last executing test programs: 38.282243203s ago: executing program 0 (id=429): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000002940)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) 37.04656433s ago: executing program 0 (id=432): r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) r1 = landlock_create_ruleset(&(0x7f0000000240)={0x1ffb}, 0x30, 0x0) landlock_restrict_self(r1, 0x0) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000240)=@urb_type_control={0x2, {}, 0x0, 0x41, &(0x7f00000004c0)={0x1f, 0x14, 0x16, 0x3}, 0x8, 0x800000, 0x4, 0x0, 0x3ff, 0x0, 0x0}) add_key$fscrypt_v1(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$USBDEVFS_REAPURB(r0, 0x4004550d, 0x0) 36.006756526s ago: executing program 0 (id=435): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000340)=ANY=[@ANYBLOB="e0000001ac1414aa0000000002000000ac"], 0x18) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='net/mcfilter\x00') preadv(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)=""/9, 0x9}], 0x1, 0x5e, 0x0) 35.497563858s ago: executing program 1 (id=439): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d0005800900010070707470"], 0xbc}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x4044040) 35.4741736s ago: executing program 0 (id=440): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 35.449097533s ago: executing program 2 (id=441): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7e, &(0x7f0000000040)={0x0, 0x8970, 0x1f280, 0x1, 0x8000399}) r1 = syz_io_uring_setup(0x3, &(0x7f0000000280)={0x0, 0x3f7, 0x40, 0x0, 0x163}, &(0x7f0000000240), &(0x7f0000001880), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_SEND_MSG_RING(0xffffffffffffffff, 0x1f, &(0x7f00000003c0)={0x28, 0x0, 0x0, r1, 0x0, 0x0, 0x8, 0x2, 0x1, {0x0, 0x0, 0xffffffffffffffff, 0x1000}}, 0x1) io_uring_enter(r0, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0) 34.963128719s ago: executing program 0 (id=443): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x4, @desc3}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2b1245d, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) 34.907479591s ago: executing program 1 (id=444): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100008}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x20, 0x28, 0x81, 0xfffff034}, {0x6, 0x0, 0xb, 0x63552b74}]}, 0x10) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xd007, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 34.767338996s ago: executing program 3 (id=446): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, &(0x7f0000001dc0)=""/4096, 0x1000) lseek(r0, 0xffffffffffffffff, 0x1) 34.204003067s ago: executing program 2 (id=448): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f0000000500), &(0x7f00000002c0)=r0}, 0x20) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r1}, &(0x7f00000006c0), &(0x7f0000000700)=r0}, 0x20) 34.112081499s ago: executing program 3 (id=449): socket(0x400000000010, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mydev\x00', 0x1ef) mount(0x0, &(0x7f0000000200)='./mydev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) get_mempolicy(&(0x7f0000000500), 0x0, 0x80000000, &(0x7f0000ffa000/0x3000)=nil, 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mydev/ttyS0\x00', 0x2, 0x100) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f00000000c0)={0x10, 0x7, 0x2, 0x171}) 34.110294298s ago: executing program 0 (id=450): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000000000007261696431203120382032202d202e2f6465762f6c6f6f7030202d202e2f6465762f6c6f6f703100") ioctl(r0, 0xc138fd0c, &(0x7f0000000500)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") 34.023430589s ago: executing program 4 (id=451): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x10000800, 0x0, 0xff, 0x1}, 0x20) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) sendmmsg$inet(r0, &(0x7f0000004ec0)=[{{&(0x7f0000000100)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, &(0x7f0000002900)=[{&(0x7f0000000140)="eb", 0x1}], 0x1}}], 0x1, 0x20000005) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x4}, 0x8) 33.972860668s ago: executing program 2 (id=452): timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x83, 0x7fff0000}]}) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) preadv2(r0, 0x0, 0x0, 0x6839, 0xa4dc, 0xa) 33.55712399s ago: executing program 1 (id=453): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xb, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa10000000000000701"], 0x0, 0xfffff7ff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1900000004000000080000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000000000000850000007d00000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 33.405433711s ago: executing program 3 (id=454): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000001bc0)={{r0, 0x0, 0x200000, 0x0, 0x4, 0x0, 0x0}, 0x1, &(0x7f0000001a80)=[{0x3, 0x10001, 0x0, &(0x7f0000000780)="98", 0x1, 0x30}]}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r1, @ANYBLOB="0000000003120100500012800b0001006272696467650000400002800800050001000000060027"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0xc048094) 33.313663898s ago: executing program 1 (id=455): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd700000000000010000000c00020002000000000000001c0007800c00018008000100", @ANYRES32=r0, @ANYBLOB="0c000180080001"], 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0x4) 33.065333143s ago: executing program 3 (id=456): syz_mount_image$udf(&(0x7f0000001400), &(0x7f0000001440)='./file0\x00', 0x4, &(0x7f0000001480)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00'], 0x46, 0xc11, &(0x7f0000001540)="$eJzs3V1oXOl5B/DnnSOtRto00WYTb9Jm04GUxCi18VdsBZcgZxW1AccbIit0r6LRh51h5ZGR5MabtkFtSQu9Cd2b0psimi4t5KJX3V5WabaQUAol5CK9KAiaLHvRC10ECi0bhXPmHWlky7ayXlvS7u+3zP7PnHnO+P0YnzkCvzoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAER89nOXTp1OB90KAOBxujL5pVNnff8DwLvKVT//AwAAAAAAAAAAAADAYZeiiGORYujVzTRdPe+oX261b92eGp/Y+7DBFClqUVT15aN++szZc586f2G0m/c//u324Xh+8uqlxnOLN24uzS8vz881ptqt2cW5+X2/w8Mef6eRagAaN168NXft2nLjzMmzu16+Pfz6wJPHhi9eOHF+tFs7NT4xMdlT09f/lv/0u9xrhccTUUQzUrw5/EZqRkQtHn4sHvDZedQGq06MVJ2YGp+oOrLQarZXyhdTLVfVIho9B411x+gxzMVDGYtYLZtfNnik7N7kzeZSc2ZhvvHF5tJKa6W12E61TmvL/jSiFqMpYi0iNgbufrv+KOKjkeLlU5tpJiKK7jh8sloY/OD21B5BH/ehbGejP2KtdgTm7BAbiCKuRIqfvXY8Zssxy4/4eMQXynw14pUyPxORyg/GuYif7vE54mjqiyL+PVIsps00V50PuueVy19ufL59bbGntnteOfLfD4/TIT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25HiT579vWpdcVTr0t93cfQ9L/x275rxZx7wPmXtyYhYre1vTW5/XjqcauV/j6Bj7Es9ivhGXv/3RwfdGAAAAAAAAAAAAAAAAAAAgHe1Il6IFF85cTytRe89xVvt642rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzDsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KBbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIk5Fi/YV69XytFnE1In6+tbXVfUTEZpkP66D7CgAAAAAAAAAAAAAAAAAAAIdWKuJjkeLp/9tMjYi4Pfz6wJPHhi9eOHF+tIgiUlnSW//85NVLjecWb9xcml9enp9rTLVbs4tz8/v94+qXW+1bt6fGJx5JZx5o8BG3f7D+3OLNl5Za17+6sufrQ/VLM8srS83ZvV+OwahFTPfuGakaPDU+UTV6odVsV4em2j0aWIsY229nAAAAAAAAAAAAAAAAAAAAODSGUhGfixQ/+a9zqbtuvK+z5v9XOs+K7dpX/mDndwEs3JFdvb8/YD/bab8NHakW3jemxicmJnt29/XfXVq2KaUinokUn3j5Q9V6+BRDe66NL+veW9bdOJfrhn+trFvdVVUfmRqfaFxZbJ+4tLCwONtcac4szDcmbzZn9/2LAwAAAAAAAAAAAAAAAAAAAOA+hlIRP4oU//P3/5G6953P6//7Os961v//VrWEvlJPu3Nbtbb/vdXa/s72+y6ODn302XvtfxTr/8s2pVTENyPF2R99qLqffnf9//QdtWXdn0WKN579SK6rPVHWNbvd6bzjtdbC/Kmy9q8jxa+/2a2NqvZ6rn16p/Z0WTsYKf5yc3ftV3PtB3Zqz5S1xyPF9/5779oP7tSeLWt/Ein+6e8a3dqhsvb3c+2xndqTs4sLcw8a1nL+vxMp/vbK76Run+85/z2//2H1jtx215zff/vtmv/hnn2reV7/NM9/8wHzfz5SfKf+kVzXGfuZ/PpT1f935v8TkeI//2137bVc+/6d2tP77dZBK+f/25Hiu3/14+0+5/nPI7szQ73z/6t9u3P7U3JA8/9Uz77h3K7ZX3Is3o2WX/r6i82FhfklGzZs2NjeOOgzE49D+f3/55Hi/48VqXsdk7//39N5tnP997/f2Pn+v3hHbjug7//39+y7mK9a+vsi6is3bvY/E1FffunrJ1o3mtfnr8+3z5w+9elPnz996vT5/ie6F3c7W/seu3eCcv5/ECl++A8/3P45Zvf1397X/0N35LYDmv+ne/u067pm30PxrlTO/99Eiqc+++Ptnzfvd/3f/fn/+Md25/bfvwOa/w/07BvO7Wr9kmMBAAAAAAAAAABwlAylIv4iUvzuH/9m6q4h2s+//5u7I7cd0L//Otazb+4xrWvY9yADABwi5fXfByPFP299f3st9+7rv/iNbm3v9d+9HIb7/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFGXoog/jBRDr26m9YHyeUf9cqt96/bU+MTehw2mSFGLoqovH/XTZ86e+9T5C6PdvP/xb7cPx/OTVy81nlu8cXNpfnl5fq4x1W7NLs7N7/sdHvb4O41UA9C48eKtuWvXlhtnTp7d9fLt4dcHnjw2fPHCifOj3dqp8YmJyZ6avv63/KffJd1j/xNRxPcjxZvDb6TvDkTU4uHH4gGfnUdtsOrESNWJqfGJqiMLrWZ7pXwx1XJVLaLRc9BYd4wew1w8lLGI1bL5ZYNHyu5N3mwuNWcW5htfbC6ttFZai+1U67S27E8jajGaItYiYmPg7rfrjyK+GSlePrWZ/mUgouiOwyevTH7p1NkHt6f2CPq4D2U7G/0Ra7UjMGeH2EAU8Y+R4mevHY/vDUT0RecRH4/4QpmvRrxS5mciUvnBOBfx0z0+RxxNfVHEuUixmDbTawPl+aB7Xrn85cbn29cWe2q755Uj//3wOB3yc1M9ivhBdcbfTP/q7zUAAAAAAAAAAAAAAADAIVLEWqT4yonjqVofvL2muNW+3rjanFnoLOvrrv3rrpne2traaqROjuWczrmacy3nes6NnFHLx+ccyzmdczXnWs71nBs5o8jH5xzLOZ1zNedazvWcGzmjLx+fcyzndM7VnGs513Nu5IxDsnYPAAAAAAAAAAAAAAAAAAB4Z6lFUd3F/Vtf20xbA537S09HJ9fdD/Qd7xcBAAD//0kCdPc=") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000021c0)='./file1\x00', r0, &(0x7f0000002200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mount$fuse(0x0, &(0x7f0000002300)='./file1\x00', 0x0, 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002740)='./sys\x00', 0x1fe) unlinkat(0xffffffffffffff9c, &(0x7f0000002440)='./file1\x00', 0x0) 32.98372386s ago: executing program 4 (id=457): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x143}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 32.936700708s ago: executing program 1 (id=458): r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@filter={'filter\x00', 0xe, 0x4, 0x438, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x368, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x2, 0x0, 'syz0\x00'}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x498) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c80)=@newlink={0x28, 0x10, 0x801, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40200}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000e80)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) 32.591990289s ago: executing program 4 (id=459): mkdirat(0xffffffffffffff9c, &(0x7f0000006000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000006000)='./sys\x00', &(0x7f0000006100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/module/psmouse/parameters/proto\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) read$FUSE(r0, &(0x7f00000000c0)={0x2020}, 0x2020) 32.336874357s ago: executing program 2 (id=460): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000a40)='./file0/file1\x00', 0x1000001, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000a80)='./bus\x00', 0x4080, 0x0, 0x1, 0x0, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000ac0)='./file0/file1\x00', &(0x7f0000000b00), &(0x7f0000000b40)='./file0/file1\x00', 0xe, 0x1) mount$overlay(0x0, &(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0), 0x0, &(0x7f0000000c00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file0/file1\x00', 0x200) 32.253778263s ago: executing program 4 (id=461): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') 32.249602916s ago: executing program 3 (id=462): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x6}) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x7, 0x0, 0x80, 0x0, 0x0, 0x1, 0x0, 0xff, 0x82, 0xd9, 0x93}, 0xe) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) 31.945701157s ago: executing program 2 (id=463): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x8c, 0x3, 0x40}) r0 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x1f, 0x0}, 0x0) 31.803198784s ago: executing program 1 (id=464): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xde9f, 0x1000, 0x2, 0x15b}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffa, 0x800, 0x1000000, 0x10000004, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2b75, 0x800, 0x2, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1b6e, 0x200, 0x1, 0x2f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xe1}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0xe3, {}, 0x0, 0x0, '\x00', {0xfff9, 0x6, 0x0, 0x0}}, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) 31.798139039s ago: executing program 4 (id=465): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000800), 0x10) recvmmsg(r0, &(0x7f0000000840), 0x3fffffffffffe83, 0x2, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000880)={0x0, 0x26, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES8=r0], 0x48}}, 0x2404c054) read$FUSE(r0, &(0x7f0000004340)={0x2020}, 0x8f1) readv(r0, &(0x7f0000000940)=[{&(0x7f0000000980)=""/58, 0x3a}], 0x1) 31.639644514s ago: executing program 2 (id=466): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000640)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000006c0)={0x2, 0x24e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000800)=0x1b32, 0x4) sendto$inet(r0, &(0x7f0000000840)='v', 0x1, 0x4040, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=""/138, 0x8a}, 0x82}], 0x1, 0x40012002, 0x0) 31.537034515s ago: executing program 3 (id=467): r0 = syz_clone(0x88206100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') syz_read_part_table(0x4072, &(0x7f0000000400)="$eJzszz1KK2EUBuA3yZ3rKIEgaCWIwcJOxs5qdpFesgYrCxVnJ5biAtyHe7DUJYwMMtFBLQNBnqc4nPO9fH9hs731TblaGiV5Wj7uJjmap6mqj/Bfn29/7q7OUuyU40yTXH4/fPGw1rcDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACbZutLPx4kN0ma56uTfi678r8ry4M013XOp0m5P0vuJinqw1H2kvnpD3dMkpckoySvSRaz9X0HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPhLLobj7XAc/xZ07o/T1MUqbdv2nd05JgAABoEY+GMN1iQmwQLsdwaSXmdf8uv6CgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHDmQAAAAAhPlb59F+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmwIAAP//k10WsQ==") fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000100)='ns/mnt\x00') 30.567111748s ago: executing program 4 (id=468): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x9, 0x8, 0x4, 0x100, 0x0, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)='%+9llu \x00'}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x9, &(0x7f0000000280)=@framed={{}, [@generic={0x7a, 0xa, 0x0, 0xfffffff8}, @map_fd={0x18, 0x1, 0x1, 0x0, r3}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r4, 0x4) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 32 (id=450): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000000000007261696431203120382032202d202e2f6465762f6c6f6f7030202d202e2f6465762f6c6f6f703100") ioctl(r0, 0xc138fd0c, &(0x7f0000000500)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.185' (ED25519) to the list of known hosts. [ 64.820307][ T5589] cgroup: Unknown subsys name 'net' [ 64.980871][ T5589] cgroup: Unknown subsys name 'cpuset' [ 64.989031][ T5589] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.305253][ T5589] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.544559][ T5606] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.544940][ T5606] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.548116][ T5603] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.548624][ T5603] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.549824][ T5603] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.550840][ T5603] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.551614][ T5603] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 68.556294][ T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.564920][ T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.579539][ T5603] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.582293][ T5603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.583674][ T5603] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.584740][ T5603] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.586230][ T5603] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.599932][ T5603] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.613480][ T54] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.615041][ T54] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.617902][ T54] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.626248][ T54] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.626942][ T54] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.705401][ T5606] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.714275][ T5606] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.716717][ T5606] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.743986][ T5606] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.744579][ T5606] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 70.429998][ T5600] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.430153][ T5600] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.430513][ T5600] bridge_slave_0: entered allmulticast mode [ 70.432255][ T5600] bridge_slave_0: entered promiscuous mode [ 70.443583][ T5600] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.443679][ T5600] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.444146][ T5600] bridge_slave_1: entered allmulticast mode [ 70.445730][ T5600] bridge_slave_1: entered promiscuous mode [ 70.520677][ T5600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.526127][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.526283][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.526361][ T5613] bridge_slave_0: entered allmulticast mode [ 70.527866][ T5613] bridge_slave_0: entered promiscuous mode [ 70.531767][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.531863][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.531980][ T5613] bridge_slave_1: entered allmulticast mode [ 70.533550][ T5613] bridge_slave_1: entered promiscuous mode [ 70.562485][ T5606] Bluetooth: hci1: command tx timeout [ 70.606502][ T5600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.626260][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.636854][ T5606] Bluetooth: hci3: command tx timeout [ 70.636861][ T5603] Bluetooth: hci2: command tx timeout [ 70.639644][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.639810][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.639901][ T5605] bridge_slave_0: entered allmulticast mode [ 70.640882][ T5605] bridge_slave_0: entered promiscuous mode [ 