][ T7] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1081.473425][ T7] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1082.641241][ T7] usb 4-1: Product: syz [ 1082.645547][ T7] usb 4-1: Manufacturer: syz [ 1082.650195][ T7] usb 4-1: SerialNumber: syz [ 1082.657547][ T7] usb 4-1: config 0 descriptor?? [ 1082.699116][ T7] usb 4-1: selecting invalid altsetting 0 [ 1082.906718][ T4353] usb 4-1: USB disconnect, device number 12 [ 1083.343422][T11858] loop4: detected capacity change from 0 to 32768 [ 1083.350325][T11858] XFS: ikeep mount option is deprecated. [ 1083.421333][T11858] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 1083.429694][T11858] XFS (loop4): Mounting V5 Filesystem [ 1083.614931][T11858] XFS (loop4): Ending clean mount [ 1083.622061][T11858] XFS (loop4): Quotacheck needed: Please wait. [ 1083.640462][ T7] XFS (loop4): Metadata CRC error detected at xfs_agfl_read_verify+0x189/0x240, xfs_agfl block 0x3 [ 1083.845453][T11873] ip_tables: iptables: counters copy to user failed while replacing table [ 1084.700839][ T7] XFS (loop4): Unmount and run xfs_repair [ 1084.708861][ T7] XFS (loop4): First 128 bytes of corrupted metadata buffer: [ 1084.765945][ T7] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1084.830827][ T7] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1084.843286][ T7] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1084.852172][ T7] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1084.896272][ T7] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1084.995409][ T7] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1085.010944][T11880] loop3: detected capacity change from 0 to 512 [ 1085.108918][ T7] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1085.139043][ T7] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1085.163324][ T9785] XFS (loop4): metadata I/O error in "xfs_alloc_read_agfl+0x21f/0x400" at daddr 0x3 len 1 error 74 [ 1085.271695][T11858] XFS (loop4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1085.303295][T11858] syz.4.1723 (11858): drop_caches: 2 [ 1085.478920][ T4285] XFS (loop4): Unmounting Filesystem [ 1086.424255][T11886] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1726'. [ 1089.515962][T11913] loop4: detected capacity change from 0 to 64 [ 1091.884267][T11918] loop4: detected capacity change from 0 to 8 [ 1093.054995][T11924] loop5: detected capacity change from 0 to 8 [ 1094.162062][T11928] loop4: detected capacity change from 0 to 32768 [ 1094.168998][T11928] XFS: ikeep mount option is deprecated. [ 1095.399170][T11937] ip_tables: iptables: counters copy to user failed while replacing table [ 1101.058068][T11971] random: crng reseeded on system resumption [ 1103.024056][T11979] ip_tables: iptables: counters copy to user failed while replacing table [ 1104.429377][T11988] loop3: detected capacity change from 0 to 512 [ 1104.534044][T11989] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1106.967435][T12001] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1749'. [ 1113.203755][T12038] ip_tables: iptables: counters copy to user failed while replacing table [ 1114.791418][T12048] random: crng reseeded on system resumption [ 1116.669960][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.676306][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 1121.599394][T12074] ip_tables: iptables: counters copy to user failed while replacing table [ 1124.981824][T12090] device bond0 entered promiscuous mode [ 1124.991878][T12090] device bond_slave_0 entered promiscuous mode [ 1124.998423][T12090] device bond_slave_1 entered promiscuous mode [ 1125.010471][T12090] device batadv0 entered promiscuous mode [ 1125.022043][T12090] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1126.238207][ T9774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 1127.221366][T12107] random: crng reseeded on system resumption [ 1128.669128][T12113] loop1: detected capacity change from 0 to 512 [ 1129.092761][T12117] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1773'. [ 1131.573006][T12128] loop3: detected capacity change from 0 to 8 [ 1136.389450][T12152] ip_tables: iptables: counters copy to user failed while replacing table [ 1139.892826][T12168] fuse: Bad value for 'fd' [ 1142.991512][T12182] random: crng reseeded on system resumption [ 1143.271101][T12185] fuse: Bad value for 'fd' [ 1147.043861][T12195] sctp: [Deprecated]: syz.4.1798 (pid 12195) Use of int in max_burst socket option deprecated. [ 1147.043861][T12195] Use struct sctp_assoc_value instead [ 1147.466925][T12200] fuse: Unknown parameter 'user_id00000000000000000000' [ 1153.649860][T12233] fuse: Bad value for 'fd' [ 1155.673288][ T129] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1155.895261][ T129] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1155.910030][ T129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1155.922963][ T129] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1156.653209][ T129] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1156.661566][ T129] usb 6-1: Product: syz [ 1156.677332][ T129] usb 6-1: Manufacturer: syz [ 1156.687454][ T129] usb 6-1: SerialNumber: syz [ 1156.704297][ T129] usb 6-1: config 0 descriptor?? [ 1156.746048][ T129] usb 6-1: selecting invalid altsetting 0 [ 1156.808176][T12258] random: crng reseeded on system resumption [ 1158.090843][T12253] loop3: detected capacity change from 0 to 4096 [ 1158.155719][ T5081] usb 6-1: USB disconnect, device number 7 [ 1158.169017][T12253] ntfs3: loop3: Different NTFS' sector size (1024) and media sector size (512) [ 1158.205970][T12253] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 1159.574971][ T9787] ntfs3: loop3: ntfs3_write_inode r=1a failed, -22. [ 1159.583455][ T9840] ntfs3: loop3: ntfs_sync_fs r=1a failed, -22. [ 1159.616010][ T9840] ntfs3: loop3: ntfs_evict_inode r=1a failed, -22. [ 1160.962861][T12278] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1161.010447][T12279] netlink: 'syz.1.1816': attribute type 4 has an invalid length. [ 1161.036794][T12278] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1161.063279][T12279] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1816'. [ 1164.119721][T12301] fuse: Bad value for 'fd' [ 1167.231715][T12316] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1167.256397][T12316] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1167.373322][T12316] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1169.619078][T12331] fuse: Bad value for 'fd' [ 1173.340027][T12353] input: syz1 as /devices/virtual/input/input26 [ 1174.915910][T12361] FAULT_INJECTION: forcing a failure. [ 1174.915910][T12361] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1175.073874][T12361] CPU: 1 PID: 12361 Comm: syz.4.1839 Not tainted syzkaller #0 [ 1175.081377][T12361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1175.091415][T12361] Call Trace: [ 1175.094678][T12361] [ 1175.097594][T12361] dump_stack_lvl+0x188/0x24e [ 1175.102261][T12361] ? inet_sendmsg+0x7a/0x2a0 [ 1175.106921][T12361] ? show_regs_print_info+0x12/0x12 [ 1175.112103][T12361] ? load_image+0x410/0x410 [ 1175.116586][T12361] ? ____sys_sendmsg+0x805/0x9a0 [ 1175.121511][T12361] ? __sys_sendmsg_sock+0x30/0x30 [ 1175.126533][T12361] should_fail_ex+0x390/0x4c0 [ 1175.131227][T12361] get_futex_key+0x1a6/0xe70 [ 1175.135806][T12361] ? rcu_is_watching+0x11/0xa0 [ 1175.140571][T12361] ? ___sys_sendmsg+0x2b2/0x360 [ 1175.145413][T12361] ? futex_setup_timer+0xc0/0xc0 [ 1175.150334][T12361] ? __sys_sendmsg+0x2a0/0x2a0 [ 1175.155086][T12361] futex_wake+0x123/0x4f0 [ 1175.159416][T12361] ? futex_wake_mark+0x150/0x150 [ 1175.164360][T12361] do_futex+0x2e2/0x320 [ 1175.168500][T12361] ? __ia32_sys_get_robust_list+0x100/0x100 [ 1175.174377][T12361] ? fput+0x150/0x1a0 [ 1175.178352][T12361] __se_sys_futex+0x381/0x410 [ 1175.183016][T12361] ? __x64_sys_futex+0xf0/0xf0 [ 1175.187770][T12361] ? __x64_sys_futex+0x1d/0xf0 [ 1175.192518][T12361] do_syscall_64+0x4c/0xa0 [ 1175.196923][T12361] ? clear_bhb_loop+0x60/0xb0 [ 1175.201588][T12361] ? clear_bhb_loop+0x60/0xb0 [ 1175.206253][T12361] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1175.212131][T12361] RIP: 0033:0x7f17dbb9fb19 [ 1175.216529][T12361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1175.236121][T12361] RSP: 002b:00007f17dc9dd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1175.244519][T12361] RAX: ffffffffffffffda RBX: 00007f17dbe25fa8 RCX: 00007f17dbb9fb19 [ 1175.252483][T12361] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f17dbe25fac [ 1175.260439][T12361] RBP: 00007f17dbe25fa0 R08: 0034f8f44f9054f0 R09: 0000000000000000 [ 1175.268394][T12361] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 1175.276349][T12361] R13: 00007f17dbe26038 R14: 00007ffd75c3f420 R15: 00007ffd75c3f508 [ 1175.284312][T12361] [ 1175.833978][T12374] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1845'. [ 1176.465559][T12376] loop4: detected capacity change from 0 to 131072 [ 1176.493596][T12374] device bond0 entered promiscuous mode [ 1176.502952][T12376] F2FS-fs (loop4): Wrong CP boundary, start(512) end(1536) blocks(0) [ 1176.511065][T12376] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 1176.517283][T12374] device bond_slave_0 entered promiscuous mode [ 1176.528764][T12376] F2FS-fs (loop4): invalid crc value [ 1176.582669][T12376] F2FS-fs (loop4): Found nat_bits in checkpoint [ 1176.616803][T12374] device bond_slave_1 entered promiscuous mode [ 1176.623045][T12376] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 1176.630406][T12376] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 1176.743647][T12374] device gretap0 entered promiscuous mode [ 1176.796784][T12385] loop5: detected capacity change from 0 to 2048 [ 1176.835707][T12385] UDF-fs: bad mount option "session=000000000000@00" or missing value [ 1177.596911][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.604888][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.764021][T12374] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 1178.771632][T12374] Cannot create hsr debugfs directory [ 1178.833814][T12374] device hsr1 entered promiscuous mode [ 1178.842673][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 1179.808374][T12398] sctp: [Deprecated]: syz.4.1847 (pid 12398) Use of int in max_burst socket option deprecated. [ 1179.808374][T12398] Use struct sctp_assoc_value instead [ 1179.972398][T12403] input: syz1 as /devices/virtual/input/input27 [ 1181.117341][ T4354] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1181.313333][ T4354] usb 5-1: Using ep0 maxpacket: 8 [ 1181.320104][ T4354] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1181.348359][ T4354] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1181.400375][ T4354] usb 5-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 1181.438564][T12410] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1848'. [ 1181.459547][ T4354] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1181.483498][ T4354] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1182.470533][ T4354] usb 