last executing test programs: 8.507895845s ago: executing program 2 (id=634): openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="3000000002"], 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000cc0)={0x24, 0x26, 0x109, 0x870bd22, 0xfffffffa, {0x2}, [@nested={0x8, 0x3f, 0x0, 0x1, [@nested={0x4, 0x122}]}, @typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x1000c957}, 0x600c800) r2 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x1, 0x0, 0x2c00}, 0x30, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000000)={0x2102, r2}, 0x1) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) ppoll(&(0x7f0000000400)=[{0xffffffffffffffff, 0x411}, {0xffffffffffffffff, 0x400}], 0x2, 0x0, 0x0, 0x0) 7.660218647s ago: executing program 1 (id=639): sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, 0x0, 0x8000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0x801}, 0x20}}, 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000008050000010b007e"], 0x88) 7.275833567s ago: executing program 2 (id=642): socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x0, 0x13) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$kcm(0x10, 0x3, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000000), &(0x7f0000000200), &(0x7f0000000000)=[0x2], 0x0, 0x1}) 7.15729661s ago: executing program 2 (id=643): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = dup2(r3, r3) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f0000000300)=""/107, 0x0, 0x6000}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r4, &(0x7f0000000a40)={0x2020}, 0x50a) write$vhost_msg_v2(r4, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0xfccf, 0x0, 0x1, 0x2}}, 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) add_key$user(0x0, &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) setrlimit(0x6, &(0x7f0000000280)={0xe425, 0x1}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x7fffffff, &(0x7f0000000380)={[0x6]}, 0x8) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="020d000014000000000000000000000005000600000000000a00000000000000fc010000000000000000000000000000000000000000000005000500000000000a000000000000000000000000000000000000000000000000000000000000000800120002000200000000000000000006003200000000000000000000000000fe880000000000000000000000000001fc0100000000000000000000000000002f214d4116fefa98faa3162ed795da5f2599"], 0xa0}}, 0x0) 5.471824202s ago: executing program 2 (id=645): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dbg\x00', &(0x7f0000000140)='debugfs\x00', 0x408, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0) pwritev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)='G', 0x1}], 0x1, 0x82e, 0x8001) ioctl$PPPIOCGIDLE(r0, 0x8010743f, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x40081, 0x0) ioctl$TIOCSETD(r2, 0x5423, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) 4.885707817s ago: executing program 0 (id=648): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188040f80ec59acbc0479e865c63100000001010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x40) 4.75961475s ago: executing program 0 (id=649): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r1 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)=0x0) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) r10 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r10, 0xc1105517, &(0x7f0000000080)={{0x0, 0x0, 0xe044, 0x0, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x7) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r11, 0x4018620d, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x1000000, 0x0}) syz_ublk_setup_queues(r9, r8, &(0x7f0000000540)={0x0, 0x3e0e, 0x0, 0x3, 0x28e, 0x0, r2}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x701, 0x1000, 0x2, 0x1af, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6, 0x2, 0x0, 0x32d, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766f, 0x20, 0x1, 0x2db, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x2, 0x400, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r9, 0xc0107526, 0x0, 0x20000700, 0x0, 0x1, {0x10}, 0x0, r7, '\x00', {0x3, 0xb45, 0x100104, 0x0}}, &(0x7f0000000180)) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c00000004000000040000000180000000000000", @ANYRES32=r12, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000c69e2e09c74183b13858a2cffe2403200b"], 0x50) 4.667114523s ago: executing program 0 (id=650): openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="3000000002"], 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000cc0)={0x24, 0x26, 0x109, 0x870bd22, 0xfffffffa, {0x2}, [@nested={0x8, 0x3f, 0x0, 0x1, [@nested={0x4, 0x122}]}, @typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x1000c957}, 0x600c800) r2 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x1, 0x0, 0x2c00}, 0x30, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000000)={0x2102, r2}, 0x1) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) ppoll(&(0x7f0000000400)=[{0xffffffffffffffff, 0x411}, {0xffffffffffffffff, 0x400}], 0x2, 0x0, 0x0, 0x0) 4.017813229s ago: executing program 1 (id=651): socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x0, 0x13) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$kcm(0x10, 0x3, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000000), &(0x7f0000000200), &(0x7f0000000000)=[0x2], 0x0, 0x1}) 3.943606771s ago: executing program 2 (id=653): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = dup2(r3, r3) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f0000000300)=""/107, 0x0, 0x6000}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r4, &(0x7f0000000a40)={0x2020}, 0x50a) write$vhost_msg_v2(r4, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0xfccf, 0x0, 0x1, 0x2}}, 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) add_key$user(0x0, &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) setrlimit(0x6, &(0x7f0000000280)={0xe425, 0x1}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x7fffffff, &(0x7f0000000380)={[0x6]}, 0x8) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="020d000014000000000000000000000005000600000000000a00000000000000fc010000000000000000000000000000000000000000000005000500000000000a000000000000000000000000000000000000000000000000000000000000000800120002000200000000000000000006003200000000000000000000000000fe880000000000000000000000000001fc0100000000000000000000000000002f214d4116fefa98faa3162ed795da5f2599"], 0xa0}}, 0x0) 3.832074983s ago: executing program 1 (id=654): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000240)) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, 0x0) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f00000009c0)={0x1}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) connect$pppoe(r0, 0x0, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r4, 0x29, 0x37, 0x0, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x1cee7696426a4fe8, &(0x7f0000ffe000/0x2000)=nil) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="090020001600"/18, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32], 0x50) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a5c000000060a010400000000000000000a0000040900010073797a31000000000900020073797a3200000000300004802c0001800a0001006d6174636800c9211c00028008000240000000020800"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) fchmod(0xffffffffffffffff, 0x101) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6cd}}, './file0\x00'}) 3.55721953s ago: executing program 0 (id=655): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0x4c, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x1, 0x0, &(0x7f0000000500)="0e"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) 3.430083484s ago: executing program 1 (id=656): write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x4, 0x0, {0x1, 0xfffffffffffffffc}}, 0x28) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="ebfa0e80ceb3dc4c43c215dc4dade38ff8c84ace0200bebe5b179f12cf39c48c2d4b61ce76443644c1dc73113bee39b5796e", 0x32}], 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r0, 0xc138fd05, &(0x7f0000000000)="0400000002000000000000007e0100003801") 3.407569134s ago: executing program 0 (id=657): socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x13) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$kcm(0x10, 0x3, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000000), &(0x7f0000000200), &(0x7f0000000000)=[0x2], 0x0, 0x1}) 3.296047647s ago: executing program 1 (id=658): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r1 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)=0x0) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) r10 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r10, 0xc1105517, &(0x7f0000000080)={{0x0, 0x0, 0xe044, 