70.693434][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.704120][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.705994][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.706118][ T5605] bridge_slave_1: entered allmulticast mode [ 70.708004][ T5605] bridge_slave_1: entered promiscuous mode [ 70.721874][ T5606] Bluetooth: hci0: command tx timeout [ 70.724623][ T5600] team0: Port device team_slave_0 added [ 70.739563][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.739747][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.740173][ T5607] bridge_slave_0: entered allmulticast mode [ 70.741753][ T5607] bridge_slave_0: entered promiscuous mode [ 70.759944][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.760045][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.760423][ T5601] bridge_slave_0: entered allmulticast mode [ 70.762221][ T5601] bridge_slave_0: entered promiscuous mode [ 70.782360][ T5600] team0: Port device team_slave_1 added [ 70.782554][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.782717][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.782840][ T5607] bridge_slave_1: entered allmulticast mode [ 70.784693][ T5607] bridge_slave_1: entered promiscuous mode [ 70.797202][ T5606] Bluetooth: hci4: command tx timeout [ 70.822384][ T5613] team0: Port device team_slave_0 added [ 70.822576][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.822697][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.823065][ T5601] bridge_slave_1: entered allmulticast mode [ 70.824606][ T5601] bridge_slave_1: entered promiscuous mode [ 70.831279][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.862177][ T5613] team0: Port device team_slave_1 added [ 70.888995][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.928612][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.949983][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.950000][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.950022][ T5600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.954062][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.970927][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.985683][ T5605] team0: Port device team_slave_0 added [ 70.987045][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.987057][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.987080][ T5600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.073289][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.073930][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.073942][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.073965][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.101349][ T5605] team0: Port device team_slave_1 added [ 71.104998][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.105012][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.105043][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.123582][ T5601] team0: Port device team_slave_0 added [ 71.162608][ T5607] team0: Port device team_slave_0 added [ 71.165576][ T5601] team0: Port device team_slave_1 added [ 71.205598][ T5600] hsr_slave_0: entered promiscuous mode [ 71.206319][ T5600] hsr_slave_1: entered promiscuous mode [ 71.215386][ T5607] team0: Port device team_slave_1 added [ 71.228235][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.228250][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.228274][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.230301][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.230314][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.230335][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.314805][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.314821][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.314843][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.318596][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.318611][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.318632][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.326504][ T5613] hsr_slave_0: entered promiscuous mode [ 71.330281][ T5613] hsr_slave_1: entered promiscuous mode [ 71.332506][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 71.332603][ T5613] Cannot create hsr debugfs directory [ 71.375365][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.375380][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.375403][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.385830][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.385846][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.385870][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.448229][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.448295][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.520542][ T5605] hsr_slave_0: entered promiscuous mode [ 71.521501][ T5605] hsr_slave_1: entered promiscuous mode [ 71.522187][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 71.522205][ T5605] Cannot create hsr debugfs directory [ 71.574533][ T5607] hsr_slave_0: entered promiscuous mode [ 71.575139][ T5607] hsr_slave_1: entered promiscuous mode [ 71.575681][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 71.575699][ T5607] Cannot create hsr debugfs directory [ 71.600668][ T5601] hsr_slave_0: entered promiscuous mode [ 71.601323][ T5601] hsr_slave_1: entered promiscuous mode [ 71.601713][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 71.601731][ T5601] Cannot create hsr debugfs directory [ 72.040030][ T5600] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.055220][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.056685][ T5600] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.065725][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.071219][ T5600] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.078147][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.091286][ T5600] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 72.103512][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.162768][ T5613] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.172583][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.176539][ T5613] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.193130][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.194014][ T5613] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.199139][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.201562][ T5613] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.208115][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.292306][ T5605] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 72.298171][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.298975][ T5605] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 72.309077][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.320586][ T5605] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 72.331089][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.345947][ T5605] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 72.354670][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.447755][ T5601] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.451835][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.467635][ T5601] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.481935][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.490308][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.492341][ T5601] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.501440][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.503945][ T5601] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.514144][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.594164][ T5600] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.621559][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 72.625099][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.644659][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.646783][ T5606] Bluetooth: hci1: command tx timeout [ 72.655550][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 72.662747][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.673525][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.673638][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.686385][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 72.692093][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.702420][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.702583][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.710478][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 72.717168][ T5606] Bluetooth: hci2: command tx timeout [ 72.717198][ T5606] Bluetooth: hci3: command tx timeout [ 72.730592][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.796346][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.797147][ T5603] Bluetooth: hci0: command tx timeout [ 72.856256][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.856313][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.877860][ T5603] Bluetooth: hci4: command tx timeout [ 72.885525][ T1113] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.885581][ T1113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.928287][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.995153][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.031072][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.035822][ T178] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.035922][ T178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.085478][ T91] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.085580][ T91] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.104451][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.145557][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.192802][ T178] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.192931][ T178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.195879][ T178] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.195977][ T178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.220663][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.251566][ T178] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.251665][ T178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.294489][ T1113] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.294631][ T1113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.895541][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.141035][ T5600] veth0_vlan: entered promiscuous mode [ 74.201407][ T5600] veth1_vlan: entered promiscuous mode [ 74.220445][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.299793][ T5600] veth0_macvtap: entered promiscuous mode [ 74.332103][ T5600] veth1_macvtap: entered promiscuous mode [ 74.402393][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.439657][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.487659][ T1113] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.488738][ T1113] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.489009][ T1113] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.589502][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.626821][ T51] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.694973][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.717842][ T5603] Bluetooth: hci1: command tx timeout [ 74.797113][ T5603] Bluetooth: hci3: command tx timeout [ 74.797144][ T5603] Bluetooth: hci2: command tx timeout [ 74.834751][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.834776][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.866461][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.879801][ T5606] Bluetooth: hci0: command tx timeout [ 74.913110][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.913130][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.913132][ T5605] veth0_vlan: entered promiscuous mode [ 74.947929][ T5605] veth1_vlan: entered promiscuous mode [ 74.957835][ T5606] Bluetooth: hci4: command tx timeout [ 75.039943][ T5607] veth0_vlan: entered promiscuous mode [ 75.087420][ T5613] veth0_vlan: entered promiscuous mode [ 75.102171][ T5607] veth1_vlan: entered promiscuous mode [ 75.141768][ T5600] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 75.143066][ T5605] veth0_macvtap: entered promiscuous mode [ 75.182244][ T5613] veth1_vlan: entered promiscuous mode [ 75.184526][ T5601] veth0_vlan: entered promiscuous mode [ 75.189617][ T5605] veth1_macvtap: entered promiscuous mode [ 75.236228][ T5601] veth1_vlan: entered promiscuous mode [ 75.275623][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.289330][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.293590][ T5607] veth0_macvtap: entered promiscuous mode [ 75.334312][ T5607] veth1_macvtap: entered promiscuous mode [ 75.348180][ T63] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.348231][ T63] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.348265][ T63] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.348298][ T63] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.398637][ T5613] veth0_macvtap: entered promiscuous mode [ 75.420419][ T5613] veth1_macvtap: entered promiscuous mode [ 75.452411][ T5601] veth0_macvtap: entered promiscuous mode [ 75.474765][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.481529][ T5601] veth1_macvtap: entered promiscuous mode [ 75.501317][ T5796] input: syz0 as /devices/virtual/input/input5 [ 75.505757][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.513784][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.578774][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.679515][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.695673][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.695693][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.737130][ T1113] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.748395][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.757306][ T63] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.757544][ T63] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.757676][ T63] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.757827][ T63] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.853242][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.853262][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.932546][ T91] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.932566][ T91] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.967883][ T91] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.967935][ T91] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.967968][ T91] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.968000][ T91] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.968028][ T91] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.968057][ T91] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.968088][ T91] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.050235][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.050269][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.119752][ T5602] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 76.135465][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.135486][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.211062][ T5805] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.211085][ T5805] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.300413][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.300432][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.325971][ T5602] usb 3-1: New USB device found: idVendor=2c7c, idProduct=0125, bcdDevice=0.00 [ 76.347415][ T5602] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 76.347463][ T5602] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.408896][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.408916][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.620295][ T5602] qmi_wwan 3-1:1.0: cdc-wdm0: USB WDM device [ 76.650779][ T5815] netlink: 'syz.1.10': attribute type 1 has an invalid length. [ 76.650865][ T5815] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10'. [ 76.675280][ T5815] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.677135][ T5815] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.698742][ T5602] wwan wwan0: port wwan0qmi0 attached [ 76.799108][ T5606] Bluetooth: hci1: command tx timeout [ 76.867591][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.867685][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.868325][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.868348][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.868557][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.868575][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.868955][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.868973][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.869271][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.869289][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.869510][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.869529][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.869758][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.869776][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.870011][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.870030][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.870929][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.870948][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.871149][ C0] qmi_wwan 3-1:1.0: nonzero urb status received: -71 [ 76.871171][ C0] qmi_wwan 3-1:1.0: wdm_int_callback - 0 bytes [ 76.879024][ T5606] Bluetooth: hci2: command tx timeout [ 76.879055][ T5606] Bluetooth: hci3: command tx timeout [ 76.958099][ T5603] Bluetooth: hci0: command tx timeout [ 77.039511][ T5603] Bluetooth: hci4: command tx timeout [ 77.050803][ T5602] qmi_wwan 3-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.2-1, WWAN/QMI device, aa:9d:8e:e5:66:36 [ 77.064244][ T5602] usb 3-1: USB disconnect, device number 2 [ 77.085395][ T5602] qmi_wwan 3-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.2-1, WWAN/QMI device [ 77.262609][ T5827] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1'. [ 