5-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 1182.492342][ T4354] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1182.499877][ T4354] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1182.511246][ T4354] usb 5-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 1182.646245][ T4354] usb 5-1: string descriptor 0 read error: -22 [ 1182.652536][ T4354] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1182.719902][ T4354] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.784041][ T4354] adutux 5-1:168.0: interrupt endpoints not found [ 1183.471022][ T129] usb 5-1: USB disconnect, device number 7 [ 1184.209933][T12423] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1184.796537][ T26] audit: type=1800 audit(1793651060.470:117): pid=12423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1853" name="attr_allow_any_host" dev="configfs" ino=52747 res=0 errno=0 [ 1186.198332][T12430] fuse: Bad value for 'fd' [ 1189.409285][T12450] loop5: detected capacity change from 0 to 2048 [ 1189.477666][T12450] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1193.358781][T12479] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1193.932980][ T26] audit: type=1800 audit(1793651069.590:118): pid=12479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1868" name="attr_allow_any_host" dev="configfs" ino=52813 res=0 errno=0 [ 1194.375715][T12485] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 1194.633394][T12492] loop1: detected capacity change from 0 to 8 [ 1195.306287][T12498] FAULT_INJECTION: forcing a failure. [ 1195.306287][T12498] name failslab, interval 1, probability 0, space 0, times 0 [ 1195.368837][T12498] CPU: 0 PID: 12498 Comm: syz.3.1866 Not tainted syzkaller #0 [ 1195.376358][T12498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1195.386437][T12498] Call Trace: [ 1195.389728][T12498] [ 1195.392662][T12498] dump_stack_lvl+0x188/0x24e [ 1195.397363][T12498] ? show_regs_print_info+0x12/0x12 [ 1195.402562][T12498] ? load_image+0x410/0x410 [ 1195.407067][T12498] ? __might_sleep+0xd0/0xd0 [ 1195.411660][T12498] ? __lock_acquire+0x7ea0/0x7ea0 [ 1195.416693][T12498] should_fail_ex+0x390/0x4c0 [ 1195.421382][T12498] should_failslab+0x5/0x20 [ 1195.425888][T12498] slab_pre_alloc_hook+0x59/0x300 [ 1195.430912][T12498] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1195.437067][T12498] ? alloc_tty_struct+0xa3/0x780 [ 1195.442008][T12498] __kmem_cache_alloc_node+0x4f/0x270 [ 1195.447409][T12498] ? alloc_tty_struct+0xa3/0x780 [ 1195.452340][T12498] kmalloc_trace+0x26/0xe0 [ 1195.456751][T12498] alloc_tty_struct+0xa3/0x780 [ 1195.461504][T12498] ? tty_open+0x204/0xd80 [ 1195.465832][T12498] ? tty_init_dev+0x4c0/0x4c0 [ 1195.470501][T12498] tty_init_dev+0x55/0x4c0 [ 1195.474910][T12498] ? tty_open+0x7c9/0xd80 [ 1195.479228][T12498] tty_open+0x7d8/0xd80 [ 1195.483382][T12498] ? __lock_acquire+0x7ea0/0x7ea0 [ 1195.488421][T12498] ? tty_compat_ioctl+0x5a0/0x5a0 [ 1195.493435][T12498] ? memset+0x1e/0x40 [ 1195.497409][T12498] ? do_raw_spin_unlock+0x11d/0x230 [ 1195.502594][T12498] chrdev_open+0x585/0x5f0 [ 1195.507004][T12498] ? cd_forget+0x160/0x160 [ 1195.511413][T12498] ? fsnotify_perm+0x39b/0x550 [ 1195.516173][T12498] ? cd_forget+0x160/0x160 [ 1195.520577][T12498] do_dentry_open+0x7dd/0x10b0 [ 1195.525357][T12498] path_openat+0x2674/0x2f10 [ 1195.529964][T12498] ? kasan_set_track+0x60/0x70 [ 1195.534723][T12498] ? verify_lock_unused+0x140/0x140 [ 1195.539912][T12498] ? do_sys_openat2+0xdd/0x4f0 [ 1195.544672][T12498] ? do_filp_open+0x420/0x420 [ 1195.549349][T12498] do_filp_open+0x1ee/0x420 [ 1195.553861][T12498] ? vfs_tmpfile+0x490/0x490 [ 1195.558456][T12498] ? _raw_spin_unlock+0x24/0x40 [ 1195.563296][T12498] ? alloc_fd+0x590/0x640 [ 1195.567624][T12498] do_sys_openat2+0x14b/0x4f0 [ 1195.572290][T12498] ? do_sys_open+0xe0/0xe0 [ 1195.576696][T12498] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1195.582700][T12498] ? lock_chain_count+0x20/0x20 [ 1195.587544][T12498] __x64_sys_openat+0x135/0x160 [ 1195.592400][T12498] do_syscall_64+0x4c/0xa0 [ 1195.596808][T12498] ? clear_bhb_loop+0x60/0xb0 [ 1195.601480][T12498] ? clear_bhb_loop+0x60/0xb0 [ 1195.606148][T12498] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1195.612027][T12498] RIP: 0033:0x7f456bb6034e [ 1195.616460][T12498] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1195.636087][T12498] RSP: 002b:00007f456c9e3b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1195.644517][T12498] RAX: ffffffffffffffda RBX: 00007f456c9e46c0 RCX: 00007f456bb6034e [ 1195.652479][T12498] RDX: 0000000000000002 RSI: 00007f456c9e3c00 RDI: ffffffffffffff9c [ 1195.660441][T12498] RBP: 00007f456bc37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1195.668404][T12498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1195.676373][T12498] R13: 00007f456be26038 R14: 00007f456be25fa0 R15: 00007fff888c4608 [ 1195.684362][T12498] [ 1195.861289][T12502] fuse: Unknown parameter '0x0000000000000006' [ 1198.918420][T12520] loop1: detected capacity change from 0 to 131072 [ 1198.941765][T12520] F2FS-fs (loop1): Invalid segment/section count (458783, 24 x 150994945) [ 1198.950492][T12520] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 1198.979137][T12520] F2FS-fs (loop1): invalid crc value [ 1199.030777][T12520] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1199.073606][ T9268] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1199.088987][T12520] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 1199.096207][T12520] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 1199.196005][ T26] audit: type=1804 audit(1793651075.360:119): pid=12520 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1879" name="/newroot/361/file1/bus" dev="loop1" ino=10 res=1 errno=0 [ 1199.253159][ T9268] usb 4-1: device descriptor read/64, error -71 [ 1199.523357][ T9268] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1199.642916][T12531] mmap: syz.0.1877 (12531) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1199.693563][ T9268] usb 4-1: device descriptor read/64, error -71 [ 1199.828654][ T9268] usb usb4-port1: attempt power cycle [ 1200.253649][ T9268] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1200.315318][ T9268] usb 4-1: device descriptor read/8, error -71 [ 1200.653241][ T9268] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1200.713887][ T9268] usb 4-1: device descriptor read/8, error -71 [ 1201.281154][T12540] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1201.856304][ T9268] usb usb4-port1: unable to enumerate USB device [ 1201.864688][ T26] audit: type=1800 audit(1793651077.530:120): pid=12540 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1880" name="attr_allow_any_host" dev="configfs" ino=52902 res=0 errno=0 [ 1202.411448][T12550] fuse: Unknown parameter '0x0000000000000006' [ 1205.556651][ T7] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1205.704266][ T7457] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1205.793318][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 1205.800674][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1205.831087][ T7] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1205.850816][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1205.863423][ T7] usb 4-1: Product: syz [ 1205.873304][ T7] usb 4-1: Manufacturer: syz [ 1205.879227][ T7] usb 4-1: SerialNumber: syz [ 1205.904014][ T7] usb 4-1: config 0 descriptor?? [ 1205.905236][ T7457] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1205.944740][ T7457] usb 2-1: config 189 has an invalid interface number: 127 but max is 0 [ 1206.098333][ T7457] usb 2-1: config 189 has no interface number 0 [ 1206.115112][ T7457] usb 2-1: config 189 interface 127 has no altsetting 0 [ 1206.134946][ T7457] usb 2-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 1206.158269][ T7457] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1206.172225][ T7457] usb 2-1: Product: syz [ 1206.178730][ T7457] usb 2-1: Manufacturer: syz [ 1206.193578][ T7457] usb 2-1: SerialNumber: syz [ 1206.428356][ T7457] usbserial_generic 2-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 1206.460576][ T7457] usbserial_generic 2-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 1206.493018][ T7457] usbserial_generic 2-1:189.127: device has no bulk endpoints [ 1206.512223][ T7457] safe_serial 2-1:189.127: safe_serial converter detected [ 1206.535581][ T7457] safe_serial: probe of 2-1:189.127 failed with error -22 [ 1206.569303][ T7457] usb 2-1: USB disconnect, device number 6 [ 1206.649959][T12590] loop4: detected capacity change from 0 to 8 [ 1208.090967][ T9267] usb 4-1: USB disconnect, device number 17 [ 1208.797178][T12605] input: syz1 as /devices/virtual/input/input28 [ 1209.647346][T12621] loop3: detected capacity change from 0 to 2048 [ 1209.700806][T12621] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1210.009755][T12629] loop4: detected capacity change from 0 to 256 [ 1210.118976][T12631] vivid-006: ================= START STATUS ================= [ 1210.126838][T12631] vivid-006: FM Deviation: 75000 [ 1210.133034][T12631] vivid-006: ================== END STATUS ================== [ 1210.166059][T12631] loop3: detected capacity change from 0 to 512 [ 1210.172996][T12631] EXT4-fs: Ignoring removed bh option [ 1210.178547][T12631] EXT4-fs: quotafile must be on filesystem root [ 1210.264769][T12342] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1210.287225][T12631] loop3: detected capacity change from 0 to 512 [ 1210.385046][T12631] EXT4-fs error (device loop3): ext4_orphan_get:1409: inode #15: comm syz.3.1909: iget: bad i_size value: 38620345925642 [ 1210.413525][T12631] EXT4-fs error (device loop3): ext4_orphan_get:1414: comm syz.3.1909: couldn't read orphan inode 15 (err -117) [ 1210.426314][T12631] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 1210.570188][T12636] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.1909: bg 0: block 5: invalid block bitmap [ 1210.641151][T12636] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 1210.713669][T12636] EXT4-fs (loop3): This should not happen!! Data will be lost [ 1210.713669][T12636] [ 1210.761185][T12636] EXT4-fs (loop3): Total free blocks count 0 [ 1210.779773][T12636] EXT4-fs (loop3): Free/Dirty block details [ 1210.789922][T12636] EXT4-fs (loop3): free_blocks=0 [ 1210.799054][T12636] EXT4-fs (loop3): dirty_blocks=4616 [ 1210.804671][T12636] EXT4-fs (loop3): Block reservation details [ 1210.810720][T12636] EXT4-fs (loop3): i_reserved_data_blocks=4616 [ 1210.903232][ T9267] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1211.073298][ T9267] usb 5-1: device descriptor read/64, error -71 [ 1211.190620][ T9] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 1211.352663][T12643] loop1: detected capacity change from 0 to 8 [ 1211.373302][ T9267] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1211.563147][ T9267] usb 5-1: device descriptor read/64, error -71 [ 1211.683909][ T9267] usb usb5-port1: attempt power cycle [ 1212.293423][ T9267] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1213.833497][T12652] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1213.938642][ T9267] usb 5-1: device descriptor read/8, error -71 [ 1214.045796][T12652] usb 6-1: Using ep0 maxpacket: 16 [ 1214.060425][T12652] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1214.117592][T12652] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1214.136812][T12655] loop1: detected capacity change from 0 to 128 [ 1214.148003][T12652] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1214.215341][T12652] usb 6-1: Product: syz [ 1214.870135][T12656] input: syz1 as /devices/virtual/input/input29 [ 1214.909854][T12652] usb 6-1: Manufacturer: syz [ 1214.911089][T12655] syz.1.1915: attempt to access beyond end of device [ 1214.911089][T12655] loop1: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1214.920006][T12652] usb 6-1: SerialNumber: syz [ 1215.444047][T12652] usb 6-1: config 0 descriptor?? [ 1215.571152][T12664] loop3: detected capacity change from 0 to 512 [ 1215.680892][T12664] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 1215.701346][T12655] syz.1.1915: attempt to access beyond end of device [ 1215.701346][T12655] loop1: rw=2049, sector=145, nr_sectors = 72 limit=128 [ 1215.715259][T12655] syz.1.1915: attempt to access beyond end of device [ 1215.715259][T12655] loop1: rw=2049, sector=217, nr_sectors = 1 limit=128 [ 1215.719916][T12664] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1917: invalid indirect mapped block 256 (level 1) [ 1215.790316][T12652] usb 6-1: can't set config #0, error -71 [ 1215.806959][T12652] usb 6-1: USB disconnect, device number 8 [ 1215.821634][T12664] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1917: invalid indirect mapped block 2683928664 (level 1) [ 1215.850399][T12664] EXT4-fs (loop3): 1 truncate cleaned up [ 1215.869341][T12664] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 1215.878410][T12655] Buffer I/O error on dev loop1, logical block 217, lost async page write [ 1215.894149][T12655] syz.1.1915: attempt to access beyond end of device [ 1215.894149][T12655] loop1: rw=2049, sector=218, nr_sectors = 1 limit=128 [ 1215.924239][T12655] Buffer I/O error on dev loop1, logical block 218, lost async page write [ 1216.011175][T12670] loop5: detected capacity change from 0 to 2048 [ 1216.264116][T12670] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1217.029730][ T9840] EXT4-fs (loop3): unmounting filesystem. [ 1217.259674][T12678] random: crng reseeded on system resumption [ 1217.322042][T12679] vivid-002: ================= START STATUS ================= [ 1217.329980][T12679] vivid-002: FM Deviation: 75000 [ 1217.334983][T12679] vivid-002: ================== END STATUS ================== [ 1217.352472][T12679] loop1: detected capacity change from 0 to 512 [ 1217.359220][T12679] EXT4-fs: Ignoring removed bh option [ 1217.364761][T12679] EXT4-fs: quotafile must be on filesystem root [ 1217.405327][T12342] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1217.421229][T12679] loop1: detected capacity change from 0 to 512 [ 1218.650237][T12679] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.1922: iget: bad i_size value: 38620345925642 [ 1218.664602][T12679] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.1922: couldn't read orphan inode 15 (err -117) [ 1218.678049][T12679] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 1218.869790][T12689] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.1922: bg 0: block 5: invalid block bitmap [ 1218.933640][T12689] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 1218.983149][T12689] EXT4-fs (loop1): This should not happen!! Data will be lost [ 1218.983149][T12689] [ 1219.010179][T12689] EXT4-fs (loop1): Total free blocks count 0 [ 1219.016954][T12689] EXT4-fs (loop1): Free/Dirty block details [ 1219.028320][T12689] EXT4-fs (loop1): free_blocks=0 [ 1219.036055][T12689] EXT4-fs (loop1): dirty_blocks=6804 [ 1219.048464][T12689] EXT4-fs (loop1): Block reservation details [ 1219.056190][T12689] EXT4-fs (loop1): i_reserved_data_blocks=6804 [ 1219.410471][ T9781] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 1221.244298][T12720] loop3: detected capacity change from 0 to 8 [ 1222.357719][T12723] input: syz1 as /devices/virtual/input/input30 [ 1222.371314][T12725] loop1: detected capacity change from 0 to 512 [ 1222.881797][T12725] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 1222.905711][T12725] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1933: invalid indirect mapped block 256 (level 1) [ 1222.987471][T12725] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1933: invalid indirect mapped block 2683928664 (level 1) [ 1223.018894][T12725] EXT4-fs (loop1): 1 truncate cleaned up [ 1223.040341][T12725] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 1223.229877][T12737] random: crng reseeded on system resumption [ 1224.752656][T12730] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:477: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 1224.909606][T12747] FAULT_INJECTION: forcing a failure. [ 1224.909606][T12747] name failslab, interval 1, probability 0, space 0, times 0 [ 1224.923630][T12747] CPU: 0 PID: 12747 Comm: syz.3.1938 Not tainted syzkaller #0 [ 1224.931129][T12747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1224.941194][T12747] Call Trace: [ 1224.944482][T12747] [ 1224.947421][T12747] dump_stack_lvl+0x188/0x24e [ 1224.952123][T12747] ? show_regs_print_info+0x12/0x12 [ 1224.957342][T12747] ? load_image+0x410/0x410 [ 1224.961859][T12747] ? __kasan_kmalloc+0x8e/0xa0 [ 1224.966646][T12747] ? verify_lock_unused+0x140/0x140 [ 1224.971864][T12747] ? netlink_rcv_skb+0x26d/0x440 [ 1224.976912][T12747] should_fail_ex+0x390/0x4c0 [ 1224.981612][T12747] should_failslab+0x5/0x20 [ 1224.986135][T12747] slab_pre_alloc_hook+0x59/0x300 [ 1224.991184][T12747] kmem_cache_alloc+0x56/0x2f0 [ 1224.995969][T12747] ? skb_clone+0x1e7/0x370 [ 1225.000412][T12747] skb_clone+0x1e7/0x370 [ 1225.004677][T12747] __netlink_deliver_tap+0x3e4/0x7e0 [ 1225.009991][T12747] ? netlink_deliver_tap+0x2e/0x1b0 [ 1225.015206][T12747] netlink_deliver_tap+0x19c/0x1b0 [ 1225.020323][T12747] netlink_sendskb+0x64/0x130 [ 1225.025000][T12747] netlink_ack+0xcd1/0x1160 [ 1225.029511][T12747] ? netlink_dump+0xcd0/0xcd0 [ 1225.034179][T12747] ? __copy_skb_header+0x3ba/0x4f0 [ 1225.039286][T12747] ? __skb_clone+0x446/0x6c0 [ 1225.043874][T12747] netlink_rcv_skb+0x26d/0x440 [ 1225.048638][T12747] ? rtnetlink_bind+0x80/0x80 [ 1225.053386][T12747] ? netlink_ack+0x1160/0x1160 [ 1225.058151][T12747] ? netlink_deliver_tap+0x2e/0x1b0 [ 1225.063347][T12747] netlink_unicast+0x7ad/0x920 [ 1225.068112][T12747] netlink_sendmsg+0x8ad/0xbd0 [ 1225.072879][T12747] ? netlink_getsockopt+0x550/0x550 [ 1225.078076][T12747] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1225.083619][T12747] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1225.088966][T12747] ? security_socket_sendmsg+0x7c/0xa0 [ 1225.094422][T12747] sock_write_iter+0x2d5/0x3e0 [ 1225.099185][T12747] ? sock_read_iter+0x3a0/0x3a0 [ 1225.104035][T12747] ? common_file_perm+0x171/0x1c0 [ 1225.109057][T12747] vfs_write+0x482/0x9a0 [ 1225.113294][T12747] ? file_end_write+0x250/0x250 [ 1225.118139][T12747] ? __fget_files+0x3fc/0x460 [ 1225.122818][T12747] ? __fdget_pos+0x1d4/0x360 [ 1225.127401][T12747] ? ksys_write+0x70/0x260 [ 1225.131809][T12747] ksys_write+0x14d/0x260 [ 1225.136131][T12747] ? __ia32_sys_read+0x80/0x80 [ 1225.140893][T12747] ? lockdep_hardirqs_on+0x94/0x140 [ 1225.146087][T12747] do_syscall_64+0x4c/0xa0 [ 1225.150507][T12747] ? clear_bhb_loop+0x60/0xb0 [ 1225.155177][T12747] ? clear_bhb_loop+0x60/0xb0 [ 1225.159846][T12747] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1225.165740][T12747] RIP: 0033:0x7f456bb9fb19 [ 1225.170146][T12747] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1225.189743][T12747] RSP: 002b:00007f456c9e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1225.198149][T12747] RAX: ffffffffffffffda RBX: 00007f456be25fa0 RCX: 00007f456bb9fb19 [ 1225.206111][T12747] RDX: 00000000000001bc RSI: 0000200000000300 RDI: 0000000000000004 [ 1225.214076][T12747] RBP: 00007f456bc37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1225.222036][T12747] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1225.229994][T12747] R13: 00007f456be26038 R14: 00007f456be25fa0 R15: 00007fff888c4608 [ 1225.237974][T12747] [ 1225.464581][ T4277] EXT4-fs (loop1): unmounting filesystem. [ 1226.430210][T12756] loop4: detected capacity change from 0 to 64 [ 1226.657060][ T4285] hfs: request for non-existent node 131072 in B*Tree [ 1226.753346][T12652] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1227.766835][T12760] input: syz1 as /devices/virtual/input/input31 [ 1227.906129][T12652] usb 4-1: Using ep0 maxpacket: 16 [ 1227.924568][T12652] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1227.989907][T12652] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1228.027944][T12652] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1228.053189][T12652] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1228.086797][T12652] usb 4-1: Product: syz [ 1228.105780][T12652] usb 4-1: Manufacturer: syz [ 1228.110385][T12652] usb 4-1: SerialNumber: syz [ 1228.149547][T12652] usb 4-1: config 0 descriptor?? [ 1228.493177][T12652] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1228.663253][T12652] usb 2-1: device descriptor read/64, error -71 [ 1228.933154][T12652] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1229.093153][T12652] usb 2-1: device descriptor read/64, error -71 [ 1229.213505][T12652] usb usb2-port1: attempt power cycle [ 1229.228356][T12780] loop4: detected capacity change from 0 to 128 [ 1229.286189][T12780] syz.4.1945: attempt to access beyond end of device [ 1229.286189][T12780] loop4: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1229.354231][T12779] syz.4.1945: attempt to access beyond end of device [ 1229.354231][T12779] loop4: rw=524288, sector=145, nr_sectors = 79 limit=128 [ 1229.390523][T12780] syz.4.1945: attempt to access beyond end of device [ 1229.390523][T12780] loop4: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1229.415531][T12780] syz.4.1945: attempt to access beyond end of device [ 1229.415531][T12780] loop4: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1229.458319][ T4355] usb 4-1: USB disconnect, device number 18 [ 1229.466229][T12780] syz.4.1945: attempt to access beyond end of device [ 1229.466229][T12780] loop4: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1229.515098][T12780] syz.4.1945: attempt to access beyond end of device [ 1229.515098][T12780] loop4: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1229.639340][T12652] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1229.686627][T12652] usb 2-1: device descriptor read/8, error -71 [ 1229.973346][T12652] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1230.014344][T12652] usb 2-1: device descriptor read/8, error -71 [ 1230.133951][T12652] usb usb2-port1: unable to enumerate USB device [ 