0x0, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x7) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r11, 0x4018620d, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x1000000, 0x0}) syz_ublk_setup_queues(r9, r8, &(0x7f0000000540)={0x0, 0x3e0e, 0x0, 0x3, 0x28e, 0x0, r2}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x701, 0x1000, 0x2, 0x1af, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6, 0x2, 0x0, 0x32d, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766f, 0x20, 0x1, 0x2db, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x2, 0x400, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r9, 0xc0107526, 0x0, 0x20000700, 0x0, 0x1, {0x10}, 0x0, r7, '\x00', {0x3, 0xb45, 0x100104, 0x0}}, &(0x7f0000000180)) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c00000004000000040000000180000000000000", @ANYRES32=r12, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000c69e2e09c74183b13858a2cffe2403200b"], 0x50) 3.265845088s ago: executing program 1 (id=659): sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x8000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0x801}, 0x20}}, 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000008050000010b007e"], 0x88) 3.224305009s ago: executing program 0 (id=660): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, 0x0, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fc, 0xffff8080, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x5, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x6, 0x1001, 0xf8, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x1, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x100004, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x6, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0xb, 0x196, 0x7ff, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0xb, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0xc, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x43d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x7, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xffdffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001300)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r8, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xc, 0xf, 0x0, 0x8}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 3.029858234s ago: executing program 3 (id=661): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x0, @val=@tracing={0xffffffffffffffff, 0x8}}, 0x1c) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000100)={r1}, 0x10) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) r4 = memfd_create(&(0x7f0000000000)='e\xf4E\x88-\x00', 0x0) pwritev(r4, &(0x7f0000000040)=[{&(0x7f0000000480)="db", 0x1}], 0x1, 0x4000001, 0x0) sendfile(r3, r4, 0x0, 0x8000fb00) 1.944564161s ago: executing program 3 (id=662): socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x0, 0x13) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$kcm(0x10, 0x3, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000000), &(0x7f0000000200), &(0x7f0000000000)=[0x2], 0x0, 0x1}) 1.708139907s ago: executing program 3 (id=663): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x2, 0x400000) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0}, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='devtmpfs\x00', 0x4000, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0x1, 0x80802, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="27738d50c7f5"}, 0x14) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2acd005, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') 1.641250969s ago: executing program 2 (id=664): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000280)={{0x2, 0x4e24, @remote}, {0x306, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0xe, {0x2, 0x4e22, @multicast1}, 'vlan0\x00'}) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff) creat(&(0x7f00000000c0)='./file0\x00', 0x48) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000880)={0x2, 0x3, 0x4, 0x3, 0x14, 0x0, 0x70bd2c, 0x25dfdbfc, [@sadb_key={0x1, 0x9}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e23, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0xdb, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0xffffffc2, @private0, 0x7}}, @sadb_address={0x5, 0x17, 0x2b, 0x80, 0x0, @in6={0xa, 0x4e24, 0x0, @private2, 0x1000}}, @sadb_x_sa2={0x2, 0x13, 0x8, 0x0, 0x0, 0x70bd2d, 0x3507}]}, 0xa0}, 0x1, 0x7}, 0x0) lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000240)=@v3={0x3000300, [{0xffff4a0c, 0x7}], 0xee01}, 0x18, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r3, &(0x7f00000001c0)='functionfs\x00', 0xb) read(r2, &(0x7f0000000100), 0xb) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x28182, 0x0) mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0xc, 0x0, &(0x7f00000004c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400000000000000", @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000000000005000000000000000108000f"], 0x74}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b708000000bc7a007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0xffffb8f3, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x4, 0x101, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0x102, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e4, 0x2, 0x200004, 0x1b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x3, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x42080, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000ad, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8864, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x33f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x9, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x47, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c) r5 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x4) ioctl$FS_IOC_RESVSP(r5, 0x402c5828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x20000000000006}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.59713249s ago: executing program 3 (id=665): syz_mount_image$btrfs(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x16, &(0x7f00000002c0)={[{@nobarrier}, {@noflushoncommit}, {@nossd}, {@commit={'commit', 0x3d, 0x3f}}, {@nodatasum}, {@nodiscard}, {@nobarrier}, {@compress_algo={'compress', 0x3d, 'zstd'}}, {@noacl}]}, 0x9, 0x512d, &(0x7f000000a5c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Ya957z3Ln3OXPPvTOOjujnIzPnPOd3nuc893IW93udc04AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEMJLf35xpKx+5sb0uQsz9d2Hts1cPTC94WwIlfb2Sl7ftf35197esevlidhh9tVsWav1GzLrejFrrOnZ2OrX+/NmCGEsGaCaL59bVxi1e3VfccBSNy/vPb5lf33zyaPN6vUr508XXzotE6s9gdWSn1eXFs6levv3SLJHp9116lV6TtGsf3rC3ZEXAQAsyVSjveh8HM0/4nbaB9N60q4n7WbSjp8Qmt2N5cjGXdNvnpvS+irNs55FhfG+80zq+fvfaTfS/kk7iRpLmGfvrnmkmeg3z7mkvlrzBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALibPPbu6CNl9TM3ps9dmKnvPrRt5uqB6Q1nQ6i1t1eycmXth0fr/3y//cShn7d+c/LSi09U835xOdq1c/gjrjw1GcJbXZVLcdjL60No9BbazfB1sfBOe+WFWAAAAOBe8mD790inncXBsZ52pZ0mK+1/URYWb17ee3zL/vrmk0eb1etXzp9e/niNPuPVFx2v064t/FS6gnGMv+l4C/W4677COOXSEdM8/+TFqX/L+hfyf608/8d3Tv4HAADgVsj/6TjlBuX/H97467Oy/oX8v6nnkIX8H2cc8/9IWF7+BwAAgLvZ7c7/9cI45Qbl//FXxr4t61/I/1PD5f/R7mnHjb/HCe+ZXDNo4gAAAEBf8f/dF75aiHk9++YgzevPPH74Qtl4hfxfHy7/j63oqwIAAABuxbGvdj5aVi/k/8Zw+X/8ts4aAAAAWIr3Pp74qKxeyP+zi+f/apL/1+bL/MqHrNMv8a8QjkyGMNFamcsKv4bms50CAAAAsEJiTv/7890/le1XyP9z5ff/j3c6iNf/99z/r+v6/xCmegvZXf+ezgsAAABwXylezx9vj589uaDf8/eHvf7/of8dfr3s+IX8f3C4/F/tXq7k8/8AAABgGVbm+X+j4U49/29nYZxyg+7//8An7/9W1r+Q/5vD5f+4XNf98k7F9+eDyRA2tlbyuwl+Fw+3JynMj3UV2hpJjx2xR16YH+8qtM0lPbZOhvBwa+VgUvh/LDSTwrX1eeFYUjgbC/n50CmcSAqn4pn25fp8umnhx1jIL7CYj1dQrOtcEpH0uN6vR6uwaI/znYMDAADcV2J4zrPsWG8zpFF2vjJoh7WDdhgZtEN10A6jyQ7pjv22h9neQtzePLd5ac//PzZc/o9vRf6cv37X/4d4/X/+XMPO9f+zsVBLCvOx0EjvGNCIx8jC7qfxGLVG3uPaxk4BAAAA7mnxe4HqKs8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4j717j5Hrqg8HfvY53od3N4GfCPkhWKCOccHrtR0ealOxTlMVhVLWJSWqEMXGXofFG2xsp+AIkGODUhRB0xIVpBbFEUI1fyS1SBDQgOJGwihqeChVESRKRFoTBApNAygtRCLVzL3n7p1zdx6OvY43/Xwk75yZ73neeXjOvXfOBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP8bTnzsA3/ZLn7fb6548JGrZ957eMvVj3/4igu/E8Js4/GeLNwzfONnZ35+++V3HL570613nbry1YN5uTweRup/evM7H421nlodwpd7QuhPA+tHs8BAfn801veS0RAuCIuBosTccFYibTh8YyiEo2ExUFT11aEQRkuBqx64955P1BO3DIWwJoRQS9t4uJa1MZQGLhnMAsNpYE9/FvjvZzJF4Cu9WQDOWHwzFC/647PNGSaWLtfi9Tdw1jr23EqH1xcTE63z/WzLMneqZDB9YPaMnrZKdSyLytvjhHfbCni3VbbzzZ628hep/BvKM4uhWujdObdr+3ULB+IjvWFqqq9VTcv0PP/gyQ/tOJ30inkdxg5MPMvX4d+9tlzdJ7+95va+dW/51l3r1zx27DVHfnqm3fx+aZOW08utFvLX3Ip5HqMZnycr4O1X+ZY06UtXCGHXe37rre3ilfn/RPv5f3w5x9veptyx1qfHsrl5fGQ0Jp4Yy+bmAAAAsGKshL2me6a+/oZ29VXm/5PdHf+Ph/zzyXw22hMhzDQSR8ZDuKjxeBb4Qmzu3eMhvLyRmm0ObEkCJ0J4cSOxrqgqKbEqlphMAj8eywMzSeBkFnggHo8rAp+PJW5OAh+NgeNJYEcMnEgCl8dAmG8ex2+P5ePoOjAUA9uyjXg8noXwi7