77.281275][ T5602] wwan wwan0: port wwan0qmi0 disconnected [ 77.373977][ T5818] loop3: detected capacity change from 0 to 40427 [ 77.396265][ T5818] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 77.396289][ T5818] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 77.422726][ T5818] F2FS-fs (loop3): invalid crc value [ 77.791003][ T5818] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 77.817590][ T5818] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 77.818266][ T5818] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 77.904266][ T5846] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 77.948403][ T32] audit: type=1800 audit(1791999131.298:2): pid=5818 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4" name="file1" dev="loop3" ino=10 res=0 errno=-22 [ 78.001696][ T5818] syz.3.4: attempt to access beyond end of device [ 78.001696][ T5818] loop3: rw=8423425, sector=53248, nr_sectors = 8 limit=40427 [ 78.018343][ T5818] syz.3.4: attempt to access beyond end of device [ 78.018343][ T5818] loop3: rw=524288, sector=53248, nr_sectors = 8 limit=40427 [ 78.018634][ T5818] syz.3.4: attempt to access beyond end of device [ 78.018634][ T5818] loop3: rw=0, sector=53248, nr_sectors = 8 limit=40427 [ 78.022050][ T32] audit: type=1800 audit(1791999131.358:3): pid=5818 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.4" name="file1" dev="loop3" ino=10 res=0 errno=-5 [ 78.085064][ T5607] syz-executor: attempt to access beyond end of device [ 78.085064][ T5607] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 78.086072][ T5607] CPU: 1 UID: 0 PID: 5607 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 78.086098][ T5607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.086115][ T5607] Call Trace: [ 78.086126][ T5607] [ 78.086134][ T5607] dump_stack_lvl+0xe8/0x150 [ 78.086166][ T5607] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 78.086198][ T5607] f2fs_write_end_bio+0x118e/0x15d0 [ 78.086252][ T5607] __submit_merged_bio+0x258/0x6a0 [ 78.086278][ T5607] ? rcu_is_watching+0x16/0xb0 [ 78.086309][ T5607] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 78.086342][ T5607] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 78.086394][ T5607] f2fs_write_data_pages+0x2a13/0x36e0 [ 78.086454][ T5607] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 78.086486][ T5607] ? is_bpf_text_address+0x292/0x2b0 [ 78.086509][ T5607] ? is_bpf_text_address+0x26/0x2b0 [ 78.086555][ T5607] ? stack_trace_save+0xa9/0x100 [ 78.086574][ T5607] ? __pfx_stack_trace_save+0x10/0x10 [ 78.086612][ T5607] ? lockdep_unlock+0x5c/0xd0 [ 78.086626][ T5607] ? __lock_acquire+0x1511/0x2de0 [ 78.086668][ T5607] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 78.086687][ T5607] do_writepages+0x338/0x560 [ 78.086722][ T5607] ? do_raw_spin_unlock+0xf5/0x200 [ 78.086752][ T5607] filemap_fdatawrite+0x1e9/0x2f0 [ 78.086782][ T5607] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 78.086852][ T5607] ? do_raw_spin_unlock+0xf5/0x200 [ 78.086880][ T5607] f2fs_sync_dirty_inodes+0x471/0x970 [ 78.086916][ T5607] f2fs_write_checkpoint+0x860/0x24d0 [ 78.086976][ T5607] kill_f2fs_super+0x2dc/0x700 [ 78.087002][ T5607] ? rcu_do_enqueue+0x616/0x870 [ 78.087022][ T5607] ? lockdep_hardirqs_on+0x7b/0x110 [ 78.087043][ T5607] ? __pfx_kill_f2fs_super+0x10/0x10 [ 78.087079][ T5607] ? __pfx_call_rcu+0x10/0x10 [ 78.087108][ T5607] ? shrinker_free+0x2a7/0x3b0 [ 78.087137][ T5607] deactivate_locked_super+0xbe/0x110 [ 78.087171][ T5607] cleanup_mnt+0x204/0x2a0 [ 78.087196][ T5607] task_work_run+0x1d9/0x260 [ 78.087227][ T5607] ? __pfx_task_work_run+0x10/0x10 [ 78.087258][ T5607] exit_to_user_mode_loop+0x204/0x770 [ 78.087280][ T5607] ? rcu_is_watching+0x16/0xb0 [ 78.087309][ T5607] do_syscall_64+0x328/0x520 [ 78.087328][ T5607] ? trace_irq_disable+0x3b/0x140 [ 78.087348][ T5607] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.087366][ T5607] ? clear_bhb_loop+0x70/0xc0 [ 78.087388][ T5607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.087407][ T5607] RIP: 0033:0x7fca3239f517 [ 78.087442][ T5607] Code: a2 c7 05 dc 61 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 78.087457][ T5607] RSP: 002b:00007ffeb67e0448 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 78.087484][ T5607] RAX: 0000000000000000 RBX: 00007fca32434ccb RCX: 00007fca3239f517 [ 78.087496][ T5607] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeb67e0500 [ 78.087511][ T5607] RBP: 00007ffeb67e0500 R08: 00007ffeb67e1500 R09: 00000000ffffffff [ 78.087523][ T5607] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeb67e1590 [ 78.087533][ T5607] R13: 00007fca32434ccb R14: 00000000000130a4 R15: 00007ffeb67e15d0 [ 78.087564][ T5607] [ 78.160091][ T5607] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 78.229726][ T5708] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 78.389031][ T5708] usb 5-1: Using ep0 maxpacket: 32 [ 78.390670][ T5708] usb 5-1: New USB device found: idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 78.396528][ T5708] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 78.396552][ T5708] usb 5-1: config 0 has no interface number 0 [ 78.396589][ T5708] usb 5-1: config 0 interface 184 has no altsetting 0 [ 78.424102][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.424128][ T5708] usb 5-1: Product: syz [ 78.424141][ T5708] usb 5-1: Manufacturer: syz [ 78.424154][ T5708] usb 5-1: SerialNumber: syz [ 78.491041][ T5708] usb 5-1: config 0 descriptor?? [ 78.519047][ T5700] loop3: lost filesystem error report for type 5 error -108 [ 78.802536][ T5861] ip_tables: iptables: counters copy to user failed while replacing table [ 79.182910][ T5883] loop3: detected capacity change from 0 to 512 [ 79.196192][ T5883] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 79.196209][ T5883] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 79.262188][ T5883] EXT4-fs error (device loop3): mb_free_blocks:2047: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 79.265816][ T5883] EXT4-fs error (device loop3): ext4_do_update_inode:6677: inode #11: comm syz.3.30: corrupted inode contents [ 79.266025][ T5883] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.272747][ T5883] EXT4-fs error (device loop3): ext4_dirty_inode:7649: inode #11: comm syz.3.30: mark_inode_dirty error [ 79.272778][ T5883] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.274436][ T5883] EXT4-fs error (device loop3): ext4_free_branches:1040: inode #11: comm syz.3.30: invalid indirect mapped block 1 (level 1) [ 79.274488][ T5883] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.275828][ T5883] EXT4-fs error (device loop3): ext4_do_update_inode:6677: inode #11: comm syz.3.30: corrupted inode contents [ 79.275854][ T5883] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.281960][ T5883] EXT4-fs error (device loop3) in ext4_orphan_del:304: Corrupt filesystem [ 79.281982][ T5883] loop3: lost filesystem error report for type 5 error -117 [ 79.282779][ T5883] EXT4-fs error (device loop3): ext4_do_update_inode:6677: inode #11: comm syz.3.30: corrupted inode contents [ 79.282804][ T5883] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.285668][ T5883] EXT4-fs error (device loop3): ext4_truncate:5514: inode #11: comm syz.3.30: mark_inode_dirty error [ 79.285718][ T5883] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 79.287230][ C0] EXT4-fs (loop3): error count since last fsck: 8 [ 79.287249][ C0] EXT4-fs (loop3): initial error at time 1791999132: mb_free_blocks:2047: inode 11: block 64 [ 79.287280][ C0] EXT4-fs (loop3): last error at time 1791999132: ext4_truncate:5514: inode 11 [ 79.302802][ T5883] EXT4-fs error (device loop3) in ext4_process_orphan:346: Corrupt filesystem [ 79.302827][ T5883] loop3: lost filesystem error report for type 5 error -117 [ 79.305836][ T5883] EXT4-fs (loop3): 1 truncate cleaned up [ 79.315181][ T5883] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 79.339550][ T5883] EXT4-fs (loop3): shut down requested (2) [ 79.506452][ T5607] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.521375][ T5888] syz_tun: entered allmulticast mode [ 79.524507][ T5887] syz_tun: left allmulticast mode [ 79.537886][ T5708] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 79.741486][ T5708] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 79.741517][ T5708] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 79.741534][ T5708] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 79.741551][ T5708] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 79.741971][ T5708] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 79.761227][ T5897] loop3: detected capacity change from 0 to 512 [ 79.803943][ T5708] usb 5-1: USB disconnect, device number 2 [ 79.944240][ T5901] FAULT_INJECTION: forcing a failure. [ 79.944240][ T5901] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 79.944271][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz.0.36 Not tainted syzkaller #0 PREEMPT(full) [ 79.944288][ T5901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.944297][ T5901] Call Trace: [ 79.944302][ T5901] [ 79.944308][ T5901] dump_stack_lvl+0xe8/0x150 [ 79.944337][ T5901] should_fail_ex+0x3eb/0x540 [ 79.944361][ T5901] prepare_alloc_pages+0x21e/0x5f0 [ 79.944385][ T5901] __alloc_frozen_pages_noprof+0x17c/0x410 [ 79.944407][ T5901] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 79.944424][ T5901] ? __alloc_frozen_pages_noprof+0x24c/0x410 [ 79.944446][ T5901] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 79.944472][ T5901] __alloc_pages_noprof+0x10/0x100 [ 79.944492][ T5901] alloc_pages_bulk_noprof+0x67a/0x8a0 [ 79.944519][ T5901] ? alloc_pages_noprof+0x140/0x2b0 [ 79.944545][ T5901] __kasan_populate_vmalloc+0xb7/0x1c0 [ 79.944578][ T5901] alloc_vmap_area+0xd10/0x1410 [ 79.944631][ T5901] ? __pfx_alloc_vmap_area+0x10/0x10 [ 79.944653][ T5901] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 79.944686][ T5901] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 79.944711][ T5901] ? __get_vm_area_node+0x155/0x2f0 [ 79.944736][ T5901] __get_vm_area_node+0x200/0x2f0 [ 79.944765][ T5901] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 79.944791][ T5901] ? packet_set_ring+0xebc/0x2e60 [ 79.944822][ T5901] ? __asan_memset+0x22/0x50 [ 79.944851][ T5901] ? __alloc_frozen_pages_noprof+0xaa/0x410 [ 79.944890][ T5901] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 79.944918][ T5901] ? alloc_pages_mpol+0x256/0x390 [ 79.944944][ T5901] ? packet_set_ring+0xebc/0x2e60 [ 79.944966][ T5901] vzalloc_noprof+0xb2/0xe0 [ 79.944992][ T5901] ? packet_set_ring+0xebc/0x2e60 [ 79.945016][ T5901] packet_set_ring+0xebc/0x2e60 [ 79.945060][ T5901] ? __pfx_packet_set_ring+0x10/0x10 [ 79.945092][ T5901] ? __might_fault+0xaf/0x130 [ 79.945121][ T5901] ? _copy_from_user+0x94/0xb0 [ 79.945147][ T5901] packet_setsockopt+0xd9c/0x1510 [ 79.945172][ T5901] ? __pfx_packet_setsockopt+0x10/0x10 [ 79.945205][ T5901] ? aa_sk_perm+0x6ff/0x8f0 [ 79.945236][ T5901] ? __pfx_aa_sk_perm+0x10/0x10 [ 79.945261][ T5901] ? aa_sock_opt_perm+0x142/0x1e0 [ 79.945296][ T5901] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 79.945314][ T5901] ? __pfx_packet_setsockopt+0x10/0x10 [ 79.945338][ T5901] do_sock_setsockopt+0x17c/0x1b0 [ 79.945364][ T5901] __x64_sys_setsockopt+0x13d/0x1b0 [ 79.945388][ T5901] do_syscall_64+0x166/0x520 [ 79.945407][ T5901] ? trace_irq_disable+0x3b/0x140 [ 79.945426][ T5901] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.945443][ T5901] ? clear_bhb_loop+0x70/0xc0 [ 79.945463][ T5901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.945481][ T5901] RIP: 0033:0x7f0c7e59e2d9 [ 79.945499][ T5901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.945516][ T5901] RSP: 002b:00007f0c7f477028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 79.945541][ T5901] RAX: ffffffffffffffda RBX: 00007f0c7e825fa0 RCX: 00007f0c7e59e2d9 [ 79.945555][ T5901] RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000004 [ 79.945567][ T5901] RBP: 00007f0c7e635888 R08: 000000000000001c R09: 0000000000000000 [ 79.945579][ T5901] R10: 00002000000008c0 R11: 0000000000000246 R12: 0000000000000000 [ 79.945600][ T5901] R13: 00007f0c7e826038 R14: 00007f0c7e825fa0 R15: 00007ffc7ab0d108 [ 79.945627][ T5901] [ 79.945978][ T5901] syz.0.36: vmalloc error: size 16777216, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 79.946144][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz.0.36 Not tainted syzkaller #0 PREEMPT(full) [ 79.946166][ T5901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.946176][ T5901] Call Trace: [ 79.946183][ T5901] [ 79.946191][ T5901] dump_stack_lvl+0xe8/0x150 [ 79.946221][ T5901] warn_alloc+0x24d/0x270 [ 79.946253][ T5901] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.946276][ T5901] ? __pfx_warn_alloc+0x10/0x10 [ 79.946304][ T5901] ? kfree+0x1c5/0x650 [ 79.946335][ T5901] ? __get_vm_area_node+0x219/0x2f0 [ 79.946367][ T5901] __vmalloc_node_range_noprof+0x396/0x16f0 [ 79.946403][ T5901] ? __asan_memset+0x22/0x50 [ 79.946432][ T5901] ? __alloc_frozen_pages_noprof+0xaa/0x410 [ 79.946480][ T5901] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 79.946510][ T5901] ? alloc_pages_mpol+0x256/0x390 [ 79.946536][ T5901] ? packet_set_ring+0xebc/0x2e60 [ 79.946559][ T5901] vzalloc_noprof+0xb2/0xe0 [ 79.946596][ T5901] ? packet_set_ring+0xebc/0x2e60 [ 79.946623][ T5901] packet_set_ring+0xebc/0x2e60 [ 79.946660][ T5901] ? __pfx_packet_set_ring+0x10/0x10 [ 79.946689][ T5901] ? __might_fault+0xaf/0x130 [ 79.946715][ T5901] ? _copy_from_user+0x94/0xb0 [ 79.946741][ T5901] packet_setsockopt+0xd9c/0x1510 [ 79.946767][ T5901] ? __pfx_packet_setsockopt+0x10/0x10 [ 79.946798][ T5901] ? aa_sk_perm+0x6ff/0x8f0 [ 79.946833][ T5901] ? __pfx_aa_sk_perm+0x10/0x10 [ 79.946863][ T5901] ? aa_sock_opt_perm+0x142/0x1e0 [ 79.946894][ T5901] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 79.946912][ T5901] ? __pfx_packet_setsockopt+0x10/0x10 [ 79.946936][ T5901] do_sock_setsockopt+0x17c/0x1b0 [ 79.946961][ T5901] __x64_sys_setsockopt+0x13d/0x1b0 [ 79.946988][ T5901] do_syscall_64+0x166/0x520 [ 79.947008][ T5901] ? trace_irq_disable+0x3b/0x140 [ 79.947030][ T5901] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.947048][ T5901] ? clear_bhb_loop+0x70/0xc0 [ 79.947071][ T5901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.947089][ T5901] RIP: 0033:0x7f0c7e59e2d9 [ 79.947106][ T5901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.947121][ T5901] RSP: 002b:00007f0c7f477028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 79.947141][ T5901] RAX: ffffffffffffffda RBX: 00007f0c7e825fa0 RCX: 00007f0c7e59e2d9 [ 79.947154][ T5901] RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000004 [ 79.947165][ T5901] RBP: 00007f0c7e635888 R08: 000000000000001c R09: 0000000000000000 [ 79.947177][ T5901] R10: 00002000000008c0 R11: 0000000000000246 R12: 0000000000000000 [ 79.947189][ T5901] R13: 00007f0c7e826038 R14: 00007f0c7e825fa0 R15: 00007ffc7ab0d108 [ 79.947220][ T5901] [ 79.951537][ T5901] Mem-Info: [ 79.951557][ T5901] active_anon:5892 inactive_anon:0 isolated_anon:0 [ 79.951557][ T5901] active_file:0 inactive_file:42780 isolated_file:0 [ 79.951557][ T5901] unevictable:0 dirty:1904 writeback:0 [ 79.951557][ T5901] slab_reclaimable:10477 slab_unreclaimable:92972 [ 79.951557][ T5901] mapped:29722 shmem:587 pagetables:1130 [ 79.951557][ T5901] sec_pagetables:0 bounce:0 [ 79.951557][ T5901] kernel_misc_reclaimable:0 [ 79.951557][ T5901] free:1325212 free_pcp:17879 free_cma:0 [ 79.951615][ T5901] Node 0 active_anon:23568kB inactive_anon:0kB active_file:0kB inactive_file:170920kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118888kB dirty:7608kB writeback:0kB shmem:2348kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11808kB pagetables:4404kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 79.951668][ T5901] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 79.951716][ T5901] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 79.951772][ T5901] lowmem_reserve[]: 0 2467 2467 2467 2467 [ 79.951804][ T5901] Node 0 DMA32 free:1353888kB boost:0kB min:33984kB low:42480kB high:50976kB reserved_highatomic:0kB free_highatomic:0kB active_anon:23568kB inactive_anon:0kB active_file:0kB inactive_file:170920kB unevictable:0kB writepending:7608kB zspages:0kB present:3129332kB managed:2526700kB mlocked:0kB bounce:0kB free_pcp:71268kB local_pcp:33188kB free_cma:0kB [ 79.951856][ T5901] lowmem_reserve[]: 0 0 0 0 0 [ 79.951887][ T5901] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 79.951936][ T5901] lowmem_reserve[]: 0 0 0 0 0 [ 79.951965][ T5901] Node 1 Normal free:3931600kB boost:0kB min:55916kB low:69892kB high:83868kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:8kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:0kB free_cma:0kB [ 79.952018][ T5901] lowmem_reserve[]: 0 0 0 0 0 [ 79.952046][ T5901] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 79.952172][ T5901] Node 0 DMA32: 764*4kB (UM) 247*8kB (UM) 31*16kB (UME) 8*32kB (UM) 9*64kB (UM) 5*128kB (UM) 5*256kB (UM) 6*512kB (UM) 5*1024kB (UM) 5*2048kB (UME) 324*4096kB (M) = 1353816kB [ 79.955853][ T5901] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 79.955942][ T5901] Node 1 Normal: 2*4kB (M) 1*8kB (M) 2*16kB (UM) 3*32kB (UM) 5*64kB (UM) 6*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 958*4096kB (M) = 3931600kB [ 79.956080][ T5901] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 79.956095][ T5901] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 79.956108][ T5901] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 79.956122][ T5901] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 79.956137][ T5901] 43367 total pagecache pages [ 79.956152][ T5901] 0 pages in swap cache [ 79.956158][ T5901] Free swap = 124996kB [ 79.956165][ T5901] Total swap = 124996kB [ 79.956172][ T5901] 2097051 pages RAM [ 79.956179][ T5901] 0 pages HighMem/MovableOnly [ 79.956185][ T5901] 433760 pages reserved [ 79.956191][ T5901] 0 pages cma reserved [ 80.161808][ T5897] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 80.161918][ T5897] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 80.359112][ T5907] netlink: 20 bytes leftover after parsing attributes in process `syz.1.39'. [ 80.524824][ T5607] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.569876][ T5911] overlayfs: failed to clone upperpath [ 80.600814][ T5911] overlayfs: failed to clone upperpath [ 81.030092][ T5923] loop4: detected capacity change from 0 to 128 [ 81.179692][ T5708] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 81.327967][ T5708] usb 4-1: New USB device found: idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 81.333968][ T5708] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.334003][ T5708] usb 4-1: Product: syz [ 81.334075][ T5708] usb 4-1: Manufacturer: syz [ 81.334088][ T5708] usb 4-1: SerialNumber: syz [ 81.359119][ T5708] usb 4-1: config 0 descriptor?? [ 81.372716][ T5708] hub 4-1:0.0: bad descriptor, ignoring hub [ 81.372742][ T5708] hub 4-1:0.0: probe with driver hub failed with error -5 [ 81.577709][ T5708] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 81.621603][ T5708] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 81.631125][ T5708] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 81.631205][ T5708] usb 4-1: media controller created [ 81.707521][ T5708] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 81.943858][ T5708] DVB: Unable to find symbol dib7000p_attach() [ 81.943874][ T5708] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 81.951725][ T5955] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 82.177442][ T5708] rc_core: IR keymap rc-dib0700-rc5 not found [ 82.177462][ T5708] Registered IR keymap rc-empty [ 82.178989][ T5708] dvb-usb: could not initialize remote control. [ 82.179002][ T5708] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 82.211228][ T5708] usb 4-1: USB disconnect, device number 2 [ 82.382825][ T5962] loop0: detected capacity change from 0 to 2048 [ 82.425952][ T5964] loop1: detected capacity change from 0 to 2048 [ 82.468354][ T5962] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 82.484717][ T5708] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 82.491996][ T5964] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 82.874570][ T5975] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.875738][ T5973] syz.4.66 uses obsolete (PF_INET,SOCK_PACKET) [ 83.088773][ T5979] use of bytesused == 0 is deprecated and will be removed in the future, [ 83.088787][ T5979] use the actual size instead. [ 83.134863][ T5980] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 83.231981][ T5984] loop1: detected capacity change from 0 to 512 [ 83.283652][ T5984] ======================================================= [ 83.283652][ T5984] WARNING: The mand mount option has been deprecated and [ 83.283652][ T5984] and is ignored by this kernel. Remove the mand [ 83.283652][ T5984] option from the mount to silence this warning. [ 83.283652][ T5984] ======================================================= [ 83.433845][ T5991] loop0: detected capacity change from 0 to 2048 [ 83.496458][ T5991] loop0: p2 < > p4 [ 83.520093][ T5991] loop0: p4 size 262144 extends beyond EOD, truncated [ 83.924894][ T6014] FAULT_INJECTION: forcing a failure. [ 83.924894][ T6014] name failslab, interval 1, probability 0, space 0, times 1 [ 83.924924][ T6014] CPU: 1 UID: 0 PID: 6014 Comm: syz.0.81 Not tainted syzkaller #0 PREEMPT(full) [ 83.924946][ T6014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.924958][ T6014] Call Trace: [ 83.924965][ T6014] [ 83.924973][ T6014] dump_stack_lvl+0xe8/0x150 [ 83.925007][ T6014] should_fail_ex+0x3eb/0x540 [ 83.925034][ T6014] should_failslab+0xa8/0x100 [ 83.925058][ T6014] __kmalloc_cache_noprof+0x9e/0x600 [ 83.925094][ T6014] ? alloc_vfsmnt+0x23/0x510 [ 83.925118][ T6014] ? alloc_vfsmnt+0x6d/0x510 [ 83.925140][ T6014] ? alloc_vfsmnt+0x6d/0x510 [ 83.925168][ T6014] alloc_vfsmnt+0x6d/0x510 [ 83.925192][ T6014] clone_mnt+0x4c/0xad0 [ 83.925219][ T6014] copy_tree+0xde/0x940 [ 83.925245][ T6014] ? get_user_ns+0xff/0x1f0 [ 83.925271][ T6014] ? alloc_mnt_ns+0x212/0x2c0 [ 83.925301][ T6014] copy_mnt_ns+0x3ff/0xd00 [ 83.925332][ T6014] ? rcu_is_watching+0x16/0xb0 [ 83.925360][ T6014] ? __pfx_copy_mnt_ns+0x10/0x10 [ 83.925387][ T6014] ? kmem_cache_alloc_noprof+0x31a/0x600 [ 83.925425][ T6014] create_new_namespaces+0xcf/0x6b0 [ 83.925451][ T6014] ? bpf_lsm_capable+0x9/0x20 [ 83.925473][ T6014] ? security_capable+0x7e/0x2c0 [ 83.925508][ T6014] unshare_nsproxy_namespaces+0x144/0x190 [ 83.925536][ T6014] ksys_unshare+0x532/0x890 [ 83.925567][ T6014] ? __pfx_ksys_unshare+0x10/0x10 [ 83.925593][ T6014] ? rcu_is_watching+0x16/0xb0 [ 83.925626][ T6014] __x64_sys_unshare+0x38/0x50 [ 83.925651][ T6014] do_syscall_64+0x166/0x520 [ 83.925671][ T6014] ? trace_irq_disable+0x3b/0x140 [ 83.925701][ T6014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.925720][ T6014] ? clear_bhb_loop+0x70/0xc0 [ 83.925743][ T6014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.925763][ T6014] RIP: 0033:0x7f0c7e59e2d9 [ 83.925781][ T6014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.925797][ T6014] RSP: 002b:00007f0c7f477028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 83.925820][ T6014] RAX: ffffffffffffffda RBX: 00007f0c7e825fa0 RCX: 00007f0c7e59e2d9 [ 83.925834][ T6014] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000022020600 [ 83.925846][ T6014] RBP: 00007f0c7e635888 R08: 0000000000000000 R09: 0000000000000000 [ 83.925859][ T6014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.925870][ T6014] R13: 00007f0c7e826038 R14: 00007f0c7e825fa0 R15: 00007ffc7ab0d108 [ 83.925901][ T6014] [ 84.202052][ T6018] FAULT_INJECTION: forcing a failure. [ 84.202052][ T6018] name failslab, interval 1, probability 0, space 0, times 0 [ 84.202082][ T6018] CPU: 0 UID: 0 PID: 6018 Comm: syz.0.82 Not tainted syzkaller #0 PREEMPT(full) [ 84.202119][ T6018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.202131][ T6018] Call Trace: [ 84.202138][ T6018] [ 84.202146][ T6018] dump_stack_lvl+0xe8/0x150 [ 84.202180][ T6018] should_fail_ex+0x3eb/0x540 [ 84.202205][ T6018] should_failslab+0xa8/0x100 [ 84.202229][ T6018] __kvmalloc_node_noprof+0x171/0x820 [ 84.202248][ T6018] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 84.202273][ T6018] ? sort_subprogs_topo+0xbe/0x1130 [ 84.202300][ T6018] ? sort_subprogs_topo+0xbe/0x1130 [ 84.202332][ T6018] sort_subprogs_topo+0xbe/0x1130 [ 84.202360][ T6018] ? bpf_prune_dead_branches+0xaa7/0xb10 [ 84.202395][ T6018] bpf_check+0x2c9e/0x3560 [ 84.202429][ T6018] ? ktime_get_with_offset+0x93/0x2d0 [ 84.202450][ T6018] ? ktime_get_with_offset+0x93/0x2d0 [ 84.202472][ T6018] ? __pfx_bpf_check+0x10/0x10 [ 84.202499][ T6018] ? bpf_obj_name_cpy+0x194/0x1e0 [ 84.202523][ T6018] bpf_prog_load+0x158f/0x1d60 [ 84.202558][ T6018] ? __pfx_bpf_prog_load+0x10/0x10 [ 84.202597][ T6018] ? __might_fault+0xaf/0x130 [ 84.202632][ T6018] __sys_bpf+0xd86/0xe00 [ 84.202664][ T6018] ? __pfx___sys_bpf+0x10/0x10 [ 84.202693][ T6018] ? do_futex+0x3e7/0x4e0 [ 84.202754][ T6018] ? rcu_is_watching+0x16/0xb0 [ 84.202786][ T6018] __x64_sys_bpf+0xba/0xd0 [ 84.202812][ T6018] do_syscall_64+0x166/0x520 [ 84.202833][ T6018] ? trace_irq_disable+0x3b/0x140 [ 84.202855][ T6018] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.202875][ T6018] ? clear_bhb_loop+0x70/0xc0 [ 84.202897][ T6018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.202916][ T6018] RIP: 0033:0x7f0c7e59e2d9 [ 84.202934][ T6018] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.202950][ T6018] RSP: 002b:00007f0c7f477028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 84.202971][ T6018] RAX: ffffffffffffffda RBX: 00007f0c7e825fa0 RCX: 00007f0c7e59e2d9 [ 84.202985][ T6018] RDX: 0000000000000094 RSI: 0000200000000800 RDI: 0000000000000005 [ 84.202997][ T6018] RBP: 00007f0c7e635888 R08: 0000000000000000 R09: 0000000000000000 [ 84.203009][ T6018] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.203019][ T6018] R13: 00007f0c7e826038 R14: 00007f0c7e825fa0 R15: 00007ffc7ab0d108 [ 84.203047][ T6018] [ 84.674467][ T6032] Bluetooth: MGMT ver 1.23 [ 84.892428][ T63] Bluetooth: hci5: Frame reassembly failed (-84) [ 84.905790][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 84.975525][ T6038] netlink: 20 bytes leftover after parsing attributes in process `syz.3.93'. [ 85.340845][ T6026] loop0: detected capacity change from 0 to 131072 [ 85.345724][ T6026] F2FS-fs (loop0): invalid crc value [ 85.443867][ T6026] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 85.464728][ T6026] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 85.780844][ T5606] Bluetooth: hci0: failed to read key size for handle 0 [ 85.982057][ T6061] loop3: detected capacity change from 0 to 8192 [ 86.017795][ T6061] FAT-fs (loop3): error, corrupted directory (invalid entries) [ 86.017818][ T6061] FAT-fs (loop3): Filesystem has been set read-only [ 86.082125][ T6061] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 86.517434][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 86.608945][ T6078] xt_hashlimit: size too large, truncated to 1048576 [ 86.673360][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 86.675999][ T9] usb 4-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 86.677240][ T9] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 86.677287][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 86.677307][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 86.677327][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 86.677348][ T9] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 86.677383][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.819163][ T27] cfg80211: failed to load regulatory.db [ 86.906863][ T9] usb 4-1: GET_CAPABILITIES returned 0 [ 86.906918][ T9] usbtmc 4-1:16.0: can't read capabilities [ 86.956749][ T5606] Bluetooth: hci5: command 0x1003 tx timeout [ 86.958416][ T5603] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 87.139647][ T46] usb 4-1: USB disconnect, device number 3 [ 87.371143][ T6099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.114'. [ 87.371171][ T6099] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 87.371187][ T6099] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 87.379423][ T6099] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 87.379444][ T6099] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 87.836750][ T5603] Bluetooth: hci0: command 0x2016 tx timeout [ 88.689853][ T6151] bridge_slave_1: left allmulticast mode [ 88.689881][ T6151] bridge_slave_1: left promiscuous mode [ 88.691579][ T6151] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.797229][ T6151] bridge_slave_0: left allmulticast mode [ 88.797255][ T6151] bridge_slave_0: left promiscuous mode [ 88.797504][ T6151] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.139054][ T6143] loop1: detected capacity change from 0 to 40427 [ 89.165520][ T6143] F2FS-fs (loop1): build fault injection rate: 174 [ 89.165544][ T6143] F2FS-fs (loop1): build fault injection type: 0x3bfe8c [ 89.166412][ T6143] F2FS-fs (loop1): invalid crc value [ 89.223764][ T6147] loop3: detected capacity change from 0 to 131072 [ 89.225925][ T6147] F2FS-fs (loop3): Wrong CP boundary, start(512) end(1536) blocks(0) [ 89.225950][ T6147] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 89.236182][ T6147] F2FS-fs (loop3): invalid crc value [ 89.331573][ T6147] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 89.349352][ T6147] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 89.349379][ T6147] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 89.632679][ T6143] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 89.666434][ T6143] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 89.748486][ T6143] F2FS-fs (loop1): inject no more block in inc_valid_block_count of f2fs_map_blocks+0x17cb/0x4c40 [ 89.801470][ T6143] syz.1.127: attempt to access beyond end of device [ 89.801470][ T6143] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 89.813399][ T6143] CPU: 0 UID: 0 PID: 6143 Comm: syz.1.127 Not tainted syzkaller #0 PREEMPT(full) [ 89.813428][ T6143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.813439][ T6143] Call Trace: [ 89.813448][ T6143] [ 89.813455][ T6143] dump_stack_lvl+0xe8/0x150 [ 89.813490][ T6143] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 89.813528][ T6143] f2fs_write_end_bio+0x118e/0x15d0 [ 89.813573][ T6143] __submit_merged_bio+0x258/0x6a0 [ 89.813601][ T6143] ? rcu_is_watching+0x16/0xb0 [ 89.813631][ T6143] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 89.813664][ T6143] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 89.813724][ T6143] f2fs_write_data_pages+0x2a13/0x36e0 [ 89.813790][ T6143] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 89.813809][ T6143] ? is_bpf_text_address+0x26/0x2b0 [ 89.813854][ T6143] ? arch_stack_walk+0xfb/0x150 [ 89.813913][ T6143] ? add_lock_to_list+0xc7/0x100 [ 89.813947][ T6143] ? lockdep_unlock+0x5c/0xd0 [ 89.813964][ T6143] ? __lock_acquire+0x1511/0x2de0 [ 89.814020][ T6143] ? do_raw_spin_lock+0x12b/0x2f0 [ 89.814061][ T6143] ? do_raw_spin_unlock+0xf5/0x200 [ 89.814091][ T6143] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 89.814113][ T6143] do_writepages+0x338/0x560 [ 89.814161][ T6143] ? do_raw_spin_unlock+0xf5/0x200 [ 89.814194][ T6143] filemap_fdatawrite+0x1e9/0x2f0 [ 89.814226][ T6143] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 89.814305][ T6143] ? do_raw_spin_unlock+0xf5/0x200 [ 89.814339][ T6143] f2fs_sync_dirty_inodes+0x471/0x970 [ 89.814378][ T6143] f2fs_write_checkpoint+0x860/0x24d0 [ 89.814437][ T6143] f2fs_issue_checkpoint+0x424/0x6f0 [ 89.814465][ T6143] ? __lock_acquire+0x1511/0x2de0 [ 89.814495][ T6143] ? __pfx_f2fs_issue_checkpoint+0x10/0x10 [ 89.814534][ T6143] ? rcu_is_watching+0x16/0xb0 [ 89.814561][ T6143] ? __up_read+0x29c/0x930 [ 89.814649][ T6143] ? f2fs_sync_fs+0x1f2/0x3c0 [ 89.814680][ T6143] f2fs_do_sync_file+0xc5a/0x1880 [ 89.814722][ T6143] ? __pfx_f2fs_do_sync_file+0x10/0x10 [ 89.814745][ T6143] ? sb_start_write+0x112/0x1c0 [ 89.814766][ T6143] ? mnt_want_write_file+0x164/0x200 [ 89.814789][ T6143] __f2fs_ioctl+0x44d4/0xde00 [ 89.814814][ T6143] ? lock_acquire+0x115/0x350 [ 89.814841][ T6143] ? is_bpf_text_address+0x26/0x2b0 [ 89.814870][ T6143] ? is_bpf_text_address+0x292/0x2b0 [ 89.814892][ T6143] ? is_bpf_text_address+0x26/0x2b0 [ 89.814912][ T6143] ? __pfx___f2fs_ioctl+0x10/0x10 [ 89.814932][ T6143] ? kernel_text_address+0xa5/0xe0 [ 89.814955][ T6143] ? __kernel_text_address+0xd/0x30 [ 89.814973][ T6143] ? unwind_get_return_address+0x4d/0x90 [ 89.814995][ T6143] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 89.815014][ T6143] ? arch_stack_walk+0xfb/0x150 [ 89.815050][ T6143] ? stack_trace_save+0xa9/0x100 [ 89.815074][ T6143] ? __pfx_stack_trace_save+0x10/0x10 [ 89.815092][ T6143] ? kasan_save_track+0x4f/0x80 [ 89.815113][ T6143] ? stack_depot_save_flags+0x33/0x7f0 [ 89.815141][ T6143] ? __lock_acquire+0x747/0x2de0 [ 89.815165][ T6143] ? kasan_save_track+0x4f/0x80 [ 89.815183][ T6143] ? kasan_save_track+0x3e/0x80 [ 89.815200][ T6143] ? kasan_save_free_info+0x40/0x50 [ 89.815223][ T6143] ? __kasan_slab_free+0x5c/0x80 [ 89.815241][ T6143] ? kfree+0x1c5/0x650 [ 89.815264][ T6143] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 89.815289][ T6143] ? security_file_ioctl+0xc3/0x2a0 [ 89.815312][ T6143] ? __se_sys_ioctl+0x47/0x170 [ 89.815333][ T6143] ? do_syscall_64+0x166/0x520 [ 89.815352][ T6143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.815397][ T6143] ? file_ioctl+0x253/0x7d0 [ 89.815423][ T6143] ? __pfx_file_ioctl+0x10/0x10 [ 89.815464][ T6143] ? kasan_quarantine_put+0xbb/0x1f0 [ 89.815496][ T6143] ? tomoyo_path_number_perm+0x219/0x5f0 [ 89.815524][ T6143] ? tomoyo_path_number_perm+0x219/0x5f0 [ 89.815552][ T6143] ? do_vfs_ioctl+0x116f/0x1530 [ 89.815576][ T6143] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 89.815613][ T6143] ? do_futex+0x3e7/0x4e0 [ 89.815658][ T6143] ? __fget_files+0x2a/0x420 [ 89.815676][ T6143] ? __fget_files+0x2a/0x420 [ 89.815692][ T6143] ? __fget_files+0x2a/0x420 [ 89.815709][ T6143] ? f2fs_ioctl+0x135/0x250 [ 89.815725][ T6143] ? __pfx_f2fs_ioctl+0x10/0x10 [ 89.815741][ T6143] __se_sys_ioctl+0xfc/0x170 [ 89.815762][ T6143] do_syscall_64+0x166/0x520 [ 89.815778][ T6143] ? trace_irq_disable+0x3b/0x140 [ 89.815795][ T6143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.815810][ T6143] ? clear_bhb_loop+0x70/0xc0 [ 89.815830][ T6143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.815844][ T6143] RIP: 0033:0x7f67f719e2d9 [ 89.815862][ T6143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.815877][ T6143] RSP: 002b:00007f67f811d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 89.815898][ T6143] RAX: ffffffffffffffda RBX: 00007f67f7425fa0 RCX: 00007f67f719e2d9 [ 89.815912][ T6143] RDX: 0000000000000000 RSI: 000000000000f502 RDI: 0000000000000005 [ 89.815923][ T6143] RBP: 00007f67f7235888 R08: 0000000000000000 R09: 0000000000000000 [ 89.815935][ T6143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.815947][ T6143] R13: 00007f67f7426038 R14: 00007f67f7425fa0 R15: 00007ffec6347038 [ 89.815980][ T6143] [ 89.830304][ T6143] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 89.830417][ T6143] CPU: 0 UID: 0 PID: 6143 Comm: syz.1.127 Not tainted syzkaller #0 PREEMPT(full) [ 89.830439][ T6143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.830450][ T6143] Call Trace: [ 89.830458][ T6143] [ 89.830465][ T6143] dump_stack_lvl+0xe8/0x150 [ 89.830498][ T6143] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 89.830530][ T6143] f2fs_write_end_bio+0x118e/0x15d0 [ 89.830566][ T6143] __submit_merged_bio+0x258/0x6a0 [ 89.830592][ T6143] ? rcu_is_watching+0x16/0xb0 [ 89.830627][ T6143] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 89.830658][ T6143] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 89.830712][ T6143] f2fs_write_data_pages+0x2a13/0x36e0 [ 89.830769][ T6143] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 89.830788][ T6143] ? is_bpf_text_address+0x26/0x2b0 [ 89.830825][ T6143] ? arch_stack_walk+0xfb/0x150 [ 89.830881][ T6143] ? add_lock_to_list+0xc7/0x100 [ 89.830905][ T6143] ? lockdep_unlock+0x5c/0xd0 [ 89.830921][ T6143] ? __lock_acquire+0x1511/0x2de0 [ 89.830973][ T6143] ? do_raw_spin_lock+0x12b/0x2f0 [ 89.831010][ T6143] ? do_raw_spin_unlock+0xf5/0x200 [ 89.831037][ T6143] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 89.831058][ T6143] do_writepages+0x338/0x560 [ 89.831095][ T6143] ? do_raw_spin_unlock+0xf5/0x200 [ 89.831131][ T6143] filemap_fdatawrite+0x1e9/0x2f0 [ 89.831162][ T6143] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 89.831235][ T6143] ? do_raw_spin_unlock+0xf5/0x200 [ 89.831266][ T6143] f2fs_sync_dirty_inodes+0x471/0x970 [ 89.831307][ T6143] f2fs_write_checkpoint+0x860/0x24d0 [ 89.831365][ T6143] f2fs_issue_checkpoint+0x424/0x6f0 [ 89.831389][ T6143] ? __lock_acquire+0x1511/0x2de0 [ 89.831415][ T6143] ? __pfx_f2fs_issue_checkpoint+0x10/0x10 [ 89.831448][ T6143] ? rcu_is_watching+0x16/0xb0 [ 89.831473][ T6143] ? __up_read+0x29c/0x930 [ 89.831544][ T6143] ? f2fs_sync_fs+0x1f2/0x3c0 [ 89.831574][ T6143] f2fs_do_sync_file+0xc5a/0x1880 [ 89.831612][ T6143] ? __pfx_f2fs_do_sync_file+0x10/0x10 [ 89.831638][ T6143] ? sb_start_write+0x112/0x1c0 [ 89.831661][ T6143] ? mnt_want_write_file+0x164/0x200 [ 89.831686][ T6143] __f2fs_ioctl+0x44d4/0xde00 [ 89.831712][ T6143] ? lock_acquire+0x115/0x350 [ 89.831742][ T6143] ? is_bpf_text_address+0x26/0x2b0 [ 89.831773][ T6143] ? is_bpf_text_address+0x292/0x2b0 [ 89.831798][ T6143] ? is_bpf_text_address+0x26/0x2b0 [ 89.831823][ T6143] ? __pfx___f2fs_ioctl+0x10/0x10 [ 89.831841][ T6143] ? kernel_text_address+0xa5/0xe0 [ 89.831863][ T6143] ? __kernel_text_address+0xd/0x30 [ 89.831882][ T6143] ? unwind_get_return_address+0x4d/0x90 [ 89.831905][ T6143] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 89.831926][ T6143] ? arch_stack_walk+0xfb/0x150 [ 89.831959][ T6143] ? stack_trace_save+0xa9/0x100 [ 89.831979][ T6143] ? __pfx_stack_trace_save+0x10/0x10 [ 89.831997][ T6143] ? kasan_save_track+0x4f/0x80 [ 89.832020][ T6143] ? stack_depot_save_flags+0x33/0x7f0 [ 89.832044][ T6143] ? __lock_acquire+0x747/0x2de0 [ 89.832068][ T6143] ? kasan_save_track+0x4f/0x80 [ 89.832085][ T6143] ? kasan_save_track+0x3e/0x80 [ 89.832102][ T6143] ? kasan_save_free_info+0x40/0x50 [ 89.832132][ T6143] ? __kasan_slab_free+0x5c/0x80 [ 89.832149][ T6143] ? kfree+0x1c5/0x650 [ 89.832171][ T6143] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 89.832195][ T6143] ? security_file_ioctl+0xc3/0x2a0 [ 89.832216][ T6143] ? __se_sys_ioctl+0x47/0x170 [ 89.832236][ T6143] ? do_syscall_64+0x166/0x520 [ 89.832254][ T6143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.832295][ T6143] ? file_ioctl+0x253/0x7d0 [ 89.832323][ T6143] ? __pfx_file_ioctl+0x10/0x10 [ 89.832359][ T6143] ? kasan_quarantine_put+0xbb/0x1f0 [ 89.832391][ T6143] ? tomoyo_path_number_perm+0x219/0x5f0 [ 89.832417][ T6143] ? tomoyo_path_number_perm+0x219/0x5f0 [ 89.832446][ T6143] ? do_vfs_ioctl+0x116f/0x1530 [ 89.832469][ T6143] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 89.832506][ T6143] ? do_futex+0x3e7/0x4e0 [ 89.832552][ T6143] ? __fget_files+0x2a/0x420 [ 89.832575][ T6143] ? __fget_files+0x2a/0x420 [ 89.832592][ T6143] ? __fget_files+0x2a/0x420 [ 89.832613][ T6143] ? f2fs_ioctl+0x135/0x250 [ 89.832630][ T6143] ? __pfx_f2fs_ioctl+0x10/0x10 [ 89.832648][ T6143] __se_sys_ioctl+0xfc/0x170 [ 89.832672][ T6143] do_syscall_64+0x166/0x520 [ 89.832690][ T6143] ? trace_irq_disable+0x3b/0x140 [ 89.832711][ T6143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.832729][ T6143] ? clear_bhb_loop+0x70/0xc0 [ 89.832752][ T6143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.832769][ T6143] RIP: 0033:0x7f67f719e2d9 [ 89.832788][ T6143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.832803][ T6143] RSP: 002b:00007f67f811d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 89.832822][ T6143] RAX: ffffffffffffffda RBX: 00007f67f7425fa0 RCX: 00007f67f719e2d9 [ 89.832836][ T6143] RDX: 0000000000000000 RSI: 000000000000f502 RDI: 0000000000000005 [ 89.832847][ T6143] RBP: 00007f67f7235888 R08: 0000000000000000 R09: 0000000000000000 [ 89.832858][ T6143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.832869][ T6143] R13: 00007f67f7426038 R14: 00007f67f7425fa0 R15: 00007ffec6347038 [ 89.832901][ T6143] [ 89.844021][ T6143] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 89.924845][ T5603] Bluetooth: hci0: command 0x2016 tx timeout [ 90.519796][ T6181] netlink: 12 bytes leftover after parsing attributes in process `syz.3.137'. [ 91.036381][ T6185] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 91.333035][ T6187] loop3: detected capacity change from 0 to 32768 [ 91.345603][ T6187] xfs: Deprecated parameter 'noattr2' [ 91.345630][ T6187] XFS: noattr2 mount option is deprecated. [ 91.410372][ T6187] XFS (loop3): DAX unsupported by block device. Turning off DAX. [ 91.438632][ T6187] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 91.668932][ T6187] XFS (loop3): Ending clean mount [ 91.714458][ T6187] XFS (loop3): Quotacheck needed: Please wait. [ 91.911374][ T6187] XFS (loop3): Quotacheck: Done. [ 92.284082][ T5607] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 92.380894][ T6230] FAULT_INJECTION: forcing a failure. [ 92.380894][ T6230] name failslab, interval 1, probability 0, space 0, times 0 [ 92.380923][ T6230] CPU: 1 UID: 0 PID: 6230 Comm: syz.0.156 Not tainted syzkaller #0 PREEMPT(full) [ 92.380943][ T6230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.380953][ T6230] Call Trace: [ 92.380960][ T6230] [ 92.380968][ T6230] dump_stack_lvl+0xe8/0x150 [ 92.381000][ T6230] should_fail_ex+0x3eb/0x540 [ 92.381025][ T6230] should_failslab+0xa8/0x100 [ 92.381046][ T6230] ? __anon_vma_prepare+0xbe/0x4a0 [ 92.381071][ T6230] kmem_cache_alloc_noprof+0x9c/0x600 [ 92.381100][ T6230] ? __anon_vma_prepare+0xbe/0x4a0 [ 92.381131][ T6230] __anon_vma_prepare+0xbe/0x4a0 [ 92.381161][ T6230] madvise_vma_behavior+0x43c9/0x4a00 [ 92.381193][ T6230] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 92.381224][ T6230] ? do_raw_spin_unlock+0xf5/0x200 [ 92.381262][ T6230] ? look_up_lock_class+0x57/0x110 [ 92.381285][ T6230] ? register_lock_class+0x31/0x2e0 [ 92.381338][ T6230] ? __pfx_guard_install_pud_entry+0x10/0x10 [ 92.381359][ T6230] ? __pfx_guard_install_pmd_entry+0x10/0x10 [ 92.381381][ T6230] ? __pfx_guard_install_pte_entry+0x10/0x10 [ 92.381405][ T6230] ? __pfx_guard_install_set_pte+0x10/0x10 [ 92.381437][ T6230] ? finish_task_switch+0x40e/0xc60 [ 92.381465][ T6230] ? __lock_acquire+0x747/0x2de0 [ 92.381514][ T6230] ? mas_prev_slot+0xb76/0xbf0 [ 92.381555][ T6230] ? find_vma_prev+0x123/0x1b0 [ 92.381577][ T6230] ? lock_acquire+0x115/0x350 [ 92.381598][ T6230] ? __pfx_find_vma_prev+0x10/0x10 [ 92.381635][ T6230] ? down_read+0x2b9/0x320 [ 92.381663][ T6230] madvise_walk_vmas+0x57d/0xb70 [ 92.381697][ T6230] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 92.381724][ T6230] ? blk_start_plug+0x6e/0x1b0 [ 92.381756][ T6230] madvise_do_behavior+0x385/0x540 [ 92.381783][ T6230] ? __pfx_madvise_do_behavior+0x10/0x10 [ 92.381823][ T6230] do_madvise+0x327/0x3a0 [ 92.381845][ T6230] ? __pfx_do_madvise+0x10/0x10 [ 92.381878][ T6230] ? __se_sys_futex+0x3a8/0x450 [ 92.381916][ T6230] ? rcu_is_watching+0x16/0xb0 [ 92.381949][ T6230] __x64_sys_madvise+0xa6/0xc0 [ 92.381973][ T6230] do_syscall_64+0x166/0x520 [ 92.381993][ T6230] ? trace_irq_disable+0x3b/0x140 [ 92.382015][ T6230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.382034][ T6230] ? clear_bhb_loop+0x70/0xc0 [ 92.382058][ T6230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.382077][ T6230] RIP: 0033:0x7f0c7e59e2d9 [ 92.382095][ T6230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.382111][ T6230] RSP: 002b:00007f0c7f477028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 92.382133][ T6230] RAX: ffffffffffffffda RBX: 00007f0c7e825fa0 RCX: 00007f0c7e59e2d9 [ 92.382147][ T6230] RDX: 0000000000000066 RSI: 000000000080fd00 RDI: 000020000042f000 [ 92.382165][ T6230] RBP: 00007f0c7e635888 R08: 0000000000000000 R09: 0000000000000000 [ 92.382177][ T6230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.382190][ T6230] R13: 00007f0c7e826038 R14: 00007f0c7e825fa0 R15: 00007ffc7ab0d108 [ 92.382226][ T6230] [ 92.580015][ T5700] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 92.765393][ T6214] loop1: detected capacity change from 0 to 32768 [ 92.777740][ T5700] usb 5-1: New USB device found: idVendor=0b48, idProduct=1006, bcdDevice=1.00 [ 92.781100][ T5700] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.781149][ T5700] usb 5-1: config 1 interface 0 has no altsetting 1 [ 92.784951][ T5700] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.784975][ T5700] usb 5-1: Product: syz [ 92.784988][ T5700] usb 5-1: Manufacturer: syz [ 92.785007][ T5700] usb 5-1: SerialNumber: syz [ 92.815107][ T6214] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.149 (6214) [ 93.087397][ T5700] ttusb_dec_send_command: command bulk message failed: error -71 [ 93.087604][ T5700] ttusb-dec 5-1:1.0: probe with driver ttusb-dec failed with error -71 [ 93.101321][ T6214] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 93.101365][ T6214] BTRFS info (device loop1): using crc32c checksum algorithm [ 93.139851][ T5700] usb 5-1: USB disconnect, device number 3 [ 93.383699][ T6214] BTRFS info (device loop1): enabling ssd optimizations [ 93.383728][ T6214] BTRFS info (device loop1): turning on flush-on-commit [ 93.383753][ T6214] BTRFS info (device loop1): enabling free space tree [ 93.383770][ T6214] BTRFS info (device loop1): enabling auto defrag [ 93.383795][ T6214] BTRFS info (device loop1): use lzo compression, level 1 [ 93.383813][ T6214] BTRFS info (device loop1): max_inline set to 4096 [ 93.498761][ T6252] team0: Device xfrm0 is of different type [ 93.614560][ T6256] loop0: detected capacity change from 0 to 1 [ 94.007495][ T6257] ldm_validate_privheads(): Disk read failed. [ 94.007560][ T6257] loop0: [ 94.007577][ T6257] loop0: partition table partially beyond EOD, truncated [ 94.161193][ T6263] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 94.568740][ T5605] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 94.970728][ T6284] Illegal XDP return value 4294967282 on prog (id 22) dev syz_tun, expect packet loss! [ 95.448168][ T6285] loop3: detected capacity change from 0 to 40427 [ 95.483863][ T6285] F2FS-fs (loop3): invalid crc value [ 95.751323][ T6285] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 95.792588][ T6285] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 95.879732][ T6285] xt_hashlimit: size too large, truncated to 1048576 [ 95.972126][ T6318] netlink: 8 bytes leftover after parsing attributes in process `syz.1.183'. [ 96.561364][ T6338] capability: warning: `syz.1.192' uses deprecated v2 capabilities in a way that may be insecure [ 96.793903][ T6340] loop0: detected capacity change from 0 to 32768 [ 96.805857][ T6340] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.193 (6340) [ 96.815694][ T6340] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 96.815726][ T6340] BTRFS info (device loop0): using crc32c checksum algorithm [ 96.917046][ T6340] BTRFS info (device loop0): enabling ssd optimizations [ 96.917072][ T6340] BTRFS info (device loop0): turning on flush-on-commit [ 96.917087][ T6340] BTRFS info (device loop0): enabling free space tree [ 96.917101][ T6340] BTRFS info (device loop0): enabling auto defrag [ 96.918385][ T6340] BTRFS info (device loop0): use lzo compression, level 1 [ 96.918410][ T6340] BTRFS info (device loop0): max_inline set to 4096 [ 96.949855][ T32] audit: type=1800 audit(1791999150.288:4): pid=6340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.193" name="file1" dev="loop0" ino=260 res=0 errno=-22 [ 97.905982][ T5601] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 98.408522][ T6391] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 98.843455][ T6383] loop4: detected capacity change from 0 to 32768 [ 98.896557][ T6383] XFS (loop4): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 98.970127][ T6383] XFS (loop4): Ending clean mount [ 99.105131][ T6383] XFS (loop4): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair. [ 99.289076][ T6428] netlink: 8 bytes leftover after parsing attributes in process `syz.0.217'. [ 99.289099][ T6428] netlink: 4 bytes leftover after parsing attributes in process `syz.0.217'. [ 99.354639][ T5613] XFS (loop4): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 99.407738][ T6428] Zero length message leads to an empty skb [ 99.420974][ T44] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.425154][ T63] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.425195][ T63] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.425226][ T63] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.459686][ T6432] loop1: detected capacity change from 0 to 512 [ 99.496008][ T6432] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 99.496026][ T6432] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 99.569379][ T6432] EXT4-fs (loop1): 1 truncate cleaned up [ 99.704731][ T6432] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 99.741976][ T6440] netlink: 'syz.2.223': attribute type 21 has an invalid length. [ 99.741997][ T6440] netlink: 4 bytes leftover after parsing attributes in process `syz.2.223'. [ 99.809559][ T6440] netlink: 'syz.2.223': attribute type 21 has an invalid length. [ 99.809583][ T6440] netlink: 4 bytes leftover after parsing attributes in process `syz.2.223'. [ 99.811272][ T6432] EXT4-fs error (device loop1): ext4_generic_delete_entry:2675: inode #2: block 13: comm syz.1.220: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 99.817601][ T63] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.817642][ T63] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.817672][ T63] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.817702][ T63] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 99.846759][ T6432] EXT4-fs (loop1): Remounting filesystem read-only [ 99.846784][ T6432] EXT4-fs warning (device loop1): ext4_rename_delete:3742: inode #2: comm syz.1.220: Deleting old file: nlink 5, error=-117 [ 99.969620][ T6444] FAULT_INJECTION: forcing a failure. [ 99.969620][ T6444] name failslab, interval 1, probability 0, space 0, times 0 [ 99.969652][ T6444] CPU: 1 UID: 0 PID: 6444 Comm: syz.0.224 Not tainted syzkaller #0 PREEMPT(full) [ 99.969673][ T6444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.969685][ T6444] Call Trace: [ 99.969693][ T6444] [ 99.969701][ T6444] dump_stack_lvl+0xe8/0x150 [ 99.969735][ T6444] should_fail_ex+0x3eb/0x540 [ 99.969762][ T6444] should_failslab+0xa8/0x100 [ 99.969787][ T6444] __kmalloc_noprof+0xf9/0x710 [ 99.969815][ T6444] ? rcu_is_watching+0x16/0xb0 [ 99.969840][ T6444] ? tomoyo_realpath_from_path+0xef/0x640 [ 99.969859][ T6444] ? tomoyo_realpath_from_path+0xef/0x640 [ 99.969885][ T6444] tomoyo_realpath_from_path+0xef/0x640 [ 99.969918][ T6444] tomoyo_path_perm+0x283/0x560 [ 99.969944][ T6444] ? tomoyo_path_perm+0x251/0x560 [ 99.969970][ T6444] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 99.970002][ T6444] ? __pfx___futex_wait+0x10/0x10 [ 99.970045][ T6444] ? __fget_files+0x2a/0x420 [ 99.970066][ T6444] ? __fget_files+0x2a/0x420 [ 99.970084][ T6444] ? __fget_files+0x2a/0x420 [ 99.970107][ T6444] security_inode_getattr+0x12b/0x310 [ 99.970132][ T6444] __se_sys_newfstat+0x133/0x440 [ 99.970167][ T6444] ? __pfx___se_sys_newfstat+0x10/0x10 [ 99.970202][ T6444] ? do_futex+0x3e7/0x4e0 [ 99.970243][ T6444] ? __pfx_do_futex+0x10/0x10 [ 99.970268][ T6444] ? __fget_files+0x3a2/0x420 [ 99.970308][ T6444] ? rcu_is_watching+0x16/0xb0 [ 99.970347][ T6444] do_syscall_64+0x166/0x520 [ 99.970368][ T6444] ? trace_irq_disable+0x3b/0x140 [ 99.970390][ T6444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.970409][ T6444] ? clear_bhb_loop+0x70/0xc0 [ 99.970430][ T6444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.970448][ T6444] RIP: 0033:0x7f0c7e59e2d9 [ 99.970465][ T6444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.970481][ T6444] RSP: 002b:00007f0c7f477028 EFLAGS: 00000246 ORIG_RAX: 0000000000000005 [ 99.970501][ T6444] RAX: ffffffffffffffda RBX: 00007f0c7e825fa0 RCX: 00007f0c7e59e2d9 [ 99.970516][ T6444] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 99.970528][ T6444] RBP: 00007f0c7e635888 R08: 0000000000000000 R09: 0000000000000000 [ 99.970540][ T6444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.970552][ T6444] R13: 00007f0c7e826038 R14: 00007f0c7e825fa0 R15: 00007ffc7ab0d108 [ 99.970584][ T6444] [ 99.970605][ T6444] ERROR: Out of memory at tomoyo_realpath_from_path. [ 100.049346][ T5605] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.114345][ T6435] loop3: detected capacity change from 0 to 32768 [ 100.186901][ T6435] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.221 (6435) [ 100.352319][ T6435] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 100.352351][ T6435] BTRFS info (device loop3): using crc32c checksum algorithm [ 100.509415][ T6435] BTRFS info (device loop3): enabling ssd optimizations [ 100.509442][ T6435] BTRFS info (device loop3): turning on flush-on-commit [ 100.509471][ T6435] BTRFS info (device loop3): enabling free space tree [ 100.509487][ T6435] BTRFS info (device loop3): enabling auto defrag [ 100.509502][ T6435] BTRFS info (device loop3): use lzo compression, level 1 [ 100.509521][ T6435] BTRFS info (device loop3): max_inline set to 4096 [ 100.834377][ T6480] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 100.844497][ T6480] bond1: (slave lo): Enslaving as an active interface with an up link [ 100.852519][ T6480] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 100.953737][ T5607] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 101.149356][ T6486] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 