1230.794668][T12796] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[7910] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[12796] [ 1231.119513][T10092] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1231.595228][T10092] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1231.748167][T10092] usb 6-1: config 7 has an invalid interface number: 46 but max is 0 [ 1231.766790][T10092] usb 6-1: config 7 has no interface number 0 [ 1231.773004][T10092] usb 6-1: config 7 interface 46 altsetting 85 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 1231.804671][T10092] usb 6-1: config 7 interface 46 has no altsetting 0 [ 1231.852259][T10092] usb 6-1: New USB device found, idVendor=0bfd, idProduct=0114, bcdDevice=85.68 [ 1231.870923][T10092] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1231.893145][T10092] usb 6-1: Product: syz [ 1231.897381][T10092] usb 6-1: Manufacturer: syz [ 1231.903543][T10092] usb 6-1: SerialNumber: syz [ 1233.161210][T12810] loop4: detected capacity change from 0 to 32768 [ 1233.222798][T12810] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 1233.411482][ T4285] ocfs2: Unmounting device (7,4) on (node local) [ 1233.842452][T10092] kvaser_usb 6-1:7.46: Cannot get usb endpoint(s) [ 1233.966930][T10092] usb 6-1: USB disconnect, device number 9 [ 1234.493348][T10092] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1234.693181][T10092] usb 6-1: Using ep0 maxpacket: 16 [ 1234.710939][T10092] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1234.771826][T10092] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1234.823824][T10092] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1234.873274][T10092] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1234.913161][T10092] usb 6-1: Product: syz [ 1234.937696][T10092] usb 6-1: Manufacturer: syz [ 1234.942369][T10092] usb 6-1: SerialNumber: syz [ 1234.967907][T10092] usb 6-1: config 0 descriptor?? [ 1235.043345][T12827] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1960'. [ 1236.321076][T12835] loop4: detected capacity change from 0 to 32768 [ 1237.025669][T12841] loop1: detected capacity change from 0 to 512 [ 1237.177621][T12673] usb 6-1: USB disconnect, device number 10 [ 1237.367460][T12838] loop4: detected capacity change from 0 to 32768 [ 1237.484621][T12849] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1965'. [ 1238.174873][T12838] XFS (loop4): Mounting V5 Filesystem [ 1238.452327][T12838] XFS (loop4): Ending clean mount [ 1238.453189][T12673] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1238.491996][T12838] XFS (loop4): Quotacheck needed: Please wait. [ 1238.556609][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.563002][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 1238.635705][T12838] XFS (loop4): Quotacheck: Done. [ 1238.653198][T12673] usb 6-1: device descriptor read/64, error -71 [ 1239.113169][T12673] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1239.305203][ T4285] XFS (loop4): Unmounting Filesystem [ 1239.393183][T12673] usb 6-1: device descriptor read/64, error -71 [ 1239.533660][T12673] usb usb6-port1: attempt power cycle [ 1239.953243][T12673] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1240.003796][T12673] usb 6-1: device descriptor read/8, error -71 [ 1240.173193][ T9267] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1240.283226][T12673] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1240.315490][T12673] usb 6-1: device descriptor read/8, error -71 [ 1240.376674][T12871] loop3: detected capacity change from 0 to 8 [ 1240.434459][ T9267] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1240.453510][T12673] usb usb6-port1: unable to enumerate USB device [ 1240.473273][ T9267] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1240.520599][ T9267] usb 2-1: Product: syz [ 1240.543282][ T9267] usb 2-1: Manufacturer: syz [ 1240.656924][ T9267] usb 2-1: SerialNumber: syz [ 1242.262277][T12879] loop5: detected capacity change from 0 to 32768 [ 1242.293313][T12879] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 1242.301755][T12879] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 1242.341393][T12879] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 1242.354151][ T5081] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 1242.377409][ T5081] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 1244.185033][ T9267] rtl8150 2-1:1.0: couldn't reset the device [ 1244.207514][ T9267] rtl8150: probe of 2-1:1.0 failed with error -5 [ 1244.751945][ T5081] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 2374ms [ 1244.753420][ T7377] usb 2-1: USB disconnect, device number 11 [ 1244.839494][ T5081] gfs2: fsid=syz:syz.0: jid=0: Done [ 1244.875677][T12879] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 1247.053693][T12901] random: crng reseeded on system resumption [ 1249.923613][ T7377] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1250.086248][T12917] loop3: detected capacity change from 0 to 128 [ 1250.114161][T12917] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 1250.135715][ T7377] usb 2-1: config 0 has no interfaces? [ 1250.144850][ T7377] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1250.173332][T12917] hpfs: filesystem error: improperly stopped [ 1250.183432][ T7377] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1250.291419][T12917] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 1250.300149][ T7377] usb 2-1: Product: syz [ 1250.313134][ T7377] usb 2-1: Manufacturer: syz [ 1250.320284][T12917] hpfs: You really don't want any checks? You are crazy... [ 1250.328598][ T7377] usb 2-1: SerialNumber: syz [ 1250.333859][T12917] hpfs: hpfs_map_sector(): read error [ 1250.341266][ T7377] usb 2-1: config 0 descriptor?? [ 1250.346652][T12917] hpfs: code page support is disabled [ 1250.408171][T12921] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1986'. [ 1250.672855][T12917] hpfs: hpfs_map_4sectors(): unaligned read [ 1251.023222][T12917] hpfs: hpfs_map_4sectors(): unaligned read [ 1251.029782][T12917] hpfs: filesystem error: unable to find root dir [ 1251.234262][ T9267] usb 2-1: USB disconnect, device number 12 [ 1253.099930][T12940] random: crng reseeded on system resumption [ 1255.082174][T12957] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1255.296807][T12962] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1997'. [ 1258.452738][T12980] loop3: detected capacity change from 0 to 32768 [ 1259.306740][T12980] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 1259.972379][ T9840] ocfs2: Unmounting device (7,3) on (node local) [ 1260.440443][T13005] loop3: detected capacity change from 0 to 512 [ 1261.828126][T13018] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2010'. [ 1262.513253][ T9267] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1262.698232][T13031] random: crng reseeded on system resumption [ 1262.713856][ T9267] usb 4-1: config 0 has no interfaces? [ 1262.733461][ T9267] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1262.752747][ T9267] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1263.519775][ T9267] usb 4-1: Product: syz [ 1263.533546][ T9267] usb 4-1: Manufacturer: syz [ 1263.538188][ T9267] usb 4-1: SerialNumber: syz [ 1263.555932][ T9267] usb 4-1: config 0 descriptor?? [ 1263.765206][T12673] usb 4-1: USB disconnect, device number 19 [ 1264.491148][T13048] overlayfs: failed to clone upperpath [ 1265.887307][T13064] loop1: detected capacity change from 0 to 512 [ 1265.931697][T13064] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 1266.043442][T13064] EXT4-fs (loop1): 1 truncate cleaned up [ 1266.060189][T13064] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 1266.242067][T13064] EXT4-fs error (device loop1): ext4_generic_delete_entry:2731: inode #2: block 13: comm syz.1.2027: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 1266.321491][T13072] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2025'. [ 1266.454386][T13064] EXT4-fs (loop1): Remounting filesystem read-only [ 1266.535255][T13064] EXT4-fs error (device loop1) in ext4_delete_entry:2802: Corrupt filesystem [ 1266.610805][T13064] EXT4-fs (loop1): Remounting filesystem read-only [ 1266.662729][T13064] EXT4-fs warning (device loop1): ext4_rename_delete:3780: inode #2: comm syz.1.2027: Deleting old file: nlink 5, error=-117 [ 1267.356890][ T4277] EXT4-fs (loop1): unmounting filesystem. [ 1268.913612][T13085] loop1: detected capacity change from 0 to 131072 [ 1268.948384][T13085] F2FS-fs (loop1): Invalid segment/section count (458783, 24 x 150994945) [ 1268.957025][T13085] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 1268.965895][T13085] F2FS-fs (loop1): invalid crc value [ 1268.995475][T13085] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1269.037703][T13085] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 1269.044806][T13085] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 1269.082008][ T26] audit: type=1804 audit(1793651145.240:121): pid=13085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2030" name="/newroot/389/file1/bus" dev="loop1" ino=10 res=1 errno=0 [ 1270.666810][T13103] sctp: failed to load transform for md5: -2 [ 1270.899431][T13119] loop1: detected capacity change from 0 to 512 [ 1271.283536][T13126] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2039'. [ 1276.722272][T13163] loop1: detected capacity change from 0 to 512 [ 1276.991456][T13167] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2051'. [ 1277.213227][ T7377] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1277.868133][T13171] fuse: Bad value for 'fd' [ 1278.494538][ T7377] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1278.649137][ T7377] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1279.256417][ T7377] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1279.293151][ T7377] usb 4-1: Product: syz [ 1279.303167][ T7377] usb 4-1: Manufacturer: syz [ 1279.313156][ T7377] usb 4-1: SerialNumber: syz [ 1279.321013][ T7377] usb 4-1: config 0 descriptor?? [ 1279.386334][ T7377] snd-usb-audio: probe of 4-1:0.0 failed with error -22 [ 1279.452813][T12972] udevd[12972]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1279.549169][ T7377] usb 4-1: USB disconnect, device number 20 [ 1279.976255][T13169] loop1: detected capacity change from 0 to 32768 [ 1280.086193][T13169] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 1280.317187][ T4277] ocfs2: Unmounting device (7,1) on (node local) [ 1280.548388][T13201] overlayfs: failed to clone upperpath [ 1281.112818][T13207] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2063'. [ 1282.132852][T13220] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[4275] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[13220] [ 1283.554435][T13227] block device autoloading is deprecated and will be removed. [ 1284.362896][T13227] md: invalid raid superblock magic on ram3 [ 1284.438696][T13233] loop3: detected capacity change from 0 to 64 [ 1284.438845][T13227] md: ram3 does not have a valid v0.0 superblock, not importing! [ 1284.572076][T13227] md: md_import_device returned -22 [ 1285.176304][T13235] loop3: detected capacity change