HYWrKtHiqqAgAAOEvy2eFA893SuQ5nmiFOL48PdcoQz8BumaGW1JDOYItpVcsa+jvV0NuphmLch6rD/9vRNjX3dKq5chpGT3OGz/7yL94W2qjM/6fbz/9rS3Skp3L8P4Stjb8xd28eWSji22abMgAAAABnYOR/Hv1cu3hl/j/T3fn/cZ9IXylzuD/uhtg9HsJ0cyCr9nergeyo90geAAAAgJWgOB5fHAufz2+zU7TT+XQ1/+xp5o8H/meWzD944mvb2vW3Mv+f7e78/+Hm26wTJ2MvPjUewqpS4Juxl/VAw2QM/PCNzYF8/CfjBrgpVpWfmFBUdVMssS0GppPA0VYlvluUuKg5kD9ZReNHinHM5yVKAQAAADjn4u6AeFw+nv//il9v+kC7cpX5/7bTO/+/MQ+unN6/MBLChv4Q+tIfBtw/nC0MGAOjPXni68NZXX1pVTcMh3BZfWBpVY/m6//3p2sMPjCUVRUDF73i2JOX1BOfGwphQznwvXfc1lhr9UASKBr/06EQXlYfbdr4l1ZljQ+kjX96VQgvLQWKqt69KoR6Y4NpVffW8usYpFX9Yy2EF5QCRVWvq4VwMACwQsX/SneWH9x/8Prd2xcW5vYtYyLuwx8Ku+YX5qZ27FnYWWvRp51Jn5uWMbqhOqZur3zzUL5E0dvv3DraTbr4neB0ua18P37lxMH8fvwuNNAY56aBprub0yG/6pXVJkLpm1SrIfcu85CHy5UsPomV+mP+wTASVl23f27f1Ae3Hziwb2P2t9vsm7K/8TBTtq02pttqeKm+dfHyaLlaVuLZbqu15Uo2HLh274b9B69fP3/t9mvmrpl738bXbZq+dHrz9Osv3VAf1XT2t8NQ1y5VdTLUZ27rclxncagX95cqORefGhISz4PEeDgvunGuEntG1rb9P7ky/9/bfv4fP3XiJ3++PkOr4/8T8TB/9vjiYf5tMXC02+P/E62O5hcnBkwmgUMxcMhhfgAAAJ4f4iQ/7s2Me6V/su5Lj7UrV5n/H+ru9/9naf3/Yun6K1st878ulphutf5/usx/sf7/oaXX/68u81+s/3/0OVj//7oikGySX1j/HwAAeD44d+v/d1zeP71AQCVDx+X90wsEVDJ0XMa/3QUC2hbstP7/w//+Z/8Z2qjM/2/ubv5v4X4AAAA4f3zkjz7w/9rFK/P/o93N/8/9+n+h1fn/k60Cs60WBrT+HwAAACtUq/X/Jm4cfle7cpX5//Hu5v/xtIveptyx1qfHsjXtQrqm3RNjxU8GAAAAYGXoDVNTA13mbVoZdcuzb/MH+VKg7dJlj/7BqdM7//9Ed/P/pt9lfPLba27vW/eWbz191/o1jx17zZGfLh7/BwAAAJZPt/slAAAAAAAAAAAAAACA596j/3Z4c7t45ff/YWvj8Va//4/X/Yu/L3hhU+5Ya+f1//L7V735joONJQvvHwvhleXA7sO7Lwj5tfnXlgP3vHPdi+qJw2mJrz1y+Y/qiXelgTetv/CpeuKyJLAtLpL44jQQr6r41OokEJdX/Nc0ELfH8TQwmAc+vjobR0+6rX4ymm2rnnRbPTgawngpUGyrL49mbfSkA7wlCRQDfH8aiAP84zzQm/bqjpGsVzEwGoveOpL1CgCA81b8FjgQds0vzE3Hr/Dx9uL+5tuoacmyG6rV9nTZ/EP50mRvv3PraDfpvvS76OK1xgdCrT6EjZWvq+UsPY1Rnp1aOmy6F7YYcqfV3npblEud7qYbbD2ioWxEUzv2LOwc6DjwzZ2zbOrvmGVjZbJTztLb2KRd1NJFX7oYUZfbposux/u9YWqqL8n1OzE4EZp0ekV0+3v98jp/rV4F5TzvO9W+5sr8f6K7+X+tPK6n8osBHIpX1vurccv8AwAAwPL6+JZffSb+e9uN932vXd7K/H+yu/l/3IOVHwrO9naciNf/PzIeQuPS+hNZ4AuxuXePh/DyRmo2lsguqH9lLDGdBb4Qd5isiyW2zTZXtSoGjieBH4/lgRNJ4GQM5HspjoV8V85fj4Xw2kZqa3OJvbHERBJ4awxMJoGpGJhOAqtjYGZrCGOlwOOr88BsUuJfYiDMN2+rO1fn2woAAOB05POsgea7IZ3nHe/vlKGnU4bhThl6O2WodcrQahTx/hdjhoHk5JWeUqaBtNahpJZKhngx/NPuVyVD+G5zzrRgpel4/kFxvkFPc4a739BfC21U5v/T3c3/h5tvs9ZPxvn/4vX/ssA3Y/c+FU8dn4yBH76xOZDvGDgZJ7s3FVXN5iXySftNscRMDEwmgb0xMJMEtm3NA0df1BzIZ9pF40eKxufzEqUAAAAAnHNxB0HcTRPn/7fu/9hIu3L5/H+ymP/PdDf/j+2NlBv7aKz11OoQvtyz2JsisH40C8T9GKPx5/EvGQ3hgtIOjqLE3HBWYjBpOHxjKPuF+mBa1VeHsh8fxPtXPXDvPZ+oJ24ZCmFNae9L0cbDtayNoTRwyWAWGE4De/qzQNzzUwS+0psF4IwVewXjCyo/1aUwsXS5Fq+/58s1QdPhVfaBLpFvqd9cLZfKDtd8n2rh9J62tvtvOWsqb48T3m0r8d024d1W/iKVf0N5ZjFUC70753Ztv27hQHyk/EvWimV6nsu/Uu0mfRZeh4eefW87q6UdmE4+PqaXLrf067AnVvfJb6+5vW/dW7511/o1jx17zZGfdt2NFuIPhe/98D+Pfr+0eZdbLeSvuRX3eTLr82Ql/jcw6WkLIWx9/NM3tYtXjv/Pdjf/709uG34VN+b+8RBeVdq498fN//vj2edgKZB9Sr6gGsgOuf/HWMtPTgAAADjbit0dxf6C+fw2OyE8nSdX88+eZv64v2Jmyfzd9nv4z9+5pl28Mv/f1n7+vyrppuP/jv+zTBz/X9L5vit6VfrAoTPaFV2pjmXh+P+Szvd3m+P/S3L83/H/pTj+34Hj/0s635+2yrekvb50hRAe+72vP9guXpn/7+1u/m/9v6UX7SvW/9vWav2/vUmgWP/vkPX/AACAZdViobl0nldZva+SIV29r5Kh4wKBHZcYtP7faa//96OLH/51aKMy/z/U3fw/vhxGyq2vlPX/Jre2qOrmGNhrYUAAAADOR612EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDcuvtv/mtnu/h9v7niwUeunnnv4S1XP/7hKy78Tgjzjcd7snDP8I2fnfn57ZffcfjuTbfederKV9fycgP57f9vyh1rfXoshKOlR0Zj4omx+p3FwFVvvuNgfz1x/1gIrywHdh/efUE98fmxENaWA/e8c92L6onDaYmvPXL5j+qJd6WBN62/8Kl64rI80JN29+9XZ93tSbv7idUhjJcCRXffu7q5qqKNP8wDvWkb/zCatREDo7HoZ0azNmJgIZaYXxXChv4Q+tKq7qtlVfWlVf1TLauqL63qI7UQLgsh9KdVPTKYVdWfjvw7g1lVMXDRK449eUk9cXQwhA3lwPfecdtr64n3J4Gi8T8ZDOFl9ZdM2vgXB7LGB9LGbxkI4aUhhMG0xC/7sxKDaYlH+0N4QSlQNP6e/hAOBp4X4odP0yfa/oPX796+sDC3bxkTg3lbQ2HX/MLc1I49CztrSZ9a6Smln7nh2Y/9oSc/tKN++/Y7t452k+7Pyw00urxpoOnu5vO997Ffw+VKFp+PSv0x/2AYCauu2z+3b+qD2w8c2Lcx+9tt9k3Z3748mm2rjStlW60tV7LhwLV7N+w/eP36+Wu3XzN3zdz7Nr5u0/Sl05unX3/phvqoprO/Sw51oGMXm4Z627kf6sX9pUrOxQeAxLlN1F+XZ6vC+of3+TIuiXOZ6G36dJs+3z/IK1/0Fzs6EGqND+jKtKKcpacxyrMx6C1JcO3ZH/Rk/J5SHVGteUQbKxOHyqA3dc6yuTKZWMwylGVpfK+rTA7LNfU2Nmm83xumpvpabYeJ5rvlzfuzdPOehh/km7HbNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP+yAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswLEAAAAAgDB/6zB6NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBLAQAA//+6/R2m") mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys\x00', 0x1df) r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r4, r4, r4}, &(0x7f00000000c0)=""/61, 0xfffffffffffffd7e, 0x0) 118.167597ms ago: executing program 3 (id=666): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='exofs\x00', 0x0, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040400000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000140000003230060000000000"], 0x50) futex_waitv(&(0x7f0000002040)=[{0x6, &(0x7f0000000740)=0xced, 0x2}], 0x1, 0x0, 0x0, 0x1) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x26) fcntl$notify(r2, 0x402, 0x80000042) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x945}}, './file0\x00'}) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r3, 0x24, &(0x7f0000000380)) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x40402) bind$unix(r4, &(0x7f0000000440)=@abs={0x0, 0x0, 0x4e21}, 0x6e) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x18a, 0x0, &(0x7f0000000540)="e30080670000ec67838717bd86dde148f0630962bb87dd44fe42904bcee14db4241544716bd9c62231ed3373a3e2995363bb217d9c1fd05dacf5bb80b4b7c9c3abc539bfa9ce38978defbb39a1ffa8a175e8257c3c5386795f7aaa2b182cc4c3705dc9f253d21fba2eace93b558c750cfba810dc7a19dbb15a5a39c850a7541d5e2765acdedc1330ff030000b727e42ad8305aaecab5141901b2fe9df9b70001000000002e226c0d3da103584e12f876c1ceeb5cde8d693c54260d41d1037995a1cd288118dbf12115ce226253e5a18f67ce0dadaaa51388f90ba0e104cc90ab1ffb103d4875d667fab1d2ab0f37a5d7964da187d982a1b03a2871abf3c69b6302e18a7c98eddb1bff82830721a399c20000008fd5e97fcad5bdf82bd8271643b28efad5b464465a978e95a26785ae67dc11e634c7e30d853049017c970145ddfb98293210ae7dba87befd9832d5b1b6ed003bb67548aada7778d4af9ec26c99038d63137e25a91c28b165226f2cad3fd4a8761a549bfee3306273f309e7f7fe9dc3654b2e8798ccf92f", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfa1d}, 0x50) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) ioctl$mixer_OSS_GETVERSION(r5, 0x40086602, &(0x7f0000000000)) 0s ago: executing program 3 (id=667): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000180)=0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[], 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00') fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x80000000003) gettid() fcntl$lock(0xffffffffffffffff, 0x26, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x800000, 0x204031, 0xffffffffffffffff, 0xec777000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.97' (ED25519) to the list of known hosts. [ 73.779019][ T5758] cgroup: Unknown subsys name 'net' [ 73.903583][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.293328][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.259213][ T5781] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.268833][ T5781] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.275083][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.277758][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.295446][ T5781] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.295557][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.304605][ T5781] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.320332][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.325039][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.330209][ T5781] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.344343][ T5781] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.352006][ T5781] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.352389][ T5783] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.360510][ T5786] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 77.375246][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.376649][ T5786] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.390432][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.414758][ T5786] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.423156][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 77.432090][ T5786] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 77.440998][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.447561][ T5786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.458680][ T5776] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 77.469561][ T5776] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.910413][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 77.971070][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 78.035637][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 78.118505][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 