101.320141][ T6501] netlink: 'syz.2.241': attribute type 1 has an invalid length. [ 101.453311][ T6501] 8021q: adding VLAN 0 to HW filter on device bond1 [ 101.540773][ T6503] bond1: (slave gretap1): making interface the new active one [ 101.560731][ T6503] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 101.574057][ T6511] loop3: detected capacity change from 0 to 128 [ 101.658838][ T6511] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 101.658875][ T6511] hpfs: filesystem error: improperly stopped [ 101.658889][ T6511] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 101.658902][ T6511] hpfs: You really don't want any checks? You are crazy... [ 101.658922][ T6511] hpfs: Code page index out of array [ 101.658929][ T6511] hpfs: code page support is disabled [ 101.659619][ T6511] hpfs: hpfs_map_4sectors(): unaligned read [ 101.659894][ T6511] hpfs: hpfs_map_4sectors(): unaligned read [ 101.659905][ T6511] hpfs: filesystem error: unable to find root dir [ 101.983941][ T6525] FAULT_INJECTION: forcing a failure. [ 101.983941][ T6525] name fail_futex, interval 1, probability 0, space 0, times 1 [ 101.983974][ T6525] CPU: 1 UID: 0 PID: 6525 Comm: syz.1.249 Not tainted syzkaller #0 PREEMPT(full) [ 101.983995][ T6525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.984006][ T6525] Call Trace: [ 101.984013][ T6525] [ 101.984021][ T6525] dump_stack_lvl+0xe8/0x150 [ 101.984055][ T6525] should_fail_ex+0x3eb/0x540 [ 101.984081][ T6525] get_futex_key+0x1b4/0x1580 [ 101.984114][ T6525] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 101.984148][ T6525] ? __pfx_get_futex_key+0x10/0x10 [ 101.984173][ T6525] ? stack_depot_save_flags+0x404/0x7f0 [ 101.984195][ T6525] ? __pfx___filename_parentat+0x10/0x10 [ 101.984232][ T6525] futex_wake+0x119/0x5f0 [ 101.984250][ T6525] ? do_syscall_64+0x166/0x520 [ 101.984268][ T6525] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.984293][ T6525] ? __pfx_futex_wake+0x10/0x10 [ 101.984327][ T6525] do_futex+0x458/0x4e0 [ 101.984359][ T6525] ? __pfx_do_futex+0x10/0x10 [ 101.984397][ T6525] __se_sys_futex+0x3a8/0x450 [ 101.984436][ T6525] ? kmem_cache_free+0x182/0x650 [ 101.984455][ T6525] ? __pfx___se_sys_futex+0x10/0x10 [ 101.984485][ T6525] ? do_getname+0x206/0x250 [ 101.984509][ T6525] ? __x64_sys_futex+0x21/0xf0 [ 101.984535][ T6525] do_syscall_64+0x166/0x520 [ 101.984553][ T6525] ? trace_irq_disable+0x3b/0x140 [ 101.984572][ T6525] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.984587][ T6525] ? clear_bhb_loop+0x70/0xc0 [ 101.984607][ T6525] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.984623][ T6525] RIP: 0033:0x7f67f719e2d9 [ 101.984639][ T6525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.984654][ T6525] RSP: 002b:00007f67f811d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 101.984680][ T6525] RAX: ffffffffffffffda RBX: 00007f67f7425fa8 RCX: 00007f67f719e2d9 [ 101.984693][ T6525] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f67f7425fac [ 101.984704][ T6525] RBP: 00007f67f7425fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 101.984716][ T6525] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 101.984727][ T6525] R13: 00007f67f7426038 R14: 00007ffec6346f50 R15: 00007ffec6347038 [ 101.984758][ T6525] [ 102.600454][ T6533] kvm: user requested TSC rate below hardware speed [ 103.999669][ T6565] warning: `syz.2.264' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 104.968007][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 105.137348][ T9] usb 5-1: New USB device found: idVendor=06cd, idProduct=0135, bcdDevice=1.00 [ 105.139596][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.139646][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.203757][ T9] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 105.204008][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 105.204075][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 105.239622][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 105.239763][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 105.283877][ T9] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 105.310621][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 105.310689][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 105.313865][ T9] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 105.707294][ T9] usb 5-1: USB disconnect, device number 4 [ 105.737895][ T9] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 105.756464][ T9] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 105.757503][ T9] keyspan 5-1:1.0: device disconnected [ 105.776247][ T6607] netlink: 'syz.1.280': attribute type 1 has an invalid length. [ 105.776268][ T6607] netlink: 'syz.1.280': attribute type 22 has an invalid length. [ 106.062513][ T32] audit: type=1800 audit(1791999159.408:5): pid=6617 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.285" name="bus" dev="tmpfs" ino=283 res=0 errno=-22 [ 106.708595][ T5602] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 106.857368][ T5602] usb 4-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 106.863031][ T5602] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 106.863058][ T5602] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 106.863075][ T5602] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 106.863116][ T5602] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 106.863139][ T5602] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 106.944920][ T6635] loop4: detected capacity change from 0 to 4096 [ 106.954809][ T6635] EXT4-fs: Ignoring removed nobh option [ 106.955481][ T6635] EXT4-fs: Ignoring removed bh option [ 106.998925][ T5602] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 106.998951][ T5602] usb 4-1: Product: syz [ 106.998964][ T5602] usb 4-1: Manufacturer: syz [ 107.045754][ T5602] cdc_wdm 4-1:1.0: skipping garbage [ 107.045774][ T5602] cdc_wdm 4-1:1.0: skipping garbage [ 107.061449][ T6635] EXT4-fs (loop4): Test dummy encryption mode enabled [ 107.104912][ T5602] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 107.104935][ T5602] cdc_wdm 4-1:1.0: Unknown control protocol [ 107.262006][ T6635] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 107.405838][ C0] wdm_int_callback: 43 callbacks suppressed [ 107.405865][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.405882][ C0] wdm_int_callback: 43 callbacks suppressed [ 107.405897][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.406126][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.406145][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.406411][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.406430][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.406709][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.406728][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.412813][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.412838][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.413199][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.413220][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.413412][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.413431][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.413625][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.413644][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.413845][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.413864][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.414062][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 107.414086][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 107.429037][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 107.429073][ T5602] usb 4-1: USB disconnect, device number 4 [ 107.872710][ T5613] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.510904][ T5602] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 109.656899][ T5602] usb 5-1: Using ep0 maxpacket: 16 [ 109.659498][ T5602] usb 5-1: New USB device found: idVendor=046e, idProduct=5577, bcdDevice=0.00 [ 109.682196][ T5602] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.682227][ T5602] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.682246][ T5602] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 109.682270][ T5602] usb 5-1: config 0 interface 0 has no altsetting 0 [ 109.682300][ T5602] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.755829][ T5602] usb 5-1: config 0 descriptor?? [ 110.401645][ T5602] input: HID 046e:5577 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:046E:5577.0001/input/input8 [ 110.520958][ T5602] topseed 0003:046E:5577.0001: input,hidraw0: USB HID v0.00 Joystick [HID 046e:5577] on usb-dummy_hcd.4-1/input0 [ 110.687361][ T32] audit: type=1800 audit(1791999164.028:6): pid=6682 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.309" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=-22 [ 110.778350][ T5602] usb 5-1: USB disconnect, device number 5 [ 111.256224][ T6680] fido_id[6680]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 111.884407][ T6692] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input9 [ 112.003705][ T6702] FAULT_INJECTION: forcing a failure. [ 112.003705][ T6702] name failslab, interval 1, probability 0, space 0, times 0 [ 112.003753][ T6702] CPU: 0 UID: 0 PID: 6702 Comm: syz.3.319 Not tainted syzkaller #0 PREEMPT(full) [ 112.003775][ T6702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.003787][ T6702] Call Trace: [ 112.003794][ T6702] [ 112.003802][ T6702] dump_stack_lvl+0xe8/0x150 [ 112.003847][ T6702] should_fail_ex+0x3eb/0x540 [ 112.003873][ T6702] should_failslab+0xa8/0x100 [ 112.003899][ T6702] ? alloc_uid+0x151/0x570 [ 112.003925][ T6702] kmem_cache_alloc_noprof+0x9c/0x600 [ 112.003964][ T6702] ? alloc_uid+0x151/0x570 [ 112.003990][ T6702] ? _raw_spin_unlock_irq+0x23/0x50 [ 112.004024][ T6702] alloc_uid+0x151/0x570 [ 112.004062][ T6702] __sys_setreuid+0x3f8/0x960 [ 112.004092][ T6702] do_syscall_64+0x166/0x520 [ 112.004112][ T6702] ? trace_irq_disable+0x3b/0x140 [ 112.004135][ T6702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.004154][ T6702] ? clear_bhb_loop+0x70/0xc0 [ 112.004177][ T6702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.004196][ T6702] RIP: 0033:0x7fca3239e2d9 [ 112.004219][ T6702] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.004235][ T6702] RSP: 002b:00007fca33203028 EFLAGS: 00000246 ORIG_RAX: 0000000000000071 [ 112.004259][ T6702] RAX: ffffffffffffffda RBX: 00007fca32625fa0 RCX: 00007fca3239e2d9 [ 112.004273][ T6702] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000ee01 [ 112.004285][ T6702] RBP: 00007fca32435888 R08: 0000000000000000 R09: 0000000000000000 [ 112.004296][ T6702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.004307][ T6702] R13: 00007fca32626038 R14: 00007fca32625fa0 R15: 00007ffeb67e11d8 [ 112.004339][ T6702] [ 112.422112][ T6704] mmap: syz.2.311 (6704) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 112.693473][ T6708] loop3: detected capacity change from 0 to 1024 [ 112.885366][ T6708] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 112.885475][ T6708] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 113.841508][ T6713] loop0: detected capacity change from 0 to 131072 [ 113.914154][ T6713] F2FS-fs (loop0): Wrong secs_per_zone / total_sections (512, 24) [ 113.914181][ T6713] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 113.914210][ T6713] F2FS-fs (loop0): Test dummy encryption mode enabled [ 113.926216][ T6713] F2FS-fs (loop0): invalid crc value [ 114.012756][ T6713] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 114.013450][ T6713] loop0: lost filesystem error report for type 5 error -117 [ 114.036125][ T6713] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 114.059426][ T6713] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0 [ 114.059468][ T6713] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 114.059552][ T6713] F2FS-fs (loop0): Start checkpoint disabled! [ 114.075468][ T6713] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0 [ 114.113687][ T6713] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0 [ 114.113715][ T6713] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 114.216725][ T32] audit: type=1800 audit(1791999167.508:7): pid=6708 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.322" name="file1" dev="loop3" ino=15 res=0 errno=-22 [ 114.339325][ T6713] fscrypt: AES-256-XTS using blk-crypto-fallback [ 114.446395][ T6725] EXT4-fs error (device loop3): ext4_map_blocks:944: inode #15: block 3: comm syz.3.322: lblock 3 mapped to illegal pblock 3 (length 3) [ 114.564428][ T6725] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 114.564461][ T6725] EXT4-fs (loop3): This should not happen!! Data will be lost [ 114.564461][ T6725] [ 114.639728][ T6712] EXT4-fs error (device loop3): ext4_validate_block_bitmap:445: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 114.685746][ T6708] EXT4-fs error (device loop3): ext4_map_blocks:944: inode #15: comm syz.3.322: lblock 0 mapped to illegal pblock 0 (length 1) [ 114.746462][ T6708] EXT4-fs error (device loop3): ext4_ext_remove_space:2977: inode #15: comm syz.3.322: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 3, max 4(4), depth 0(0) [ 114.969416][ T13] EXT4-fs error (device loop3): ext4_map_blocks:944: inode #15: block 8: comm kworker/u8:1: lblock 8 mapped to illegal pblock 8 (length 8) [ 114.989402][ T13] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 114.989434][ T13] EXT4-fs (loop3): This should not happen!! Data will be lost [ 114.989434][ T13] [ 115.042576][ T5607] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 116.116300][ T6740] bridge_slave_1: left allmulticast mode [ 116.116327][ T6740] bridge_slave_1: left promiscuous mode [ 116.132651][ T6740] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.159482][ T6740] bridge_slave_0: left allmulticast mode [ 116.159511][ T6740] bridge_slave_0: left promiscuous mode [ 116.181117][ T6740] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.362415][ T32] audit: type=1800 audit(1791999170.708:8): pid=6760 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.336" name="file1" dev="tmpfs" ino=345 res=0 errno=-22 [ 117.997540][ T5709] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 118.158251][ T5709] usb 1-1: New USB device found: idVendor=06cd, idProduct=0107, bcdDevice=1.00 [ 118.159369][ T5709] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.161959][ T6774] netlink: 52 bytes leftover after parsing attributes in process `syz.1.343'. [ 118.203641][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.203666][ T5709] usb 1-1: Product: syz [ 118.203679][ T5709] usb 1-1: Manufacturer: syz [ 118.203691][ T5709] usb 1-1: SerialNumber: syz [ 118.259719][ T6776] netlink: 52 bytes leftover after parsing attributes in process `syz.1.343'. [ 118.279015][ T5709] keyspan 1-1:1.0: Keyspan 1 port adapter converter detected [ 118.279222][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 84 [ 118.284885][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 81 [ 118.284985][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 82 [ 118.285064][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 1 [ 118.285142][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 2 [ 118.285222][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 83 [ 118.285303][ T5709] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 3 [ 118.367681][ T9] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 118.410479][ T5709] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 118.517517][ T9] usb 5-1: New USB device found: idVendor=2c7c, idProduct=0125, bcdDevice=0.00 [ 118.521688][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 118.521735][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.724393][ T6781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.345'. [ 118.913266][ T9] qmi_wwan 5-1:1.0: cdc-wdm0: USB WDM device [ 118.946060][ T9] wwan wwan0: port wwan0qmi0 attached [ 119.033315][ T5709] usb 1-1: USB disconnect, device number 2 [ 119.072505][ T5709] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 119.075489][ T5709] keyspan 1-1:1.0: device disconnected [ 119.211028][ T9] qmi_wwan 5-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.4-1, WWAN/QMI device, f6:51:3b:ae:03:09 [ 119.308615][ T9] usb 5-1: USB disconnect, device number 6 [ 119.347884][ T9] qmi_wwan 5-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.4-1, WWAN/QMI device [ 119.545651][ T9] wwan wwan0: port wwan0qmi0 disconnected [ 119.756889][ T6755] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 119.908806][ T6755] usb 4-1: New USB device found: idVendor=0711, idProduct=0900, bcdDevice=1.00 [ 119.910262][ T6755] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 119.910289][ T6755] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 119.912911][ T6755] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.912936][ T6755] usb 4-1: Product: syz [ 119.912949][ T6755] usb 4-1: Manufacturer: syz [ 119.912962][ T6755] usb 4-1: SerialNumber: syz [ 120.197811][ T6755] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 120.623828][ T6755] usb 4-1: USB disconnect, device number 5 [ 120.652151][ T6755] usblp0: removed [ 122.126824][ T5716] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 122.133376][ T6812] netlink: 4 bytes leftover after parsing attributes in process `syz.1.357'. [ 122.281479][ T5716] usb 1-1: New USB device found: idVendor=0572, idProduct=cafe, bcdDevice=1.00 [ 122.285591][ T5716] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 122.285647][ T5716] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 122.285672][ T5716] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 122.285709][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.920241][ T5716] cxacru 1-1:1.0: send of cm 0x91 failed (-71) [ 122.920308][ T5716] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 122.920321][ T5716] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 122.989377][ T6822] jffs2: notice: (6822) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 123.115670][ T5716] cxacru 1-1:1.0: probe with driver cxacru failed with error -71 [ 123.154388][ T5716] usb 1-1: USB disconnect, device number 3 [ 124.046519][ T6838] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 125.108307][ T6857] netlink: 16 bytes leftover after parsing attributes in process `syz.2.375'. [ 125.241929][ T5700] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 125.441054][ T6859] Bluetooth: ISO socket layer initialized [ 125.882944][ T6871] loop3: detected capacity change from 0 to 256 [ 125.996439][ T5700] usb 1-1: unable to get BOS descriptor or descriptor too short [ 125.996491][ T5700] usb 1-1: New USB device found: idVendor=0763, idProduct=2080, bcdDevice=0.40 [ 126.109071][ T5700] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 126.109098][ T5700] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 126.275905][ T6871] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3163b44b, utbl_chksum : 0xe619d30d) [ 126.282643][ T5700] usb 1-1: string descriptor 0 read error: -22 [ 126.282772][ T5700] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.798922][ T6871] exFAT-fs (loop3): valid_size(150994954) is greater than size(10) [ 126.799717][ T32] audit: type=1800 audit(1791999180.148:9): pid=6871 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.381" name="file1" dev="loop3" ino=6 res=0 errno=-22 [ 127.095719][ T6886] capability: warning: `syz.1.386' uses 32-bit capabilities (legacy support in use) [ 127.446421][ T6892] fuse: Bad value for 'fd' [ 127.471588][ T6891] syz_tun: entered allmulticast mode [ 127.495353][ T6889] syz_tun: left allmulticast mode [ 127.643444][ T6896] FAULT_INJECTION: forcing a failure. [ 127.643444][ T6896] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 127.643478][ T6896] CPU: 0 UID: 0 PID: 6896 Comm: syz.3.391 Not tainted syzkaller #0 PREEMPT(full) [ 127.643501][ T6896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 127.643513][ T6896] Call Trace: [ 127.643520][ T6896] [ 127.643528][ T6896] dump_stack_lvl+0xe8/0x150 [ 127.643561][ T6896] should_fail_ex+0x3eb/0x540 [ 127.643588][ T6896] prepare_alloc_pages+0x21e/0x5f0 [ 127.643613][ T6896] __alloc_frozen_pages_noprof+0x17c/0x410 [ 127.643636][ T6896] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 127.643659][ T6896] ? trace_kmalloc+0x2a/0xf0 [ 127.643688][ T6896] ? policy_nodemask+0x2cc/0x8e0 [ 127.643711][ T6896] ? __kmalloc_node_track_caller_noprof+0x4cd/0x720 [ 127.643747][ T6896] alloc_pages_mpol+0x21e/0x390 [ 127.643775][ T6896] alloc_pages_noprof+0xb1/0x2b0 [ 127.643802][ T6896] alloc_skb_with_frags+0x264/0x760 [ 127.643836][ T6896] sock_alloc_send_pskb+0xc69/0xd90 [ 127.643869][ T6896] ? rcu_is_watching+0x16/0xb0 [ 127.643906][ T6896] ? __lock_acquire+0x747/0x2de0 [ 127.643938][ T6896] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 127.643979][ T6896] tun_get_user+0x99b/0x4450 [ 127.644013][ T6896] ? aa_file_perm+0x18b/0x15f0 [ 127.644036][ T6896] ? aa_file_perm+0x4ed/0x15f0 [ 127.644053][ T6896] ? __pfx_tun_get_user+0x10/0x10 [ 127.644073][ T6896] ? __lock_acquire+0x747/0x2de0 [ 127.644107][ T6896] ? ref_tracker_alloc+0x172/0x530 [ 127.644134][ T6896] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 127.644160][ T6896] ? lock_acquire+0x115/0x350 [ 127.644181][ T6896] ? tun_get+0x1c/0x2f0 [ 127.644204][ T6896] ? tun_get+0x1c/0x2f0 [ 127.644223][ T6896] ? tun_get+0x1c/0x2f0 [ 127.644245][ T6896] tun_chr_write_iter+0x113/0x200 [ 127.644278][ T6896] vfs_write+0x612/0xba0 [ 127.644307][ T6896] ? __pfx_vfs_write+0x10/0x10 [ 127.644329][ T6896] ? __fget_files+0x3a2/0x420 [ 127.644347][ T6896] ? __fget_files+0x2a/0x420 [ 127.644369][ T6896] ? fdget+0x1ac/0x250 [ 127.644394][ T6896] ksys_write+0x150/0x270 [ 127.644417][ T6896] ? __pfx_ksys_write+0x10/0x10 [ 127.644447][ T6896] do_syscall_64+0x166/0x520 [ 127.644469][ T6896] ? trace_irq_disable+0x3b/0x140 [ 127.644493][ T6896] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.644514][ T6896] ? clear_bhb_loop+0x70/0xc0 [ 127.644537][ T6896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.644556][ T6896] RIP: 0033:0x7fca3235eb0e [ 127.644577][ T6896] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.644593][ T6896] RSP: 002b:00007fca33202fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.644615][ T6896] RAX: ffffffffffffffda RBX: 00007fca332036c0 RCX: 00007fca3235eb0e [ 127.644631][ T6896] RDX: 000000000000fdef RSI: 0000000000000000 RDI: 00000000000000c8 [ 127.644644][ T6896] RBP: 00007fca32435888 R08: 0000000000000000 R09: 0000000000000000 [ 127.644657][ T6896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.644668][ T6896] R13: 00007fca32626038 R14: 00007fca32625fa0 R15: 00007ffeb67e11d8 [ 127.644700][ T6896] [ 128.469185][ T5700] usb 1-1: USB disconnect, device number 4 [ 129.006822][ T6917] overlay: filesystem on ./file0 not supported as upperdir [ 130.935839][ T6958] loop4: detected capacity change from 0 to 128 [ 131.008632][ T6958] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 131.110177][ T32] audit: type=1800 audit(1791999184.458:10): pid=6958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.415" name="file1" dev="loop4" ino=94 res=0 errno=-22 [ 131.111691][ T32] audit: type=1800 audit(1791999184.458:11): pid=6958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.415" name="file1" dev="loop4" ino=94 res=0 errno=-22 [ 131.169342][ T32] audit: type=1800 audit(1791999184.518:12): pid=6958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.415" name="file1" dev="loop4" ino=94 res=0 errno=-22 [ 132.882282][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.882339][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.893052][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807a52c400: rx timeout, send abort [ 132.895626][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88807a52c400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 133.153562][ T6990] loop3: detected capacity change from 0 to 128 [ 133.313098][ T6990] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 133.342366][ T6990] ext4 filesystem being mounted at /78/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 134.941874][ T7001] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 134.941897][ T7001] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 134.983981][ T5607] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 135.207237][ T7007] loop4: detected capacity change from 0 to 256 [ 135.240531][ T7007] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 136.091223][ T7019] netlink: 32 bytes leftover after parsing attributes in process `syz.1.439'. [ 136.758004][ T7032] loop0: detected capacity change from 0 to 128 [ 137.025162][ T7032] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 137.040812][ T7032] ext4 filesystem being mounted at /84/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 137.146524][ T7032] syz.0.443 (pid 7032) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 137.738090][ T5601] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 138.129222][ T7053] netlink: 44 bytes leftover after parsing attributes in process `syz.3.454'. [ 138.164222][ T7053] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.166469][ T7053] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.204342][ T7055] netlink: 44 bytes leftover after parsing attributes in process `syz.3.454'. [ 138.304815][ T7056] block nbd0: shutting down sockets [ 138.548510][ T7059] loop3: detected capacity change from 0 to 2048 [ 138.587888][ T7059] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 138.644304][ T7063] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 138.785972][ T7065] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 139.100366][ T7068] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 139.100385][ T7068] device-mapper: raid: Choosing default region size of 4MiB [ 139.315190][ T7074] overlayfs: failed to clone upperpath [ 139.633833][ T7081] netlink: 84 bytes leftover after parsing attributes in process `syz.2.463'. [ 148.456650][ C1] sched: DL replenish lagged too much [ 151.634119][ T7068] device-mapper: table: 248:0: raid: Component device(s) too small (-EINVAL) [ 151.634160][ T7068] device-mapper: ioctl: error adding target to table [ 195.039001][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.053521][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 222.549040][ T54] Bluetooth: hci3: command 0x0406 tx timeout [ 222.549090][ T54] Bluetooth: hci0: command 0x2016 tx timeout [ 255.887232][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.901556][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 293.714270][ T33] INFO: task syz.3.467:7094 blocked for more than 146 seconds. [ 293.714299][ T33] Not tainted syzkaller #0 [ 293.714309][ T33] Blocked by coredump. [ 293.714315][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 293.714327][ T33] task:syz.3.467 state:D stack:28616 pid:7094 tgid:7092 ppid:5607 task_flags:0x40044c flags:0x00080002 [ 293.714393][ T33] Call Trace: [ 293.714401][ T33] [ 293.714413][ T33] __schedule+0x17dd/0x5820 [ 293.714467][ T33] ? __pfx___schedule+0x10/0x10 [ 293.714495][ T33] ? schedule+0x90/0x2b0 [ 293.714517][ T33] schedule+0x164/0x2b0 [ 293.714538][ T33] schedule_preempt_disabled+0x13/0x30 [ 293.714556][ T33] rwsem_down_read_slowpath+0x6d8/0x980 [ 293.714575][ T33] ? rwsem_down_read_slowpath+0x58a/0x980 [ 293.714603][ T33] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 293.714646][ T33] down_read+0x97/0x320 [ 293.714668][ T33] ? sched_cache_exit_mm+0xef/0x190 [ 293.714701][ T33] exit_mm+0x77/0x240 [ 293.714738][ T33] do_exit+0x6a8/0x2360 [ 293.714771][ T33] ? __pfx_do_exit+0x10/0x10 [ 293.714800][ T33] ? do_raw_spin_lock+0x12b/0x2f0 [ 293.714839][ T33] do_group_exit+0x22d/0x2f0 [ 293.714855][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 293.714886][ T33] get_signal+0x1216/0x12c0 [ 293.714930][ T33] arch_do_signal_or_restart+0xbb/0x860 [ 293.714961][ T33] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 293.715006][ T33] exit_to_user_mode_loop+0x10e/0x770 [ 293.715027][ T33] ? rcu_is_watching+0x16/0xb0 [ 293.715056][ T33] do_syscall_64+0x328/0x520 [ 293.715075][ T33] ? trace_irq_disable+0x3b/0x140 [ 293.715096][ T33] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.715115][ T33] ? clear_bhb_loop+0x70/0xc0 [ 293.715139][ T33] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.715157][ T33] RIP: 0033:0x7fca3239e2d9 [ 293.715174][ T33] RSP: 002b:00007fca331e20e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 293.715193][ T33] RAX: fffffffffffffe00 RBX: 00007fca32626098 RCX: 00007fca3239e2d9 [ 293.715207][ T33] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fca32626098 [ 293.715218][ T33] RBP: 00007fca32626090 R08: 0000000000000000 R09: 0000000000000000 [ 293.715230][ T33] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 293.715241][ T33] R13: 00007fca32626128 R14: 00007ffeb67e10f0 R15: 00007ffeb67e11d8 [ 293.715273][ T33] [ 293.715280][ T33] INFO: task syz.3.467:7095 blocked for more than 146 seconds. [ 293.715293][ T33] Not tainted syzkaller #0 [ 293.715302][ T33] Blocked by coredump. [ 293.715308][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 293.715316][ T33] task:syz.3.467 state:D stack:28808 pid:7095 tgid:7092 ppid:5607 task_flags:0x40044c flags:0x00080002 [ 293.715374][ T33] Call Trace: [ 293.715381][ T33] [ 293.715392][ T33] __schedule+0x17dd/0x5820 [ 293.715438][ T33] ? __pfx___schedule+0x10/0x10 [ 293.715465][ T33] ? schedule+0x90/0x2b0 [ 293.715486][ T33] schedule+0x164/0x2b0 [ 293.715507][ T33] schedule_preempt_disabled+0x13/0x30 [ 293.715525][ T33] rwsem_down_read_slowpath+0x6d8/0x980 [ 293.715547][ T33] ? rwsem_down_read_slowpath+0x58a/0x980 [ 293.715576][ T33] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 293.715620][ T33] down_read+0x97/0x320 [ 293.715641][ T33] ? sched_cache_exit_mm+0xef/0x190 [ 293.715673][ T33] exit_mm+0x77/0x240 [ 293.715702][ T33] do_exit+0x6a8/0x2360 [ 293.715737][ T33] ? rwsem_down_write_slowpath+0x466/0x10d0 [ 293.715765][ T33] ? __pfx_do_exit+0x10/0x10 [ 293.715793][ T33] ? do_raw_spin_lock+0x12b/0x2f0 [ 293.715829][ T33] do_group_exit+0x22d/0x2f0 [ 293.715845][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 293.715875][ T33] get_signal+0x1216/0x12c0 [ 293.715918][ T33] arch_do_signal_or_restart+0xbb/0x860 [ 293.715949][ T33] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 293.715974][ T33] ? vm_mmap_pgoff+0x23d/0x4e0 [ 293.716018][ T33] exit_to_user_mode_loop+0x10e/0x770 [ 293.716040][ T33] ? rcu_is_watching+0x16/0xb0 [ 293.716068][ T33] do_syscall_64+0x328/0x520 [ 293.716086][ T33] ? trace_irq_disable+0x3b/0x140 [ 293.716107][ T33] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.716124][ T33] ? clear_bhb_loop+0x70/0xc0 [ 293.716148][ T33] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.716165][ T33] RIP: 0033:0x7fca3239e042 [ 293.716181][ T33] RSP: 002b:00007fca331c0d48 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 293.716199][ T33] RAX: fffffffffffffffc RBX: 0000000000000000 RCX: 00007fca3239e042 [ 293.716212][ T33] RDX: 0000000000000003 RSI: 0000000008400000 RDI: 0000000000000000 [ 293.716223][ T33] RBP: 0000000000000022 R08: 00000000ffffffff R09: 0000000000000000 [ 293.716235][ T33] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000004 [ 293.716246][ T33] R13: 00007fca331c0ddc R14: 00007fca331c0de0 R15: 00007ffeb67e11d8 [ 293.716277][ T33] [ 293.716294][ T33] [ 293.716294][ T33] Showing all locks held in the system: [ 293.716302][ T33] locks held by kthreadd/2: 2, last CPU#1: [ 293.716314][ T33] #0: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.716360][ T33] #1: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 293.716409][ T33] locks held by kworker/0:0/9: 5, last CPU#0: [ 293.716420][ T33] #0: ffff888056301548 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.716474][ T33] #1: ffffc900000e7c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.716534][ T33] #2: ffff8880799ec888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.716587][ T33] #3: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.724430][ T33] #4: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x22/0x2e0 [ 293.724478][ T33] locks held by kworker/0:1/10: 3, last CPU#0: [ 293.724491][ T33] #0: ffff88807e315548 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.724544][ T33] #1: ffffc900000f7c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.724604][ T33] #2: ffff88802a891440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x214/0xbf0 [ 293.724658][ T33] locks held by kworker/u8:0/12: 3, last CPU#0: [ 293.724671][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.724725][ T33] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.724774][ T33] #2: ffff888054020800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 293.724822][ T33] locks held by kworker/u8:1/13: 3, last CPU#0: [ 293.724834][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.724882][ T33] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.724930][ T33] #2: ffff8880549c0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 293.724978][ T33] locks held by kworker/1:0/27: 3, last CPU#1: [ 293.724991][ T33] #0: ffff88807f312548 ((wq_completion)wg-kex-wg1#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725043][ T33] #1: ffffc90000a1fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725103][ T33] #2: ffff88807af0d270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.725155][ T33] locks held by khungtaskd/33: 1, last CPU#0: [ 293.725167][ T33] #0: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 293.725210][ T33] locks held by kworker/u8:2/44: 3, last CPU#0: [ 293.725223][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725271][ T33] #1: ffffc90000b47c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725319][ T33] #2: ffff888054af0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 293.725364][ T33] locks held by kworker/1:1/46: 4, on CPU#1: [ 293.725377][ T33] #0: ffff88807e319148 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725429][ T33] #1: ffffc90000b67c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725489][ T33] #2: ffff88807ff55440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 293.725540][ T33] #3: ffff88807af0c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 293.725591][ T33] locks held by kworker/u8:3/51: 4, last CPU#0: [ 293.725604][ T33] #0: ffff88807cbeb148 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725651][ T33] #1: ffffc90000bb7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725700][ T33] #2: ffff888035795440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 293.725755][ T33] #3: ffff8880799ee640 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 293.725806][ T33] locks held by kworker/u9:0/54: 5, on CPU#0: [ 293.725819][ T33] #0: ffff8880795fc148 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725867][ T33] #1: ffffc90000be7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.725916][ T33] #2: ffff88807a3f8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 [ 293.725963][ T33] #3: ffff88807a3f80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 293.726015][ T33] #4: ffffffff913d8e40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 293.726067][ T33] locks held by kworker/u8:4/63: 4, on CPU#1: [ 293.726080][ T33] #0: ffff88807cbea148 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.726128][ T33] #1: ffffc9000205fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.726177][ T33] #2: ffff888034875440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 293.726228][ T33] #3: ffff8880799ed270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 293.726279][ T33] locks held by kworker/u8:5/91: 3, last CPU#0: [ 293.726292][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.726340][ T33] #1: ffffc9000250fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.726389][ T33] #2: ffff888054700800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 293.726438][ T33] locks