from 0 to 32768 [ 1285.274858][T13235] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 1285.370660][ T9840] ocfs2: Unmounting device (7,3) on (node local) [ 1286.424180][T13258] fuse: Bad value for 'fd' [ 1286.527355][T13260] loop1: detected capacity change from 0 to 512 [ 1286.627563][T13260] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 1286.683587][T13260] EXT4-fs (loop1): orphan cleanup on readonly fs [ 1286.692420][T13264] loop3: detected capacity change from 0 to 4096 [ 1286.771227][T13260] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.2078: bg 0: block 16: invalid block bitmap [ 1287.126924][T13260] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6195: Corrupt filesystem [ 1287.328706][T13260] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.2078: invalid indirect mapped block 5 (level 0) [ 1287.472077][T13260] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.2078: invalid indirect mapped block 4294967295 (level 1) [ 1287.493102][T13260] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.2078: invalid indirect mapped block 4294967295 (level 2) [ 1287.561687][T13274] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[7910] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[13274] [ 1287.893094][ T5080] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1288.079135][T13260] EXT4-fs (loop1): 1 truncate cleaned up [ 1288.115304][ T5080] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1288.118526][T13260] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 1288.142412][ T5080] usb 6-1: config 7 has an invalid interface number: 46 but max is 0 [ 1288.171069][ T5080] usb 6-1: config 7 has no interface number 0 [ 1288.186541][T13260] EXT4-fs (loop1): unmounting filesystem. [ 1288.191341][ T5080] usb 6-1: config 7 interface 46 altsetting 85 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 1288.335753][T13282] overlayfs: failed to clone upperpath [ 1288.544486][T13280] loop4: detected capacity change from 0 to 32768 [ 1288.552107][T12877] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1288.560820][ T5080] usb 6-1: config 7 interface 46 has no altsetting 0 [ 1288.570375][ T5080] usb 6-1: New USB device found, idVendor=0bfd, idProduct=0114, bcdDevice=85.68 [ 1288.580793][ T5080] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1288.589306][ T5080] usb 6-1: Product: syz [ 1288.593799][ T5080] usb 6-1: Manufacturer: syz [ 1288.598550][ T5080] usb 6-1: SerialNumber: syz [ 1288.635519][T13280] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 1288.753538][T12877] usb 4-1: Using ep0 maxpacket: 32 [ 1288.761024][T12877] usb 4-1: config 87 has an invalid interface number: 229 but max is 1 [ 1288.764904][ T4285] ocfs2: Unmounting device (7,4) on (node local) [ 1288.769864][T12877] usb 4-1: config 87 has no interface number 1 [ 1288.786604][T12877] usb 4-1: config 87 interface 229 has no altsetting 0 [ 1288.820560][T12877] usb 4-1: New USB device found, idVendor=0421, idProduct=042f, bcdDevice=1a.7c [ 1288.856329][T12877] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1288.879288][T12877] usb 4-1: Product: syz [ 1288.897318][T12877] usb 4-1: Manufacturer: syz [ 1288.897338][T12877] usb 4-1: SerialNumber: syz [ 1290.080566][ T5080] kvaser_usb 6-1:7.46: Cannot get usb endpoint(s) [ 1290.317958][ T5080] usb 6-1: USB disconnect, device number 15 [ 1290.923371][T12877] usb 4-1: bad CDC descriptors [ 1290.932476][T12877] usb 4-1: bad CDC descriptors [ 1290.976921][T12877] usb 4-1: USB disconnect, device number 21 [ 1293.312954][T13323] FAULT_INJECTION: forcing a failure. [ 1293.312954][T13323] name failslab, interval 1, probability 0, space 0, times 0 [ 1293.328080][T13323] CPU: 0 PID: 13323 Comm: syz.4.2099 Not tainted syzkaller #0 [ 1293.335572][T13323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1293.345644][T13323] Call Trace: [ 1293.348933][T13323] [ 1293.351874][T13323] dump_stack_lvl+0x188/0x24e [ 1293.356582][T13323] ? show_regs_print_info+0x12/0x12 [ 1293.361803][T13323] ? load_image+0x410/0x410 [ 1293.366325][T13323] ? __might_sleep+0xd0/0xd0 [ 1293.370930][T13323] ? __lock_acquire+0x7ea0/0x7ea0 [ 1293.375987][T13323] should_fail_ex+0x390/0x4c0 [ 1293.380685][T13323] should_failslab+0x5/0x20 [ 1293.385209][T13323] slab_pre_alloc_hook+0x59/0x300 [ 1293.390266][T13323] kmem_cache_alloc+0x56/0x2f0 [ 1293.395045][T13323] ? __alloc_file+0x25/0x230 [ 1293.399664][T13323] __alloc_file+0x25/0x230 [ 1293.404115][T13323] alloc_empty_file+0x90/0x180 [ 1293.408907][T13323] alloc_file+0x5b/0x5f0 [ 1293.413177][T13323] alloc_file_pseudo+0x180/0x200 [ 1293.418140][T13323] ? alloc_empty_file_noaccount+0x80/0x80 [ 1293.423872][T13323] ? raw_spin_rq_lock_nested+0x130/0x130 [ 1293.429521][T13323] ? alloc_anon_inode+0x22e/0x300 [ 1293.434564][T13323] ? memcpy+0x3c/0x60 [ 1293.438563][T13323] ? bpf_lsm_inode_init_security_anon+0x5/0x10 [ 1293.444825][T13323] ? security_inode_init_security_anon+0x7e/0xa0 [ 1293.451178][T13323] __anon_inode_getfile+0x22f/0x350 [ 1293.456472][T13323] ? anon_inode_getfile+0x1a0/0x1a0 [ 1293.461692][T13323] ? alloc_fd+0x590/0x640 [ 1293.466053][T13323] anon_inode_getfd_secure+0x4c/0x90 [ 1293.471368][T13323] new_userfaultfd+0x1e9/0x310 [ 1293.476147][T13323] __x64_sys_userfaultfd+0x7d/0x90 [ 1293.481275][T13323] do_syscall_64+0x4c/0xa0 [ 1293.485713][T13323] ? clear_bhb_loop+0x60/0xb0 [ 1293.490413][T13323] ? clear_bhb_loop+0x60/0xb0 [ 1293.495112][T13323] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1293.501025][T13323] RIP: 0033:0x7f17dbb9fb19 [ 1293.505451][T13323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1293.525066][T13323] RSP: 002b:00007f17dc9bc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000143 [ 1293.533504][T13323] RAX: ffffffffffffffda RBX: 00007f17dbe26090 RCX: 00007f17dbb9fb19 [ 1293.541490][T13323] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000080801 [ 1293.549473][T13323] RBP: 00007f17dbc37af8 R08: 0000000000000000 R09: 0000000000000000 [ 1293.557457][T13323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1293.565436][T13323] R13: 00007f17dbe26128 R14: 00007f17dbe26090 R15: 00007ffd75c3f508 [ 1293.573436][T13323] [ 1293.576554][ C0] vkms_vblank_simulate: vblank timer overrun [ 1294.550899][T13330] random: crng reseeded on system resumption [ 1294.722523][T13326] loop5: detected capacity change from 0 to 32768 [ 1295.974100][T13326] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 1296.056882][ T7910] ocfs2: Unmounting device (7,5) on (node local) [ 1296.557060][T13346] fuse: Bad value for 'fd' [ 1298.816895][T13376] random: crng reseeded on system resumption [ 1298.846685][T13355] loop5: detected capacity change from 0 to 40427 [ 1298.888117][T13355] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 1298.906246][T13355] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 1300.081780][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.090533][T13355] F2FS-fs (loop5): invalid crc value [ 1300.098209][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.130506][T13355] F2FS-fs (loop5): Failed to start F2FS issue_checkpoint_thread (-12) [ 1300.443315][ T7377] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1300.634697][ T7377] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1300.634736][ T7377] usb 5-1: config 0 interface 0 altsetting 251 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1300.634754][ T7377] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1300.636773][ T7377] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1300.636801][ T7377] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1300.636821][ T7377] usb 5-1: Product: syz [ 1300.636836][ T7377] usb 5-1: Manufacturer: syz [ 1300.636851][ T7377] usb 5-1: SerialNumber: syz [ 1300.638578][ T7377] usb 5-1: config 0 descriptor?? [ 1300.682870][ T7377] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 1300.785294][T13298] udevd[13298]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1300.847619][ T7377] usb 5-1: USB disconnect, device number 12 [ 1301.226935][T13397] netlink: 'syz.3.2122': attribute type 3 has an invalid length. [ 1301.243197][T13397] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2122'. [ 1301.289836][T13399] loop1: detected capacity change from 0 to 512 [ 1301.377187][T13399] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 1301.427912][T13399] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.2119: invalid indirect mapped block 256 (level 1) [ 1303.071896][T13399] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.2119: invalid indirect mapped block 2683928664 (level 1) [ 1303.221190][T13399] EXT4-fs (loop1): 1 truncate cleaned up [ 1303.241190][T13399] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 1303.619885][T13423] snd_dummy snd_dummy.0: control 5:245:0:syz0:0 is already present [ 1304.268731][ T4277] EXT4-fs (loop1): unmounting filesystem. [ 1304.625824][T13433] loop4: detected capacity change from 0 to 32768 [ 1304.698979][T13433] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 1304.805651][ T4285] ocfs2: Unmounting device (7,4) on (node local) [ 1306.724181][ T9267] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1306.954094][ T9267] usb 5-1: config 0 interface 0 altsetting 251 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1307.592778][ T9267] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1308.454053][ T9267] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1308.614065][ T9267] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1308.739716][ T9267] usb 5-1: Product: syz [ 1308.763109][ T9267] usb 5-1: Manufacturer: syz [ 1308.788137][ T9267] usb 5-1: SerialNumber: syz [ 1308.851023][ T9267] usb 5-1: config 0 descriptor?? [ 1309.659349][T13459] loop3: detected capacity change from 0 to 131072 [ 1309.675538][ T9267] usb 5-1: can't set config #0, error -71 [ 1309.682590][ T9267] usb 5-1: USB disconnect, device number 13 [ 1309.689479][T13459] F2FS-fs (loop3): Invalid segment/section count (458783, 24 x 150994945) [ 1309.698067][T13459] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 1309.717947][T13459] F2FS-fs (loop3): invalid crc value [ 1309.761917][T13459] F2FS-fs (loop3): Found nat_bits in checkpoint [ 1309.811398][T13459] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 1309.818867][T13459] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 1309.833413][ T26] audit: type=1804 audit(1793651186.000:122): pid=13459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.2139" name="/newroot/161/file1/bus" dev="loop3" ino=10 res=1 errno=0 [ 1309.937270][T13467] loop5: detected capacity change from 0 to 256 [ 1310.053974][T13469] loop4: detected capacity change from 0 to 512 [ 1310.113559][T13469] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 1310.161890][T13469] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.2142: invalid indirect mapped block 256 (level 1) [ 1310.235221][T13469] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.2142: invalid indirect mapped block 2683928664 (level 1) [ 1310.287212][T13469] EXT4-fs (loop4): 1 truncate cleaned up [ 