78.213600][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.222985][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.230876][ T5777] bridge_slave_0: entered allmulticast mode [ 78.238835][ T5777] bridge_slave_0: entered promiscuous mode [ 78.276658][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.288859][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.298170][ T5777] bridge_slave_1: entered allmulticast mode [ 78.309073][ T5777] bridge_slave_1: entered promiscuous mode [ 78.330281][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.338738][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.349230][ T5773] bridge_slave_0: entered allmulticast mode [ 78.356659][ T5773] bridge_slave_0: entered promiscuous mode [ 78.366034][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.373591][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.381669][ T5773] bridge_slave_1: entered allmulticast mode [ 78.390486][ T5773] bridge_slave_1: entered promiscuous mode [ 78.398410][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.408993][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.416917][ T5772] bridge_slave_0: entered allmulticast mode [ 78.425573][ T5772] bridge_slave_0: entered promiscuous mode [ 78.434470][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.441900][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.451356][ T5772] bridge_slave_1: entered allmulticast mode [ 78.458495][ T5772] bridge_slave_1: entered promiscuous mode [ 78.515202][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.529901][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.545913][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.593087][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.616055][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.628954][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.662388][ T5777] team0: Port device team_slave_0 added [ 78.680207][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.689092][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.698217][ T5771] bridge_slave_0: entered allmulticast mode [ 78.707984][ T5771] bridge_slave_0: entered promiscuous mode [ 78.717307][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.725257][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.732857][ T5771] bridge_slave_1: entered allmulticast mode [ 78.740587][ T5771] bridge_slave_1: entered promiscuous mode [ 78.761361][ T5772] team0: Port device team_slave_0 added [ 78.771955][ T5777] team0: Port device team_slave_1 added [ 78.792316][ T5773] team0: Port device team_slave_0 added [ 78.805750][ T5773] team0: Port device team_slave_1 added [ 78.835975][ T5772] team0: Port device team_slave_1 added [ 78.905918][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.914989][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.947976][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.966070][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.974844][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.009310][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.023294][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.035980][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.074054][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.093530][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.110557][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.122377][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.132512][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.164569][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.198429][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.208753][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.242963][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.277796][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.286210][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.315113][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.359245][ T5771] team0: Port device team_slave_0 added [ 79.371471][ T5771] team0: Port device team_slave_1 added [ 79.403339][ T5777] hsr_slave_0: entered promiscuous mode [ 79.411998][ T5777] hsr_slave_1: entered promiscuous mode [ 79.440303][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.450382][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.479564][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.505590][ T5786] Bluetooth: hci2: command tx timeout [ 79.505602][ T5776] Bluetooth: hci3: command tx timeout [ 79.505788][ T5776] Bluetooth: hci1: command tx timeout [ 79.512558][ T5780] Bluetooth: hci0: command tx timeout [ 79.549982][ T5772] hsr_slave_0: entered promiscuous mode [ 79.557654][ T5772] hsr_slave_1: entered promiscuous mode [ 79.564187][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.573566][ T5772] Cannot create hsr debugfs directory [ 79.579726][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.589762][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.617593][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.652506][ T5773] hsr_slave_0: entered promiscuous mode [ 79.662251][ T5773] hsr_slave_1: entered promiscuous mode [ 79.669881][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.678318][ T5773] Cannot create hsr debugfs directory [ 79.737932][ T5771] hsr_slave_0: entered promiscuous mode [ 79.747512][ T5771] hsr_slave_1: entered promiscuous mode [ 79.754449][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.762396][ T5771] Cannot create hsr debugfs directory [ 80.189722][ T5777] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.216422][ T5777] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.227416][ T5777] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.238303][ T5777] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.297223][ T5772] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 80.319301][ T5772] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 80.329447][ T5772] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 80.341996][ T5772] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 80.440335][ T5773] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.453059][ T5773] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.462841][ T5773] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.490544][ T5773] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.575234][ T5771] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.598448][ T5771] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.609660][ T5771] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.622535][ T5771] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 80.700107][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.717957][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.746185][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.790934][ T2897] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.799011][ T2897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.821199][ T2897] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.828889][ T2897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.859680][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.892092][ T2897] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.900677][ T2897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.924392][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.957158][ T2897] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.965315][ T2897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.999682][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.047624][ T2897] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.063848][ T2897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.121915][ T747] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.129652][ T747] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.193595][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.282771][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.337389][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.346115][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.392476][ T5773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.437886][ T2897] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.447751][ T2897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.587427][ T5780] Bluetooth: hci1: command tx timeout [ 81.587450][ T5776] Bluetooth: hci0: command tx timeout [ 81.593353][ T5780] Bluetooth: hci2: command tx timeout [ 81.602062][ T5776] Bluetooth: hci3: command tx timeout [ 81.664246][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.720918][ T5777] veth0_vlan: entered promiscuous mode [ 81.737171][ T5777] veth1_vlan: entered promiscuous mode [ 81.792640][ T5777] veth0_macvtap: entered promiscuous mode [ 81.809612][ T5777] veth1_macvtap: entered promiscuous mode [ 81.881243][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.899996][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.919097][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.963143][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.988545][ T5777] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.998373][ T5777] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.007919][ T5777] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.017085][ T5777] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.138902][ T5772] veth0_vlan: entered promiscuous mode [ 82.151482][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.200745][ T5772] veth1_vlan: entered promiscuous mode [ 82.262160][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.276263][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.331224][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.348987][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.379652][ T5773] veth0_vlan: entered promiscuous mode [ 82.457873][ T5771] veth0_vlan: entered promiscuous mode [ 82.477121][ T5773] veth1_vlan: entered promiscuous mode [ 82.502539][ T5772] veth0_macvtap: entered promiscuous mode [ 82.521510][ T5772] veth1_macvtap: entered promiscuous mode [ 82.561193][ T5771] veth1_vlan: entered promiscuous mode [ 82.640754][ T5834] binder: BINDER_SET_CONTEXT_MGR already set [ 82.647872][ T5773] veth0_macvtap: entered promiscuous mode [ 82.651448][ T5834] binder: 5833:5834 ioctl 4018620d 200000004a80 returned -16 [ 82.661020][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.676774][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.701625][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.737240][ T5773] veth1_macvtap: entered promiscuous mode [ 82.778293][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.792750][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.810484][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.846803][ T5771] veth0_macvtap: entered promiscuous mode [ 82.870274][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.891698][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.906969][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.919499][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.948490][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.958323][ T5772] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.973886][ T5772] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.982988][ T5772] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.992654][ T5772] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.022215][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.038164][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.048975][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.054387][ T5840] Bluetooth: MGMT ver 1.22 [ 83.060258][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.077500][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.077961][ T5840] netlink: 'syz.1.7': attribute type 3 has an invalid length. [ 83.099816][ T5771] veth1_macvtap: entered promiscuous mode [ 83.122606][ T5776] Bluetooth: hci3: unexpected Set CIG Parameters response data [ 83.123167][ T5773] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.142338][ T5773] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.153136][ T5773] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.162722][ T5773] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.206974][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.219732][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.232047][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.244823][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.258475][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.278962][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.291557][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.338441][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.357964][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.368564][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.380818][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.391694][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.402678][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.415367][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.473016][ T5771] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.483249][ T5771] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.494944][ T5771] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.505056][ T5771] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.533324][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.547058][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.579248][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.593379][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.655657][ T2897] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.666214][ T2897] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.668901][ T5776] Bluetooth: hci2: command tx timeout [ 83.674263][ T5780] Bluetooth: hci0: command tx timeout [ 83.674294][ T5780] Bluetooth: hci1: command tx timeout [ 83.732832][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.741629][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.796796][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.817532][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.900689][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.924593][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.948646][ T5844] 9pnet_virtio: no channels available for device syz [ 84.006231][ T5844] process 'syz.3.4' launched '' with NULL argv: empty string added [ 85.749127][ T5786] Bluetooth: hci1: command tx timeout [ 85.755613][ T5780] Bluetooth: hci0: command tx timeout [ 85.762931][ T5776] Bluetooth: hci2: command tx timeout [ 86.711462][ T5880] netlink: 'syz.3.16': attribute type 3 has an invalid length. [ 86.721253][ T5776] Bluetooth: hci2: unexpected Set CIG Parameters response data [ 86.994277][ T5889] syzkaller0: entered promiscuous mode [ 87.025439][ T5889] syzkaller0: entered allmulticast mode [ 87.097832][ T28] audit: type=1800 audit(1786084971.004:2): pid=5892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.22" name="attr_allow_any_host" dev="configfs" ino=7495 res=0 errno=0 [ 87.110670][ T5892] nvmet: adding nsid 1 to subsystem testnqn [ 87.123423][ C1] vkms_vblank_simulate: vblank timer overrun [ 87.124499][ T5894] netlink: 8 bytes leftover after parsing attributes in process `syz.0.23'. [ 87.186365][ T5776] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 87.199116][ T5776] Bluetooth: hci3: Injecting HCI hardware error event [ 87.209398][ T5780] Bluetooth: hci3: hardware error 0x00 [ 87.225389][ T5897] syz.3.24[5897]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 87.232441][ T5889] tipc: Started in network mode [ 87.244946][ T28] audit: type=1800 audit(1786084971.154:3): pid=5892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.22" name="addr_trtype" dev="configfs" ino=7122 res=0 errno=0 [ 87.247135][ T28] audit: type=1800 audit(1786084971.154:4): pid=5892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.22" name="addr_adrfam" dev="configfs" ino=7123 res=0 errno=0 [ 87.270748][ C1] vkms_vblank_simulate: vblank timer overrun [ 87.316564][ T28] audit: type=1800 audit(1786084971.214:5): pid=5892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.22" name="addr_traddr" dev="configfs" ino=7506 res=0 errno=0 [ 87.327210][ T5892] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 87.338505][ C1] vkms_vblank_simulate: vblank timer overrun [ 87.338648][ T28] audit: type=1800 audit(1786084971.224:6): pid=5892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.22" name="addr_trsvcid" dev="configfs" ino=7507 res=0 errno=0 [ 87.404098][ T5889] tipc: Node identity 02833ed3caec, cluster identity 4711 [ 87.412443][ T5889] tipc: Enabled bearer , priority 0 [ 87.534576][ T5886] tipc: Resetting bearer [ 88.000527][ T5886] tipc: Disabling bearer [ 89.344124][ T5780] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 89.544856][ T5922] netlink: 'syz.1.32': attribute type 3 has an invalid length. [ 90.784057][ T5780] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 90.799243][ T5780] Bluetooth: hci2: Injecting HCI hardware error event [ 90.816340][ T5776] Bluetooth: hci2: hardware error 0x00 [ 92.598279][ T56] cfg80211: failed to load regulatory.db [ 92.932090][ T5955] netlink: 'syz.2.42': attribute type 3 has an invalid length. [ 92.954580][ T5776] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 