held by kworker/u8:6/178: 3, last CPU#0: [ 293.726451][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.726500][ T33] #1: ffffc90002e0fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.726549][ T33] #2: ffff888054650800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 293.741822][ T33] locks held by kworker/0:2/837: 2, last CPU#0: [ 293.741840][ T33] #0: ffff888055ee6548 ((wq_completion)wg-crypt-wg1#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.741899][ T33] #1: ffffc9000462fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.741953][ T33] locks held by kworker/u8:7/1113: 4, last CPU#1: [ 293.741966][ T33] #0: ffff888035d16948 ((wq_completion)wg-kex-wg0#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742019][ T33] #1: ffffc90004fa7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742068][ T33] #2: ffff888032c5d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 293.742121][ T33] #3: ffff88802cec5c58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 293.742172][ T33] locks held by kworker/1:2/1223: 1, last CPU#1: [ 293.742186][ T33] #0: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.742241][ T33] locks held by kworker/R-bat_e/3222: 2, last CPU#0: [ 293.742254][ T33] #0: ffff888032b50948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742303][ T33] #1: ffffc9000de17c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742354][ T33] locks held by kworker/u9:1/4921: 7, on CPU#1: [ 293.742367][ T33] #0: ffff888029aec948 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742415][ T33] #1: ffffc900103d7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742463][ T33] #2: ffff88807d854ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 [ 293.742511][ T33] #3: ffff88807d8540b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 293.742563][ T33] #4: ffffffff913d8e40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 293.742612][ T33] #5: ffff8880263482f8 (_T->lock#5){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x630 [ 293.742660][ T33] #6: ffffffff8fd605e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x388/0x760 [ 293.742718][ T33] locks held by udevd/4971: 2, last CPU#0: [ 293.742731][ T33] #0: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.742774][ T33] #1: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x37/0x410 [ 293.742821][ T33] locks held by kworker/1:3/5066: 5, last CPU#1: [ 293.742835][ T33] #0: ffff8880562e7948 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742887][ T33] #1: ffffc900103a7c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.742949][ T33] #2: ffff88807af0f028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.743000][ T33] #3: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 293.743044][ T33] #4: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 293.743092][ T33] locks held by dhcpcd/5266: 3, last CPU#0: [ 293.743105][ T33] #0: ffffffff904fca98 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x5f0 [ 293.743154][ T33] #1: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.743196][ T33] #2: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 293.743243][ T33] locks held by dhcpcd/5267: 4, last CPU#0: [ 293.743256][ T33] #0: ffffffff8fe39050 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 [ 293.743301][ T33] #1: ffff88801c09b440 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 293.743350][ T33] #2: ffff88802a15b440 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 293.743403][ T33] #3: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.743446][ T33] locks held by getty/5359: 2, on CPU#0: [ 293.743459][ T33] #0: ffff8880365640a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 293.743503][ T33] #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 293.743555][ T33] locks held by syz-executor/5589: 2, last CPU#1: [ 293.743568][ T33] #0: ffff888035e9a800 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 [ 293.743619][ T33] #1: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.743662][ T33] locks held by syz-executor/5600: 5, last CPU#1: [ 293.743675][ T33] #0: ffff8880777da460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 293.743732][ T33] #1: ffff88801eb38eb8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 [ 293.743789][ T33] #2: ffffffff904fca98 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 293.743838][ T33] #3: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.743879][ T33] #4: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 293.743925][ T33] locks held by kworker/u9:2/5603: 3, on CPU#1: [ 293.743938][ T33] #0: ffff8880795fc948 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.743991][ T33] #1: ffffc900043afc40 ((work_completion)(&hdev->cmd_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744040][ T33] #2: ffff88807a3f80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_cmd_work+0xa0/0x850 [ 293.744084][ T33] locks held by syz-executor/5605: 4, last CPU#0: [ 293.744098][ T33] #0: ffff88807a392460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 293.744146][ T33] #1: ffff888026b22d30 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 [ 293.744203][ T33] #2: ffffffff904fca98 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 293.744250][ T33] #3: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.744293][ T33] locks held by kworker/u9:3/5606: 5, on CPU#1: [ 293.744305][ T33] #0: ffff888026348948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744353][ T33] #1: ffffc900043cfc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744401][ T33] #2: ffff88807aed0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 [ 293.744446][ T33] #3: ffff88807aed00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 293.744497][ T33] #4: ffffffff913d8e40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 293.744547][ T33] locks held by kworker/u9:4/5610: 3, on CPU#0: [ 293.744559][ T33] #0: ffff888029aed148 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744611][ T33] #1: ffffc900043efc40 ((work_completion)(&hdev->cmd_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744659][ T33] #2: ffff88807d8540b8 (&hdev->lock){+.+.}-{4:4}, at: hci_cmd_work+0xa0/0x850 [ 293.744703][ T33] locks held by syz-executor/5613: 2, last CPU#0: [ 293.744722][ T33] #0: ffff888032d902e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 293.744772][ T33] #1: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.744817][ T33] locks held by kworker/1:4/5700: 3, last CPU#1: [ 293.744831][ T33] #0: ffff888079c01d48 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744883][ T33] #1: ffffc9000467fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.744946][ T33] #2: ffff8880799eaad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.744997][ T33] locks held by kworker/1:5/5701: 2, last CPU#1: [ 293.745010][ T33] #0: ffff88805611d148 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745064][ T33] #1: ffffc9000468fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745127][ T33] locks held by kworker/0:5/5709: 5, last CPU#0: [ 293.745141][ T33] #0: ffff88801d327d48 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745189][ T33] #1: ffffc9000470fc40 ((work_completion)(&(&mc->mca_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745238][ T33] #2: ffff88803613e530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_mca_work+0x52/0x440 [ 293.745284][ T33] #3: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: igmp6_send+0x1b1/0x1140 [ 293.745330][ T33] #4: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x21b/0x4f0 [ 293.745377][ T33] locks held by kworker/0:6/5716: 3, last CPU#0: [ 293.745389][ T33] #0: ffff888055ee4d48 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745442][ T33] #1: ffffc9000477fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745505][ T33] #2: ffff88802cec34b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.745557][ T33] locks held by kworker/1:6/5729: 3, last CPU#1: [ 293.745571][ T33] #0: ffff888055d5e148 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745623][ T33] #1: ffffc9000485fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745685][ T33] #2: ffff8880799e9700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.745742][ T33] locks held by kworker/1:7/5730: 5, last CPU#1: [ 293.745755][ T33] #0: ffff888056301548 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745808][ T33] #1: ffffc9000486fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.745871][ T33] #2: ffff8880799ed270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.745922][ T33] #3: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 293.745964][ T33] #4: ffffffff8fd59f60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 293.746011][ T33] locks held by kworker/u8:8/5805: 3, last CPU#0: [ 293.746024][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.746073][ T33] #1: ffffc900049efc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.746122][ T33] #2: ffff8880544c0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 293.746169][ T33] locks held by kworker/u8:9/6362: 4, on CPU#0: [ 293.746182][ T33] #0: ffff88807cbef148 ((wq_completion)wg-kex-wg2#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.746233][ T33] #1: ffffc9000d5b7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.746282][ T33] #2: ffff88807ff55440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 293.746334][ T33] #3: ffff88807af0c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 293.746381][ T33] locks held by kworker/0:7/6755: 3, last CPU#0: [ 293.746394][ T33] #0: ffff88807e319148 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.746447][ T33] #1: ffffc900034afc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 293.746509][ T33] #2: ffff88807af0c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 293.746560][ T33] locks held by syz.3.467/7092: 1, on CPU#1: [ 293.746573][ T33] #0: ffff88807e3d0f80 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock_killable+0x1d/0x70 [ 301.388353][ T33] locks held by syz.3.467/7093: 4, last CPU#1: [ 301.388370][ T33] #0: ffffffff8fe39050 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 [ 301.388426][ T33] #1: ffff88807e3d0f80 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 301.388475][ T33] #2: ffff88807e3d5900 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 301.388527][ T33] #3: ffffffff8feb0470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 301.388570][ T33] locks held by syz.3.467/7094: 1, on CPU#0: [ 301.388584][ T33] #0: ffff88807e3d0f80 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x77/0x240 [ 301.388635][ T33] locks held by syz.3.467/7095: 1, on CPU#0: [ 301.388648][ T33] #0: ffff88807e3d0f80 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x77/0x240 [ 301.388699][ T33] locks held by kworker/u8:10/7097: 4, last CPU#1: [ 301.388712][ T33] #0: ffff888035fbd948 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 301.388765][ T33] #1: ffffc9001ac87c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 301.388815][ T33] #2: ffff88807dbad440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 301.388867][ T33] #3: ffff88802cec4888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 301.388922][ T33] [ 301.388927][ T33] ============================================= [ 301.388927][ T33] [ 301.388953][ T33] NMI backtrace for cpu 1 [ 301.388966][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 301.388986][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 301.388997][ T33] Call Trace: [ 301.389004][ T33] [ 301.389013][ T33] dump_stack_lvl+0xe8/0x150 [ 301.389041][ T33] nmi_cpu_backtrace+0x274/0x2d0 [ 301.389068][ T33] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 301.389090][ T33] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 301.389119][ T33] sys_info+0x135/0x170 [ 301.389141][ T33] watchdog+0x1073/0x10f0 [ 301.389170][ T33] ? watchdog+0x209/0x10f0 [ 301.389197][ T33] kthread+0x38b/0x480 [ 301.389216][ T33] ? __pfx_watchdog+0x10/0x10 [ 301.389234][ T33] ? __pfx_kthread+0x10/0x10 [ 301.389254][ T33] ret_from_fork+0x514/0xb70 [ 301.389275][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 301.389293][ T33] ? __switch_to+0xc78/0x1410 [ 301.389320][ T33] ? __pfx_kthread+0x10/0x10 [ 301.389339][ T33] ret_from_fork_asm+0x1a/0x30 [ 301.389372][ T33] [ 301.389379][ T33] Sending NMI from CPU 1 to CPUs 0: [ 301.389422][ C0] NMI backtrace for cpu 0 [ 301.389434][ C0] CPU: 0 UID: 0 PID: 3222 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) [ 301.389453][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 301.389464][ C0] Workqueue: bat_events batadv_tt_purge [ 301.389490][ C0] RIP: 0010:trace_consume_skb+0xd/0x1f0 [ 301.389512][ C0] Code: 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 48 89 f3 <49> 89 fe e8 9b 07 11 f8 0f 1f 44 00 00 e8 91 07 11 f8 65 8b 1d d2 [ 301.389527][ C0] RSP: 0018:ffffc90000007408 EFLAGS: 00000246 [ 301.389541][ C0] RAX: ffffffff89b7576c RBX: ffffffff8a27529a RCX: ffff88802c5b0000 [ 301.389555][ C0] RDX: 8000000000000100 RSI: ffffffff8a27529a RDI: ffff88818f4218c0 [ 301.389568][ C0] RBP: 0000000000000001 R08: 0000000000000100 R09: 1ffff11031e84334 [ 301.389580][ C0] R10: dffffc0000000000 R11: ffffed1031e84335 R12: ffff88818f4218c0 [ 301.389593][ C0] R13: ffffc900000075a2 R14: ffff88818f4219a4 R15: ffffc90000007720 [ 301.389606][ C0] FS: 0000000000000000(0000) GS:ffff888123a92000(0000) knlGS:0000000000000000 [ 301.389620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.389633][ C0] CR2: 00007ffec6345c50 CR3: 000000000fb48000 CR4: 00000000003526f0 [ 301.389648][ C0] Call Trace: [ 301.389654][ C0] [ 301.389663][ C0] consume_skb+0x59/0xb0 [ 301.389681][ C0] nft_synproxy_eval_v4+0x36a/0x4e0 [ 301.389708][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 301.389732][ C0] ? nf_ip_checksum+0x13c/0x510 [ 301.389755][ C0] nft_synproxy_do_eval+0x389/0x5d0 [ 301.389781][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 301.389812][ C0] nft_do_chain+0x48d/0x1b10 [ 301.389836][ C0] ? __lock_acquire+0x747/0x2de0 [ 301.389858][ C0] ? lock_acquire+0x115/0x350 [ 301.389876][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 301.389907][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 301.389928][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 301.389960][ C0] nft_do_chain_ipv4+0x195/0x290 [ 301.389982][ C0] ? ipt_do_table+0x2b9/0x15d0 [ 301.390003][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 301.390026][ C0] ? iptable_mangle_hook+0x18a/0x4c0 [ 301.390051][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 301.390074][ C0] nf_hook_slow+0xc5/0x220 [ 301.390094][ C0] NF_HOOK+0x21f/0x3c0 [ 301.390117][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 301.390139][ C0] ? NF_HOOK+0x9e/0x3c0 [ 301.390160][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 301.390183][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 301.390209][ C0] ? ip_local_deliver+0x113/0x190 [ 301.390232][ C0] NF_HOOK+0x336/0x3c0 [ 301.390254][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 301.390276][ C0] ? NF_HOOK+0x9e/0x3c0 [ 301.390296][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 301.390319][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 301.390340][ C0] ? ip_rcv_core+0x88d/0xd50 [ 301.390364][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 301.390385][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 301.390407][ C0] process_backlog+0xa6b/0x18b0 [ 301.390427][ C0] ? process_backlog+0x3de/0x18b0 [ 301.390450][ C0] __napi_poll+0xaa/0x330 [ 301.390476][ C0] net_rx_action+0x61d/0xf50 [ 301.390499][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 301.390530][ C0] handle_softirqs+0x223/0x840 [ 301.390549][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 301.390570][ C0] ? do_softirq+0x77/0xd0 [ 301.390590][ C0] ? process_scheduled_works+0x97a/0x1630 [ 301.390611][ C0] ? batadv_tt_local_purge+0x277/0x300 [ 301.390634][ C0] do_softirq+0x77/0xd0 [ 301.390652][ C0] [ 301.390658][ C0] [ 301.390664][ C0] __local_bh_enable_ip+0x100/0x140 [ 301.390684][ C0] batadv_tt_local_purge+0x277/0x300 [ 301.390712][ C0] ? process_scheduled_works+0x97a/0x1630 [ 301.390733][ C0] batadv_tt_purge+0x35/0xa40 [ 301.390758][ C0] ? rcu_is_watching+0x16/0xb0 [ 301.390781][ C0] ? process_scheduled_works+0x97a/0x1630 [ 301.390802][ C0] process_scheduled_works+0xc3d/0x1630 [ 301.390841][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 301.390866][ C0] ? assign_work+0x3af/0x5d0 [ 301.390889][ C0] rescuer_thread+0x84a/0x12a0 [ 301.390921][ C0] ? rescuer_thread+0xb8/0x12a0 [ 301.390954][ C0] kthread+0x38b/0x480 [ 301.390970][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 301.390993][ C0] ? __pfx_kthread+0x10/0x10 [ 301.391009][ C0] ret_from_fork+0x514/0xb70 [ 301.391027][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 301.391044][ C0] ? __switch_to+0xc78/0x1410 [ 301.391068][ C0] ? __pfx_kthread+0x10/0x10 [ 301.391085][ C0] ret_from_fork_asm+0x1a/0x30 [ 301.391108][ C0] [ 301.391423][ T33] Kernel panic - not syncing: hung_task: blocked tasks [ 303.845011][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 303.854124][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 303.864181][ T33] Call Trace: [ 303.867466][ T33] [ 303.870399][ T33] vpanic+0x26f/0x710 [ 303.874400][ T33] panic+0xc5/0xd0 [ 303.878134][ T33] ? __pfx_panic+0x10/0x10 [ 303.882563][ T33] ? wq_watchdog_touch+0xf9/0x160 [ 303.887602][ T33] ? nmi_trigger_cpumask_backtrace+0x24d/0x390 [ 303.893773][ T33] watchdog+0x10e7/0x10f0 [ 303.898125][ T33] ? watchdog+0x209/0x10f0 [ 303.902557][ T33] kthread+0x38b/0x480 [ 303.906627][ T33] ? __pfx_watchdog+0x10/0x10 [ 303.911308][ T33] ? __pfx_kthread+0x10/0x10 [ 303.915915][ T33] ret_from_fork+0x514/0xb70 [ 303.920516][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 303.925630][ T33] ? __switch_to+0xc78/0x1410 [ 303.930319][ T33] ? __pfx_kthread+0x10/0x10 [ 303.934930][ T33] ret_from_fork_asm+0x1a/0x30 [ 303.939709][ T33] [ 303.943004][ T33] Kernel Offset: disabled [ 303.947406][ T33] Rebooting in 86400 seconds..