1310.295638][T13473] loop5: detected capacity change from 0 to 128 [ 1310.324175][T13469] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 1310.669190][T13478] snd_dummy snd_dummy.0: control 5:245:0:syz0:0 is already present [ 1311.141368][T13473] syz.5.2144: attempt to access beyond end of device [ 1311.141368][T13473] loop5: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1311.260915][ T4285] EXT4-fs (loop4): unmounting filesystem. [ 1311.274693][T13473] syz.5.2144: attempt to access beyond end of device [ 1311.274693][T13473] loop5: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1311.334996][T13488] fuse: Bad value for 'fd' [ 1312.366605][T13498] sctp: [Deprecated]: syz.3.2150 (pid 13498) Use of int in max_burst socket option deprecated. [ 1312.366605][T13498] Use struct sctp_assoc_value instead [ 1312.829931][T13500] loop1: detected capacity change from 0 to 131072 [ 1312.863515][T13500] F2FS-fs (loop1): Invalid segment/section count (458783, 24 x 150994945) [ 1312.872099][T13500] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 1312.881386][T13500] F2FS-fs (loop1): invalid crc value [ 1312.903885][T13500] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1312.957530][T13500] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 1312.964630][T13500] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 1313.007120][ T26] audit: type=1804 audit(1793651189.170:123): pid=13500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2153" name="/newroot/412/file1/bus" dev="loop1" ino=10 res=1 errno=0 [ 1314.847832][T13527] fuse: Bad value for 'fd' [ 1315.318118][T13530] loop5: detected capacity change from 0 to 512 [ 1315.344907][T13536] loop3: detected capacity change from 0 to 128 [ 1315.449546][T13536] syz.3.2162: attempt to access beyond end of device [ 1315.449546][T13536] loop3: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1315.463272][T13530] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2 [ 1315.482598][T13530] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.2161: invalid indirect mapped block 256 (level 1) [ 1315.523959][T13530] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.2161: invalid indirect mapped block 2683928664 (level 1) [ 1315.560536][T13543] sctp: [Deprecated]: syz.0.2164 (pid 13543) Use of int in max_burst socket option deprecated. [ 1315.560536][T13543] Use struct sctp_assoc_value instead [ 1315.586386][T13530] EXT4-fs (loop5): 1 truncate cleaned up [ 1315.591771][T13536] syz.3.2162: attempt to access beyond end of device [ 1315.591771][T13536] loop3: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1315.622634][T13530] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1316.222140][T13546] snd_dummy snd_dummy.0: control 5:245:0:syz0:0 is already present [ 1316.436031][T13539] EXT4-fs error (device loop5): ext4_read_block_bitmap_nowait:477: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 1316.505456][ T7910] EXT4-fs (loop5): unmounting filesystem. [ 1316.838864][T13552] loop4: detected capacity change from 0 to 256 [ 1319.709347][T13575] sctp: [Deprecated]: syz.0.2175 (pid 13575) Use of int in max_burst socket option deprecated. [ 1319.709347][T13575] Use struct sctp_assoc_value instead [ 1319.818177][ T9268] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1320.662729][T13583] loop4: detected capacity change from 0 to 128 [ 1320.773108][ T9268] usb 6-1: Using ep0 maxpacket: 32 [ 1320.778553][T13587] loop3: detected capacity change from 0 to 2048 [ 1320.779840][ T9268] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 1320.809315][ T9268] usb 6-1: config 0 has no interface number 0 [ 1320.838416][T13587] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1320.838850][ T9268] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1320.864323][ T9268] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1320.872460][ T9268] usb 6-1: Product: syz [ 1320.901161][T13591] loop1: detected capacity change from 0 to 256 [ 1320.907820][ T9268] usb 6-1: Manufacturer: syz [ 1320.912505][ T9268] usb 6-1: SerialNumber: syz [ 1321.958091][ T9268] usb 6-1: config 0 descriptor?? [ 1322.129677][ T9268] smsc95xx v2.0.0 [ 1322.274047][T13603] loop4: detected capacity change from 0 to 64 [ 1322.700151][T13618] overlayfs: failed to clone upperpath [ 1323.178064][ T9268] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 1323.213465][ T9268] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1323.520511][ T9268] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1323.532257][ T9268] smsc95xx: probe of 6-1:0.67 failed with error -71 [ 1323.543908][ T9268] usb 6-1: USB disconnect, device number 16 [ 1323.929692][T13643] loop4: detected capacity change from 0 to 512 [ 1323.939957][T13643] EXT4-fs: Ignoring removed bh option [ 1323.945786][T13643] EXT4-fs: quotafile must be on filesystem root [ 1324.119014][T13640] loop3: detected capacity change from 0 to 2048 [ 1324.426670][T13640] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1325.620193][T13650] loop3: detected capacity change from 0 to 131072 [ 1325.627619][T13650] F2FS-fs (loop3): Invalid segment/section count (458783, 24 x 150994945) [ 1325.636193][T13650] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 1325.646888][T13650] F2FS-fs (loop3): invalid crc value [ 1325.799569][T13657] loop4: detected capacity change from 0 to 64 [ 1325.826686][T13650] F2FS-fs (loop3): Found nat_bits in checkpoint [ 1325.904366][T13650] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 1325.911443][T13650] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 1328.041016][T13692] loop4: detected capacity change from 0 to 512 [ 1328.052531][T13692] EXT4-fs: Ignoring removed bh option [ 1328.058401][T13692] EXT4-fs: quotafile must be on filesystem root [ 1330.110097][T13704] loop3: detected capacity change from 0 to 64 [ 1330.466156][T13713] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2216'. [ 1331.623292][T13725] fuse: Bad value for 'fd' [ 1333.109518][T13748] loop3: detected capacity change from 0 to 512 [ 1333.123575][T13748] EXT4-fs: Ignoring removed bh option [ 1333.129262][T13748] EXT4-fs: quotafile must be on filesystem root [ 1333.228945][T13748] loop3: detected capacity change from 0 to 512 [ 1333.307239][T13748] EXT4-fs error (device loop3): ext4_orphan_get:1409: inode #15: comm syz.3.2227: iget: bad i_size value: 38620345925642 [ 1333.321365][T13748] EXT4-fs error (device loop3): ext4_orphan_get:1414: comm syz.3.2227: couldn't read orphan inode 15 (err -117) [ 1333.345886][T13748] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 1333.512421][T13754] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.2227: bg 0: block 5: invalid block bitmap [ 1333.526334][T13754] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 560 with error 28 [ 1333.538911][T13754] EXT4-fs (loop3): This should not happen!! Data will be lost [ 1333.538911][T13754] [ 1333.548727][T13754] EXT4-fs (loop3): Total free blocks count 0 [ 1333.554793][T13754] EXT4-fs (loop3): Free/Dirty block details [ 1333.561294][T13754] EXT4-fs (loop3): free_blocks=0 [ 1333.566465][T13754] EXT4-fs (loop3): dirty_blocks=560 [ 1333.571754][T13754] EXT4-fs (loop3): Block reservation details [ 1334.069592][T13753] loop1: detected capacity change from 0 to 131072 [ 1334.081548][T13754] EXT4-fs (loop3): i_reserved_data_blocks=560 [ 1334.085350][T13753] F2FS-fs (loop1): Invalid segment/section count (458783, 24 x 150994945) [ 1334.096316][T13753] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 1334.111519][T13753] F2FS-fs (loop1): invalid crc value [ 1334.130397][T13753] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1334.162329][T13753] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 1334.169511][T13753] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 1334.542731][ T9840] EXT4-fs (loop3): unmounting filesystem. [ 1336.920081][T13794] loop5: detected capacity change from 0 to 8 [ 1338.893101][ T7457] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1339.085590][ T7457] usb 5-1: config 0 interface 0 altsetting 251 has an invalid endpoint with address 0x0, skipping [ 1339.135573][ T7457] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1339.168553][ T7457] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1339.234379][ T7457] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1339.242799][ T7457] usb 5-1: Product: syz [ 1339.261779][ T7457] usb 5-1: Manufacturer: syz [ 1339.268075][ T7457] usb 5-1: SerialNumber: syz [ 1339.281772][ T7457] usb 5-1: config 0 descriptor?? [ 1339.339928][ T7457] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 1339.357879][T13298] udevd[13298]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1339.372451][T13829] loop5: detected capacity change from 0 to 256 [ 1339.513341][ T7377] usb 5-1: USB disconnect, device number 14 [ 1339.658997][T13835] fuse: Bad value for 'fd' [ 1339.808735][T13838] loop3: detected capacity change from 0 to 64 [ 1341.591436][ T5081] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1341.808798][ T5081] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1341.828383][ T5081] usb 6-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 1341.837748][ T5081] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1341.885433][ T5081] usb 6-1: Product: syz [ 1341.911176][ T5081] usb 6-1: Manufacturer: syz [ 1341.952736][ T5081] usb 6-1: SerialNumber: syz [ 1342.005972][ T5081] ums-karma 6-1:1.0: USB Mass Storage device detected [ 1342.097019][ T5081] ums-karma 6-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1342.097019][ T5081] Please send a copy of this message to and [ 1342.227170][T13857] FAULT_INJECTION: forcing a failure. [ 1342.227170][T13857] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1342.253365][T13857] CPU: 1 PID: 13857 Comm: syz.4.2260 Not tainted syzkaller #0 [ 1342.260857][T13857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1342.270904][T13857] Call Trace: [ 1342.274177][T13857] [ 1342.277112][T13857] dump_stack_lvl+0x188/0x24e [ 1342.281802][T13857] ? show_regs_print_info+0x12/0x12 [ 1342.286989][T13857] ? load_image+0x410/0x410 [ 1342.291482][T13857] ? __cgroup_rstat_updated+0xce/0x350 [ 1342.296926][T13857] ? rcu_read_lock_sched_held+0x86/0x110 [ 1342.302546][T13857] ? sched_slice+0x430/0x430 [ 1342.307126][T13857] should_fail_ex+0x390/0x4c0 [ 1342.311786][T13857] get_futex_key+0x1a6/0xe70 [ 1342.316359][T13857] ? futex_setup_timer+0xc0/0xc0 [ 1342.321275][T13857] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 1342.327240][T13857] ? __lock_acquire+0x7ea0/0x7ea0 [ 1342.332249][T13857] ? lock_chain_count+0x20/0x20 [ 1342.337086][T13857] futex_wait_setup+0xb8/0x270 [ 1342.341834][T13857] ? futex_wait_multiple+0x970/0x970 [ 1342.347098][T13857] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1342.352973][T13857] ? _raw_spin_unlock+0x40/0x40 [ 1342.357810][T13857] futex_wait+0x1cb/0x640 [ 1342.362126][T13857] ? futex_wait_setup+0x270/0x270 [ 1342.367150][T13857] do_futex+0x310/0x320 [ 1342.371293][T13857] ? __ia32_sys_get_robust_list+0x100/0x100 [ 1342.377169][T13857] ? kasan_quarantine_put+0xd4/0x210 [ 1342.382440][T13857] __se_sys_futex+0x381/0x410 [ 1342.387100][T13857] ? __x64_sys_sched_setattr+0x80/0x80 [ 1342.392544][T13857] ? __x64_sys_futex+0xf0/0xf0 [ 1342.397295][T13857] ? __x64_sys_futex+0x1d/0xf0 [ 1342.402042][T13857] do_syscall_64+0x4c/0xa0 [ 1342.406458][T13857] ? clear_bhb_loop+0x60/0xb0 [ 1342.411139][T13857] ? clear_bhb_loop+0x60/0xb0 [ 1342.415812][T13857] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1342.421711][T13857] RIP: 0033:0x7f17dbb9fb19 [ 1342.426115][T13857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1342.445710][T13857] RSP: 002b:00007f17dc9dd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1342.454107][T13857] RAX: ffffffffffffffda RBX: 00007f17dbe25fa8 RCX: 00007f17dbb9fb19 [ 1342.462063][T13857] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f17dbe25fa8 [ 1342.470019][T13857] RBP: 00007f17dbe25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1342.477977][T13857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1342.485934][T13857] R13: 00007f17dbe26038 R14: 00007ffd75c3f420 R15: 00007ffd75c3f508 [ 1342.493897][T13857] [ 1342.800079][ T5081] usb 6-1: USB disconnect, device number 17 [ 1342.860355][T13862] loop4: detected capacity change from 0 to 256 [ 1346.882867][T13903] loop5: detected capacity change from 0 to 256 [ 1349.263069][T13901] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1349.444690][T13901] usb 5-1: config 0 interface 0 altsetting 251 has an invalid endpoint with address 0x0, skipping [ 1349.476142][T13901] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1349.514940][T13901] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1349.568526][T13901] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1349.612820][T13901] usb 5-1: Product: syz [ 1349.641008][T13901] usb 5-1: Manufacturer: syz [ 1349.661875][T13901] usb 5-1: SerialNumber: syz [ 1349.675010][T13901] usb 5-1: config 0 descriptor?? [ 1349.702218][T13901] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 1349.738407][T13298] udevd[13298]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1349.888802][ T5081] usb 5-1: USB disconnect, device number 15 [ 1350.420477][T13933] loop1: detected capacity change from 0 to 4096 [ 1350.470231][T13933] ntfs3: loop1: Different NTFS' sector size (1024) and media sector size (512) [ 1350.589390][T13933] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 1350.712811][T13937] loop4: detected capacity change from 0 to 256 [ 1350.764765][ T9791] ntfs3: loop1: ntfs3_write_inode r=1a failed, -22. [ 1350.773072][ T4277] ntfs3: loop1: ntfs_sync_fs r=1a failed, -22. [ 1350.791429][ T4277] ntfs3: loop1: ntfs_evict_inode r=1a failed, -22. [ 1352.195513][T13948] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1352.218260][ T26] audit: type=1800 audit(1793651228.380:124): pid=13948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2290" name="attr_allow_any_host" dev="configfs" ino=56555 res=0 errno=0 [ 1353.353118][ T9268] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1353.553261][ T9268] usb 5-1: Using ep0 maxpacket: 16 [ 1353.572759][ T9268] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1353.649366][ T9268] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1353.699837][ T9268] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.743838][ T9268] usb 5-1: Product: syz [ 1353.793838][ T9268] usb 5-1: Manufacturer: syz [ 1353.879904][ T9268] usb 5-1: SerialNumber: syz [ 1354.632796][ T9268] usb 5-1: config 0 descriptor?? [ 1354.644437][ T9268] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1354.663127][ T9268] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 1355.196682][ T5081] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1355.260966][ T9268] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 1355.433667][ T5081] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1355.466199][ T5081] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1355.515814][ T5081] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1355.563107][ T5081] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1355.604048][ T5081] usb 4-1: Product: syz [ 1355.628048][ T5081] usb 4-1: Manufacturer: syz [ 1355.661207][ T5081] usb 4-1: SerialNumber: syz [ 1355.681524][ T9268] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1355.720646][ T5081] usb 4-1: config 0 descriptor?? [ 1355.730111][ T9268] em28xx 5-1:0.0: board has no eeprom [ 1355.773062][ T5081] usb 4-1: selecting invalid altsetting 0 [ 1356.004183][ T5081] usb 4-1: USB disconnect, device number 22 [ 1356.073118][ T9268] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1356.101301][ T9268] em28xx 5-1:0.0: dvb set to bulk mode. [ 1356.121840][ T9268] usb 5-1: USB disconnect, device number 16 [ 1356.143588][ T9268] em28xx 5-1:0.0: Disconnecting em28xx [ 1356.159829][ T4353] em28xx 5-1:0.0: Binding DVB extension [ 1356.201871][T13973] loop5: detected capacity change from 0 to 4096 [ 1356.263343][T13973] ntfs3: loop5: Different NTFS' sector size (1024) and media sector size (512) [ 1356.409855][ T4353] em28xx 5-1:0.0: Registering input extension [ 1356.453600][ T9268] em28xx 5-1:0.0: Closing input extension [ 1356.488937][ T9268] em28xx 5-1:0.0: Freeing device [ 1356.586787][T13973] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 1356.782130][T13976] loop1: detected capacity change from 0 to 128 [ 1356.830125][ T9774] ntfs3: loop5: ntfs3_write_inode r=1a failed, -22. [ 1356.856483][ T7910] ntfs3: loop5: ntfs_sync_fs r=1a failed, -22. [ 1356.910539][ T7910] ntfs3: loop5: ntfs_evict_inode r=1a failed, -22. [ 1360.769927][T14006] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1361.359504][ T26] audit: type=1800 audit(1793651237.000:125): pid=14006 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2304" name="attr_allow_any_host" dev="configfs" ino=56610 res=0 errno=0 [ 1361.436326][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.442664][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.632797][T14009] loop5: detected capacity change from 0 to 32768 [ 1361.697688][T14009] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 1361.783854][ T7910] ocfs2: Unmounting device (7,5) on (node local) [ 1363.562634][T14027] overlayfs: failed to clone upperpath [ 1363.671979][T14025] loop3: detected capacity change from 0 to 4096 [ 1363.728755][T14029] FAULT_INJECTION: forcing a failure. [ 1363.728755][T14029] name failslab, interval 1, probability 0, space 0, times 0 [ 1363.742104][T14029] CPU: 0 PID: 14029 Comm: syz.1.2307 Not tainted syzkaller #0 [ 1363.749582][T14029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1363.759652][T14029] Call Trace: [ 1363.762940][T14029] [ 1363.765884][T14029] dump_stack_lvl+0x188/0x24e [ 1363.770589][T14029] ? lock_chain_count+0x20/0x20 [ 1363.775460][T14029] ? show_regs_print_info+0x12/0x12 [ 1363.780677][T14029] ? load_image+0x410/0x410 [ 1363.785191][T14029] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 1363.791115][T14029] should_fail_ex+0x390/0x4c0 [ 1363.795824][T14029] should_failslab+0x5/0x20 [ 1363.800342][T14029] slab_pre_alloc_hook+0x59/0x300 [ 1363.805376][T14029] ? hash_ipport6_add+0x1811/0x2040 [ 1363.810656][T14029] __kmem_cache_alloc_node+0x4f/0x270 [ 1363.816025][T14029] ? hash_ipport6_add+0x1811/0x2040 [ 1363.821211][T14029] __kmalloc+0xa3/0x240 [ 1363.825354][T14029] hash_ipport6_add+0x1811/0x2040 [ 1363.830378][T14029] hash_ipport6_uadt+0x770/0x9b0 [ 1363.835302][T14029] ? hash_ipport6_uadt+0x9b0/0x9b0 [ 1363.840412][T14029] ? hash_ipport6_kadt+0x480/0x480 [ 1363.845541][T14029] call_ad+0x181/0xb00 [ 1363.849707][T14029] ? ip_set_ad+0x9c0/0x9c0 [ 1363.854160][T14029] ? __nla_parse+0x3c/0x50 [ 1363.858569][T14029] ip_set_ad+0x816/0x9c0 [ 1363.862806][T14029] ? ip_set_dump_done+0x310/0x310 [ 1363.867834][T14029] nfnetlink_rcv_msg+0xcab/0x1290 [ 1363.872899][T14029] ? nfnetlink_rcv_msg+0x224/0x1290 [ 1363.878097][T14029] ? nfnetlink_unbind+0x160/0x160 [ 1363.883107][T14029] ? kasan_save_free_info+0x27/0x40 [ 1363.888320][T14029] netlink_rcv_skb+0x1ef/0x440 [ 1363.893083][T14029] ? nfnetlink_unbind+0x160/0x160 [ 1363.898116][T14029] ? netlink_ack+0x1160/0x1160 [ 1363.902870][T14029] ? bpf_lsm_capable+0x5/0x10 [ 1363.907534][T14029] ? security_capable+0x85/0xb0 [ 1363.912388][T14029] nfnetlink_rcv+0x2b0/0x2470 [ 1363.917057][T14029] ? __local_bh_enable_ip+0x136/0x1c0 [ 1363.922468][T14029] ? _local_bh_enable+0xa0/0xa0 [ 1363.927306][T14029] ? __dev_queue_xmit+0x274/0x3a70 [ 1363.932447][T14029] ? __dev_queue_xmit+0x274/0x3a70 [ 1363.937546][T14029] ? __dev_queue_xmit+0x1496/0x3a70 [ 1363.942731][T14029] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 1363.948269][T14029] ? ref_tracker_free+0x682/0x830 [ 1363.953284][T14029] ? refcount_inc+0x70/0x70 [ 1363.957770][T14029] ? memcpy+0x3c/0x60 [ 1363.961756][T14029] ? __copy_skb_header+0x3ba/0x4f0 [ 1363.966854][T14029] ? __skb_clone+0x446/0x6c0 [ 1363.971434][T14029] ? netlink_deliver_tap+0x2e/0x1b0 [ 1363.976626][T14029] ? __netlink_deliver_tap+0x7a9/0x7e0 [ 1363.982076][T14029] ? __lock_acquire+0x7ea0/0x7ea0 [ 1363.987091][T14029] ? netlink_deliver_tap+0x2e/0x1b0 [ 1363.992278][T14029] netlink_unicast+0x7ad/0x920 [ 1363.997057][T14029] netlink_sendmsg+0x8ad/0xbd0 [ 1364.001813][T14029] ? netlink_getsockopt+0x550/0x550 [ 1364.007002][T14029] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1364.012533][T14029] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1364.017800][T14029] ? security_socket_sendmsg+0x7c/0xa0 [ 1364.023243][T14029] ? netlink_getsockopt+0x550/0x550 [ 1364.028447][T14029] ____sys_sendmsg+0x5ed/0x9a0 [ 1364.033215][T14029] ? __sys_sendmsg_sock+0x30/0x30 [ 1364.038225][T14029] ? __import_iovec+0x306/0x510 [ 1364.043106][T14029] ? import_iovec+0x6f/0xa0 [ 1364.047609][T14029] ___sys_sendmsg+0x2a2/0x360 [ 1364.052274][T14029] ? __sys_sendmsg+0x2a0/0x2a0 [ 1364.057046][T14029] __se_sys_sendmsg+0x1c3/0x2b0 [ 1364.061885][T14029] ? __x64_sys_sendmsg+0x80/0x80 [ 1364.066813][T14029] ? lockdep_hardirqs_on+0x94/0x140 [ 1364.071999][T14029] do_syscall_64+0x4c/0xa0 [ 1364.076402][T14029] ? clear_bhb_loop+0x60/0xb0 [ 1364.081070][T14029] ? clear_bhb_loop+0x60/0xb0 [ 1364.085736][T14029] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1364.091621][T14029] RIP: 0033:0x7f2fdb79fb19 [ 1364.096024][T14029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1364.115617][T14029] RSP: 002b:00007f2fdc5a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1364.124014][T14029] RAX: ffffffffffffffda RBX: 00007f2fdba25fa0 RCX: 00007f2fdb79fb19 [ 1364.131975][T14029] RDX: 0000000000000080 RSI: 00002000000007c0 RDI: 0000000000000005 [ 1364.139931][T14029] RBP: 00007f2fdb837af8 R08: 0000000000000000 R09: 0000000000000000 [ 1364.147888][T14029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1364.155846][T14029] R13: 00007f2fdba26038 R14: 00007f2fdba25fa0 R15: 00007ffff8b6ba48 [ 1364.163812][T14029] [ 1364.513082][ T4353] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1364.753215][ T4353] usb 4-1: Using ep0 maxpacket: 32 [ 1364.760585][ T4353] usb 4-1: config 87 has an invalid