92.975087][ T5951] syzkaller0: entered promiscuous mode [ 92.981639][ T5951] syzkaller0: entered allmulticast mode [ 92.984366][ T5776] Bluetooth: hci0: unexpected Set CIG Parameters response data [ 93.169292][ T5951] tipc: Enabled bearer , priority 0 [ 93.571709][ T5949] tipc: Resetting bearer [ 94.040290][ T5949] tipc: Disabling bearer [ 94.163724][ T5964] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 96.183333][ T5983] 9pnet_virtio: no channels available for device syz [ 96.762746][ T5996] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 97.034306][ T5776] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 97.047311][ T5776] Bluetooth: hci0: Injecting HCI hardware error event [ 97.062983][ T5776] Bluetooth: hci0: hardware error 0x00 [ 97.520454][ T6001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 98.726044][ T6011] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 98.944214][ T174] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 99.033997][ T6016] 9pnet_virtio: no channels available for device syz [ 99.187040][ T174] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 99.224004][ T174] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.240025][ T174] usb 2-1: Product: syz [ 99.253317][ T174] usb 2-1: Manufacturer: syz [ 99.344675][ T6027] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 99.585740][ T5776] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 99.626216][ T174] usb 2-1: SerialNumber: syz [ 100.101835][ T174] usb 2-1: config 0 descriptor?? [ 100.736581][ T6041] netlink: 16 bytes leftover after parsing attributes in process `syz.3.66'. [ 100.923890][ T174] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 101.975311][ T5841] usb 2-1: USB disconnect, device number 2 [ 102.047697][ T174] usb 1-1: Dual-Role OTG device on HNP port [ 102.090303][ T174] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 102.128315][ T174] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.259890][ T174] gspca_main: spca501-2.14.0 probing 0000:0000 [ 102.335312][ T6054] 9pnet_virtio: no channels available for device syz [ 102.345524][ T174] gspca_spca501: reg write: error -32 [ 102.369571][ T174] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 102.404150][ T174] spca501: probe of 1-1:1.0 failed with error -22 [ 102.447754][ T174] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 102.638262][ T6061] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 103.809165][ T6073] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 103.922336][ T6076] jffs2: notice: (6076) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 105.525006][ T28] audit: type=1800 audit(1786084989.424:7): pid=6096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.90" name="attr_allow_any_host" dev="configfs" ino=8483 res=0 errno=0 [ 105.689031][ T6100] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 105.743438][ T6096] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 105.950418][ T28] audit: type=1800 audit(1786084989.494:8): pid=6096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.90" name="addr_trtype" dev="configfs" ino=7815 res=0 errno=0 [ 106.408089][ T6105] jffs2: notice: (6105) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.440567][ T28] audit: type=1800 audit(1786084989.524:9): pid=6096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.90" name="addr_adrfam" dev="configfs" ino=8486 res=0 errno=0 [ 106.501082][ T28] audit: type=1800 audit(1786084989.584:10): pid=6096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.90" name="addr_traddr" dev="configfs" ino=8488 res=0 errno=0 [ 106.761879][ T6111] syzkaller0: entered promiscuous mode [ 106.778632][ T6111] syzkaller0: entered allmulticast mode [ 106.820317][ T6113] Zero length message leads to an empty skb [ 107.379408][ T6111] tipc: Started in network mode [ 107.434186][ T6111] tipc: Node identity 6aaa05971df1, cluster identity 4711 [ 107.545879][ T6111] tipc: Enabled bearer , priority 0 [ 107.654684][ T6110] tipc: Resetting bearer [ 107.762973][ T6110] tipc: Disabling bearer [ 110.413696][ C0] sched: RT throttling activated [ 111.153798][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 112.610284][ T6148] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 112.781689][ T6151] warning: `syz.3.107' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 113.223351][ T6159] syzkaller0: entered promiscuous mode [ 113.247268][ T6159] syzkaller0: entered allmulticast mode [ 114.095416][ T6168] tipc: Enabled bearer , priority 0 [ 114.164471][ T6158] tipc: Resetting bearer [ 114.275824][ T6158] tipc: Disabling bearer [ 114.702257][ T6181] ieee802154 phy0 wpan0: encryption failed: -22 [ 115.811359][ T6194] syzkaller0: entered promiscuous mode [ 115.838320][ T6194] syzkaller0: entered allmulticast mode [ 115.927903][ T6194] tipc: Enabled bearer , priority 0 [ 115.970269][ T6193] tipc: Resetting bearer [ 116.442719][ T6193] tipc: Disabling bearer [ 117.267564][ T6207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.127'. [ 118.139744][ T6221] (null): rxe_set_mtu: Set mtu to 1024 [ 118.369595][ T6230] netlink: 8 bytes leftover after parsing attributes in process `syz.1.135'. [ 119.558971][ T6221] infiniband syz2: set down [ 119.580901][ T6221] infiniband syz2: added ipvlan0 [ 119.588473][ T6221] syz2: rxe_create_cq: returned err = -12 [ 119.588761][ T6221] infiniband syz2: Couldn't create ib_mad CQ [ 119.589160][ T6221] infiniband syz2: Couldn't open port 1 [ 119.647390][ T6244] syzkaller0: entered promiscuous mode [ 119.708451][ T6244] syzkaller0: entered allmulticast mode [ 119.726856][ T6221] RDS/IB: syz2: added [ 119.742348][ T6221] smc: adding ib device syz2 with port count 1 [ 119.763940][ T6221] smc: ib device syz2 port 1 has pnetid [ 119.879096][ T6244] tipc: Enabled bearer , priority 0 [ 119.951775][ T6243] tipc: Resetting bearer [ 120.670462][ T6243] tipc: Disabling bearer [ 123.037349][ T6280] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 123.899145][ T6283] syzkaller0: entered promiscuous mode [ 123.904934][ T6283] syzkaller0: entered allmulticast mode [ 125.245507][ T6295] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 125.291728][ T6295] CIFS mount error: No usable UNC path provided in device string! [ 125.291728][ T6295] [ 125.327128][ T6295] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 125.884266][ T56] libceph: connect (1)[c::]:6789 error -101 [ 125.896253][ T56] libceph: mon0 (1)[c::]:6789 connect error [ 125.928228][ T27] libceph: connect (1)[c::]:6789 error -101 [ 125.934627][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 126.147986][ T6313] syzkaller0: entered promiscuous mode [ 126.155371][ T6313] syzkaller0: entered allmulticast mode [ 126.187763][ T6313] tipc: Enabled bearer , priority 0 [ 126.204022][ T6312] tipc: Resetting bearer [ 126.216111][ T27] libceph: connect (1)[c::]:6789 error -101 [ 126.292062][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 126.322504][ T6312] tipc: Disabling bearer [ 126.348618][ T6303] ceph: No mds server is up or the cluster is laggy [ 128.728807][ T6331] device-mapper: ioctl: Unable to rename non-existent device, to § [ 129.231013][ T6340] syzkaller0: entered promiscuous mode [ 129.242576][ T6340] syzkaller0: entered allmulticast mode [ 129.277626][ T6340] tipc: Started in network mode [ 129.284598][ T8] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 129.289789][ T6340] tipc: Node identity bea6b8436876, cluster identity 4711 [ 129.302499][ T6340] tipc: Enabled bearer , priority 0 [ 129.320656][ T6339] tipc: Resetting bearer [ 129.367033][ T6339] tipc: Disabling bearer [ 129.488085][ T8] usb 4-1: Using ep0 maxpacket: 8 [ 129.509836][ T8] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 129.523787][ T8] usb 4-1: config 0 has no interface number 0 [ 129.532446][ T8] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 129.555347][ T8] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 129.585922][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.620463][ T8] usb 4-1: config 0 descriptor?? [ 129.715043][ T8] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 129.965029][ T6354] device-mapper: ioctl: Unable to rename non-existent device, to § [ 130.138902][ T6361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.159827][ T6361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.181646][ T6361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.207327][ T6361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.305796][ T6367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.318873][ T6367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.328805][ T6366] syzkaller0: entered promiscuous mode [ 130.339386][ T6346] loop0: detected capacity change from 0 to 32768 [ 130.346972][ T6366] syzkaller0: entered allmulticast mode [ 130.428533][ T6366] tipc: Enabled bearer , priority 0 [ 130.451291][ T6346] XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 130.463843][ T6365] tipc: Resetting bearer [ 130.547893][ T6365] tipc: Disabling bearer [ 130.572153][ T6346] XFS (loop0): Ending clean mount [ 130.790127][ T5773] XFS (loop0): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 131.057620][ T8] usb 4-1: USB disconnect, device number 2 [ 131.305395][ T6388] device-mapper: ioctl: Unable to rename non-existent device, to § [ 131.613509][ T6398] syzkaller0: entered promiscuous mode [ 131.650285][ T6398] syzkaller0: entered allmulticast mode [ 131.732797][ T6398] tipc: Enabled bearer , priority 0 [ 131.797874][ T6397] tipc: Resetting bearer [ 131.875176][ T6397] tipc: Disabling bearer [ 131.959838][ T6410] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 132.863511][ T6416] device-mapper: ioctl: Unable to rename non-existent device, to § [ 133.052601][ T6421] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 133.096751][ T6421] binder: 6419:6421 unknown command 1074553619 [ 133.107215][ T6421] binder: 6419:6421 ioctl c0306201 200000000040 returned -22 [ 133.489217][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.503512][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.112296][ T6426] pim6reg: entered allmulticast mode [ 134.276854][ T6434] usb 1-1: USB disconnect, device number 2 [ 135.233844][ T8] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 135.272008][ T6449] file system registered [ 135.340676][ T6452] netlink: 84 bytes leftover after parsing attributes in process `syz.3.211'. [ 135.372476][ T6451] tipc: Enabling of bearer rejected, failed to enable media [ 135.458576][ T5772] ffs_data_put(): freeing [ 135.544068][ T8] usb 3-1: unable to get BOS descriptor or descriptor too short [ 135.554816][ T6457] netlink: 12 bytes leftover after parsing attributes in process `syz.3.213'. [ 135.586370][ T8] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 135.599358][ T8] usb 3-1: can't read configurations, error -71 [ 135.666596][ T6463] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.678354][ T6463] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.362637][ T6479] netlink: 84 bytes leftover after parsing attributes in process `syz.3.222'. [ 136.395070][ T6480] netlink: 'syz.0.223': attribute type 3 has an invalid length. [ 136.426075][ T5776] Bluetooth: hci1: unexpected Set CIG Parameters response data [ 136.451866][ T5772] ffs_data_put(): freeing [ 136.506778][ T6484] 9pnet_virtio: no channels available for device syz [ 136.624948][ T6486] syzkaller0: entered promiscuous mode [ 136.636113][ T6486] syzkaller0: entered allmulticast mode [ 136.665382][ T6486] tipc: Enabled bearer , priority 0 [ 136.688967][ T6485] tipc: Resetting bearer [ 136.748595][ T6485] tipc: Disabling bearer [ 137.000333][ T6497] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 137.872866][ T6503] ffs_data_put(): freeing [ 137.878518][ T5771] ffs_data_put(): freeing [ 137.891760][ T6505] 9pnet_virtio: no channels available for device syz [ 137.902312][ T6503] netlink: 84 bytes leftover after parsing attributes in process `syz.1.233'. [ 138.300569][ T6518] syzkaller0: entered promiscuous mode [ 138.314407][ T6518] syzkaller0: entered allmulticast mode [ 138.404191][ T6518] tipc: Started in network mode [ 138.418499][ T6518] tipc: Node identity ca4b18134262, cluster identity 4711 [ 138.437100][ T6518] tipc: Enabled bearer , priority 0 [ 138.447924][ T6523] netlink: 'syz.2.242': attribute type 3 has an invalid length. [ 138.460255][ T6517] tipc: Resetting bearer [ 138.515815][ T6517] tipc: Disabling bearer [ 138.615001][ T6529] 9pnet_virtio: no channels available for device syz [ 138.812569][ T6533] ffs_data_put(): freeing [ 138.830555][ T6533] netlink: 84 bytes leftover after parsing attributes in process `syz.1.247'. [ 139.978904][ T28] audit: type=1800 audit(1786085023.884:11): pid=6548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.251" name="attr_allow_any_host" dev="configfs" ino=9738 res=0 errno=0 [ 140.000092][ C0] vkms_vblank_simulate: vblank timer overrun [ 140.063953][ T28] audit: type=1800 audit(1786085023.924:12): pid=6548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.251" name="addr_trtype" dev="configfs" ino=9739 res=0 errno=0 [ 140.094040][ T6548] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 140.117077][ T6551] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 140.381559][ T28] audit: type=1800 audit(1786085023.924:13): pid=6548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.251" name="addr_traddr" dev="configfs" ino=9740 res=0 errno=0 [ 140.472801][ T5776] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 140.482599][ T5776] Bluetooth: hci1: Injecting HCI hardware error event [ 140.497081][ T5780] Bluetooth: hci1: hardware error 0x00 [ 140.993434][ T6559] netlink: 40 bytes leftover after parsing attributes in process `syz.3.254'. [ 141.111952][ T6567] netlink: 'syz.3.259': attribute type 3 has an invalid length. [ 141.130753][ T6565] 9pnet_virtio: no channels available for device syz [ 141.264393][ T6571] syzkaller0: entered promiscuous mode [ 141.276906][ T6571] syzkaller0: entered allmulticast mode [ 141.305592][ T6571] tipc: Enabled bearer , priority 0 [ 141.326523][ T6570] tipc: Resetting bearer [ 141.374613][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 141.385632][ T28] audit: type=1800 audit(1786085025.284:14): pid=6581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.263" name="attr_allow_any_host" dev="configfs" ino=10474 res=0 errno=0 [ 141.408358][ T6581] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 141.415872][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 141.433535][ T6570] tipc: Disabling bearer [ 141.444007][ T28] audit: type=1800 audit(1786085025.284:15): pid=6581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.263" name="addr_trtype" dev="configfs" ino=10475 res=0 errno=0 [ 141.471851][ T28] audit: type=1800 audit(1786085025.294:16): pid=6581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.263" name="addr_traddr" dev="configfs" ino=9795 res=0 errno=0 [ 141.557600][ T6586] syzkaller0: entered promiscuous mode [ 141.563289][ T6586] syzkaller0: entered allmulticast mode [ 141.674863][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 141.687943][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 141.823567][ T6591] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 142.159581][ T6576] ceph: No mds server is up or the cluster is laggy [ 142.226051][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 142.302137][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 142.716641][ T6595] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 142.943994][ T5780] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 143.673013][ T6602] netlink: 40 bytes leftover after parsing attributes in process `syz.0.270'. [ 143.834470][ T6606] 9pnet_virtio: no channels available for device syz [ 143.909865][ T6610] syzkaller0: entered promiscuous mode [ 143.916468][ T6610] syzkaller0: entered allmulticast mode [ 143.938669][ T6613] netlink: 'syz.0.275': attribute type 3 has an invalid length. [ 143.954654][ T6610] tipc: Enabled bearer , priority 0 [ 144.007089][ T6609] tipc: Resetting bearer [ 144.062188][ T6609] tipc: Disabling bearer [ 144.080992][ T27] libceph: connect (1)[c::]:6789 error -101 [ 144.090172][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 144.309620][ T6632] netlink: 16 bytes leftover after parsing attributes in process `syz.1.282'. [ 144.354490][ T5876] libceph: connect (1)[c::]:6789 error -101 [ 144.360700][ T5876] libceph: mon0 (1)[c::]:6789 connect error [ 144.623833][ T27] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 144.693645][ T6638] (null): rxe_set_mtu: Set mtu to 1024 [ 144.703821][ T6638] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 144.878033][ T23] libceph: connect (1)[c::]:6789 error -101 [ 144.933805][ T27] usb 4-1: Using ep0 maxpacket: 8 [ 144.968687][ T23] libceph: mon0 (1)[c::]:6789 connect error [ 145.085883][ T27] usb 4-1: config 0 has no interfaces? [ 145.170876][ T27] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 145.317648][ T27] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.378089][ T27] usb 4-1: config 0 descriptor?? [ 145.608545][ T27] usb 4-1: USB disconnect, device number 3 [ 145.904394][ T6640] loop0: detected capacity change from 0 to 32768 [ 145.999289][ T6640] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.285 (6640) [ 146.083720][ T6617] ceph: No mds server is up or the cluster is