interface number: 229 but max is 1 [ 1364.870757][ T4353] usb 4-1: config 87 has no interface number 1 [ 1364.902544][ T4353] usb 4-1: config 87 interface 229 has no altsetting 0 [ 1364.942620][ T4353] usb 4-1: New USB device found, idVendor=0421, idProduct=042f, bcdDevice=1a.7c [ 1364.957300][T14038] loop5: detected capacity change from 0 to 128 [ 1365.010199][ T4353] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1365.052156][T14038] syz.5.2312: attempt to access beyond end of device [ 1365.052156][T14038] loop5: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1365.076199][ T4353] usb 4-1: Product: syz [ 1365.080388][ T4353] usb 4-1: Manufacturer: syz [ 1365.121469][ T4353] usb 4-1: SerialNumber: syz [ 1365.174900][T14037] syz.5.2312: attempt to access beyond end of device [ 1365.174900][T14037] loop5: rw=524288, sector=145, nr_sectors = 79 limit=128 [ 1365.215933][T14038] syz.5.2312: attempt to access beyond end of device [ 1365.215933][T14038] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1365.283232][T14038] syz.5.2312: attempt to access beyond end of device [ 1365.283232][T14038] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1365.310673][T14038] syz.5.2312: attempt to access beyond end of device [ 1365.310673][T14038] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1365.357097][T14038] syz.5.2312: attempt to access beyond end of device [ 1365.357097][T14038] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1365.372222][ T4353] usb 4-1: bad CDC descriptors [ 1365.397661][ T4353] usb 4-1: bad CDC descriptors [ 1365.443125][ T9268] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1365.463344][ T4353] usb 4-1: USB disconnect, device number 23 [ 1366.345117][ T9268] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1366.355271][ T9268] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1366.375337][ T9268] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1366.393082][ T9268] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1366.411673][ T9268] usb 5-1: Product: syz [ 1366.416797][ T9268] usb 5-1: Manufacturer: syz [ 1366.421415][ T9268] usb 5-1: SerialNumber: syz [ 1366.453136][ T9268] usb 5-1: config 0 descriptor?? [ 1366.472069][ T9268] usb 5-1: selecting invalid altsetting 0 [ 1366.693846][ T4366] usb 5-1: USB disconnect, device number 17 [ 1366.820139][T14051] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2320'. [ 1367.327135][T14052] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1367.904830][ T26] audit: type=1800 audit(1793651243.540:126): pid=14052 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2320" name="attr_allow_any_host" dev="configfs" ino=56652 res=0 errno=0 [ 1369.953217][ T4366] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 1370.124080][T14072] overlayfs: failed to clone upperpath [ 1370.143144][ T4366] usb 5-1: Using ep0 maxpacket: 16 [ 1370.150598][ T4366] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1370.174212][ T4366] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1370.192236][ T4366] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1370.226969][ T4366] usb 5-1: Product: syz [ 1370.245837][ T4366] usb 5-1: Manufacturer: syz [ 1370.255482][ T4366] usb 5-1: SerialNumber: syz [ 1370.284566][ T4366] usb 5-1: config 0 descriptor?? [ 1370.329147][ T4366] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1370.364210][T14074] loop3: detected capacity change from 0 to 32768 [ 1370.366167][ T4366] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 1370.455039][T14074] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 1370.567332][ T9840] ocfs2: Unmounting device (7,3) on (node local) [ 1370.669052][T14080] loop3: detected capacity change from 0 to 128 [ 1370.710845][T14080] syz.3.2328: attempt to access beyond end of device [ 1370.710845][T14080] loop3: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1371.429208][ T4366] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 1371.486931][T14079] syz.3.2328: attempt to access beyond end of device [ 1371.486931][T14079] loop3: rw=524288, sector=145, nr_sectors = 79 limit=128 [ 1371.540165][T14080] syz.3.2328: attempt to access beyond end of device [ 1371.540165][T14080] loop3: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1371.561249][T14088] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2331'. [ 1371.612420][T14080] syz.3.2328: attempt to access beyond end of device [ 1371.612420][T14080] loop3: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1371.698163][T14080] syz.3.2328: attempt to access beyond end of device [ 1371.698163][T14080] loop3: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1372.052454][ T4366] em28xx 5-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 1374.190159][ T4366] em28xx 5-1:0.0: board has no eeprom [ 1374.246624][T14089] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1374.260210][ T26] audit: type=1800 audit(1793651250.420:127): pid=14089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2331" name="attr_allow_any_host" dev="configfs" ino=57369 res=0 errno=0 [ 1374.283253][ T4366] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1374.296856][ T4366] em28xx 5-1:0.0: dvb set to bulk mode. [ 1374.334274][ T4366] usb 5-1: USB disconnect, device number 18 [ 1374.341497][T12673] em28xx 5-1:0.0: Binding DVB extension [ 1374.408909][ T4366] em28xx 5-1:0.0: Disconnecting em28xx [ 1374.740627][T12673] em28xx 5-1:0.0: Registering input extension [ 1374.751209][ T4366] em28xx 5-1:0.0: Closing input extension [ 1374.798007][ T4366] em28xx 5-1:0.0: Freeing device [ 1374.823197][ T7377] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1375.003086][ T9268] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1375.783174][ T7377] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1375.793171][ T7377] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1375.826280][ T7377] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1375.853796][ T7377] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1375.883091][ T7377] usb 4-1: Product: syz [ 1375.887301][ T7377] usb 4-1: Manufacturer: syz [ 1375.891898][ T7377] usb 4-1: SerialNumber: syz [ 1375.920770][ T9268] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1375.942752][ T9268] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1375.954158][ T7377] usb 4-1: config 0 descriptor?? [ 1375.963293][ T9268] usb 6-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 1375.972464][ T9268] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1376.005328][ T7377] usb 4-1: selecting invalid altsetting 0 [ 1376.199172][ T4366] usb 4-1: USB disconnect, device number 24 [ 1376.731971][T14113] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1376.731971][T14113] [ 1376.745822][T14113] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1376.758413][T14113] CIFS: Attempting to mount \\127.0.0.1\share [ 1376.765481][T14113] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1376.773201][T14113] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1379.477841][ T9268] usb 6-1: USB disconnect, device number 18 [ 1379.626977][T14127] loop5: detected capacity change from 0 to 128 [ 1379.687495][T14127] syz.5.2342: attempt to access beyond end of device [ 1379.687495][T14127] loop5: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1379.769850][T14126] syz.5.2342: attempt to access beyond end of device [ 1379.769850][T14126] loop5: rw=524288, sector=145, nr_sectors = 79 limit=128 [ 1379.830131][T14127] syz.5.2342: attempt to access beyond end of device [ 1379.830131][T14127] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1379.873576][T14127] syz.5.2342: attempt to access beyond end of device [ 1379.873576][T14127] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1379.908901][T14127] syz.5.2342: attempt to access beyond end of device [ 1379.908901][T14127] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1379.953705][T14127] syz.5.2342: attempt to access beyond end of device [ 1379.953705][T14127] loop5: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1380.993694][T14140] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2347'. [ 1381.702551][T14140] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1381.886663][T14153] loop1: detected capacity change from 0 to 8 [ 1383.593104][T13901] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1383.793170][T13901] usb 4-1: Using ep0 maxpacket: 16 [ 1383.802745][T13901] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1383.945635][T13901] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1383.980588][T13901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1384.006714][T13901] usb 4-1: Product: syz [ 1384.016585][T13901] usb 4-1: Manufacturer: syz [ 1384.022568][T13901] usb 4-1: SerialNumber: syz [ 1384.028750][T14178] loop4: detected capacity change from 0 to 128 [ 1384.058141][T13901] usb 4-1: config 0 descriptor?? [ 1384.100589][T13901] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1384.117740][T14178] syz.4.2357: attempt to access beyond end of device [ 1384.117740][T14178] loop4: rw=2049, sector=145, nr_sectors = 79 limit=128 [ 1384.125663][T13901] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 1384.178916][T14176] syz.4.2357: attempt to access beyond end of device [ 1384.178916][T14176] loop4: rw=524288, sector=145, nr_sectors = 79 limit=128 [ 1384.241193][T14178] syz.4.2357: attempt to access beyond end of device [ 1384.241193][T14178] loop4: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1384.256046][T14178] syz.4.2357: attempt to access beyond end of device [ 1384.256046][T14178] loop4: rw=0, sector=145, nr_sectors = 8 limit=128 [ 1384.291980][T14185] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2359'. [ 1384.780523][T14186] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1385.354104][ T26] audit: type=1800 audit(1793651261.020:128): pid=14186 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2359" name="attr_allow_any_host" dev="configfs" ino=56818 res=0 errno=0 [ 1385.503814][T13901] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1386.880522][T14191] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2361'. [ 1386.914793][T13901] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1386.922836][T13901] em28xx 4-1:0.0: board has no eeprom [ 1386.945418][T14201] loop3: detected capacity change from 0 to 8 [ 1387.018598][T13901] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1387.043749][T13901] em28xx 4-1:0.0: dvb set to bulk mode. [ 1387.074957][ T5081] em28xx 4-1:0.0: Binding DVB extension [ 1387.118435][T13901] usb 4-1: USB disconnect, device number 25 [ 1387.178000][T13901] em28xx 4-1:0.0: Disconnecting em28xx [ 1387.321016][ T5081] em28xx 4-1:0.0: Registering input extension [ 1387.337729][T13901] em28xx 4-1:0.0: Closing input extension [ 1387.388256][T13901] em28xx 4-1:0.0: Freeing device [ 1387.419334][T14206] printk: console [ttyS0] disabled [ 1387.498512][ T4286] Bluetooth: Wrong link type (-22) syzkaller syzkaller login: serialport: Connection terminated to allow system upgrade. Please reconnect at your convenience.