laggy [ 146.381380][ T6644] 9pnet_virtio: no channels available for device syz [ 146.530755][ T6640] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 146.672431][ T6640] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 146.787964][ T6640] BTRFS info (device loop0): turning off barriers [ 146.870441][ T6640] BTRFS info (device loop0): setting nodatasum [ 146.918668][ T6640] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 147.086280][ T6640] BTRFS info (device loop0): use zstd compression, level 3 [ 147.204210][ T6640] BTRFS info (device loop0): using free space tree [ 147.378727][ T45] BTRFS warning (device loop0): checksum verify failed on logical 5312512 mirror 1 wanted 0x6ee40500 found 0x6ee483f7 level 0 [ 147.445518][ T6640] BTRFS error (device loop0: state C): failed to load root csum [ 147.541037][ T6670] syzkaller0: entered promiscuous mode [ 147.555622][ T6670] syzkaller0: entered allmulticast mode [ 147.568041][ T6640] BTRFS error (device loop0: state C): open_ctree failed: -5 [ 147.594931][ T6670] tipc: Enabled bearer , priority 0 [ 147.644001][ T6669] tipc: Resetting bearer [ 147.668249][ T5788] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by udevd (5788) [ 147.945516][ T6678] netlink: 'syz.2.293': attribute type 3 has an invalid length. [ 147.972050][ T6669] tipc: Disabling bearer [ 148.197593][ T6684] 9pnet_virtio: no channels available for device syz [ 148.219749][ T6686] syzkaller0: entered promiscuous mode [ 148.226298][ T6686] syzkaller0: entered allmulticast mode [ 148.437277][ T6690] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 151.026548][ T6711] syzkaller0: entered promiscuous mode [ 151.032829][ T6711] syzkaller0: entered allmulticast mode [ 151.050997][ T6714] 9pnet_virtio: no channels available for device syz [ 151.072901][ T6711] tipc: Enabled bearer , priority 0 [ 151.166530][ T6708] tipc: Resetting bearer [ 151.300730][ T6708] tipc: Disabling bearer [ 151.554465][ T6726] netlink: 'syz.3.311': attribute type 3 has an invalid length. [ 151.907619][ T6738] 9pnet_virtio: no channels available for device syz [ 153.007019][ T6755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.319'. [ 153.403285][ T6773] tipc: Enabling of bearer rejected, failed to enable media [ 154.390587][ T6785] 9pnet_virtio: no channels available for device syz [ 154.607737][ T6796] netlink: 8 bytes leftover after parsing attributes in process `syz.0.329'. [ 155.720186][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 155.743244][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 156.037167][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 156.143439][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 156.774300][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 156.801608][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 156.926910][ T6812] ceph: No mds server is up or the cluster is laggy [ 156.989896][ T6840] 9pnet_virtio: no channels available for device syz [ 157.171925][ T6849] netlink: 8 bytes leftover after parsing attributes in process `syz.0.340'. [ 157.433766][ T5841] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 158.455296][ T5841] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 158.493674][ T5841] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.711941][ T6874] syzkaller0: entered promiscuous mode [ 158.720135][ T6874] syzkaller0: entered allmulticast mode [ 158.749549][ T5841] cdc_acm 4-1:1.0: ttyACM0: USB ACM device [ 158.805675][ T5876] libceph: connect (1)[c::]:6789 error -101 [ 158.816026][ T5876] libceph: mon0 (1)[c::]:6789 connect error [ 159.084320][ T27] libceph: connect (1)[c::]:6789 error -101 [ 159.097772][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 159.116364][ T6893] netlink: 8 bytes leftover after parsing attributes in process `syz.0.351'. [ 159.640627][ T27] libceph: connect (1)[c::]:6789 error -101 [ 159.673080][ T6877] ceph: No mds server is up or the cluster is laggy [ 159.747585][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 160.443197][ T6916] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 161.411641][ T6925] syzkaller0: entered promiscuous mode [ 161.421305][ T6925] syzkaller0: entered allmulticast mode [ 161.970140][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 162.775613][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 163.145881][ T6945] ceph: No mds server is up or the cluster is laggy [ 163.435770][ T6965] binder: 6964:6965 unknown command 1074553619 [ 163.464545][ T6965] binder: 6964:6965 ioctl c0306201 200000000040 returned -22 [ 163.631301][ T6968] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 163.657435][ T6968] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.667359][ T6968] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.315373][ T27] usb 4-1: USB disconnect, device number 4 [ 164.604213][ T6980] syzkaller0: entered promiscuous mode [ 164.620473][ T6980] syzkaller0: entered allmulticast mode [ 167.917317][ T7023] sch_fq: defrate 0 ignored. [ 169.013699][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 169.224319][ T7046] binder: 7044:7046 unknown command 1074553619 [ 169.230735][ T7046] binder: 7044:7046 ioctl c0306201 200000000040 returned -22 [ 169.352096][ T7050] syzkaller0: entered promiscuous mode [ 169.374084][ T7050] syzkaller0: entered allmulticast mode [ 171.196244][ T28] audit: type=1800 audit(1786085055.084:17): pid=7095 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.404" name="attr_allow_any_host" dev="configfs" ino=12340 res=0 errno=0 [ 171.226682][ T7095] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 171.275741][ T28] audit: type=1800 audit(1786085055.104:18): pid=7095 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.404" name="addr_adrfam" dev="configfs" ino=12341 res=0 errno=0 [ 171.393682][ T28] audit: type=1800 audit(1786085055.134:19): pid=7095 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.404" name="addr_traddr" dev="configfs" ino=12342 res=0 errno=0 [ 171.579302][ T7105] 9pnet_virtio: no channels available for device syz [ 173.384618][ T7133] 9pnet_virtio: no channels available for device syz [ 175.165904][ T7172] fuse: Bad value for 'fd' [ 175.174651][ T5772] ffs_data_put(): freeing [ 175.344439][ T7181] 9pnet_virtio: no channels available for device syz [ 175.720571][ T7191] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 175.737628][ T7191] binder: 7188:7191 unknown command 1074553619 [ 175.744152][ T7191] binder: 7188:7191 ioctl c0306201 200000000040 returned -22 [ 178.664877][ T5773] ffs_data_put(): freeing [ 178.742198][ T7223] 9pnet_fd: Insufficient options for proto=fd [ 178.821278][ T7227] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 178.838802][ T7227] binder: 7224:7227 unknown command 1074553619 [ 178.846201][ T7227] binder: 7224:7227 ioctl c0306201 200000000040 returned -22 [ 179.461321][ T7225] 9pnet_virtio: no channels available for device syz [ 180.936636][ T7257] 9pnet_virtio: no channels available for device syz [ 181.148843][ T7263] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 181.169152][ T7263] binder: 7260:7263 unknown command 1074553619 [ 181.175730][ T7263] binder: 7260:7263 ioctl c0306201 200000000040 returned -22 [ 182.209199][ T7272] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 183.397313][ T7286] 9pnet_virtio: no channels available for device syz [ 183.972349][ T7303] ffs_data_put(): freeing [ 184.768910][ T7313] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 185.821630][ T7318] 9pnet_virtio: no channels available for device syz [ 186.168587][ T7327] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 186.188146][ T7327] binder: 7325:7327 unknown command 1074553619 [ 186.194863][ T7327] binder: 7325:7327 ioctl c0306201 200000000040 returned -22 [ 187.165952][ T28] audit: type=1800 audit(1786085071.074:20): pid=7335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.473" name="attr_allow_any_host" dev="configfs" ino=12730 res=0 errno=0 [ 187.192773][ T7335] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 187.243470][ T28] audit: type=1800 audit(1786085071.094:21): pid=7335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.473" name="addr_trtype" dev="configfs" ino=12731 res=0 errno=0 [ 187.268052][ T28] audit: type=1800 audit(1786085071.094:22): pid=7335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.473" name="addr_adrfam" dev="configfs" ino=12732 res=0 errno=0 [ 187.356722][ T28] audit: type=1800 audit(1786085071.094:23): pid=7335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.473" name="addr_traddr" dev="configfs" ino=12733 res=0 errno=0 [ 187.456893][ T7342] syzkaller0: entered promiscuous mode [ 187.471696][ T7342] syzkaller0: entered allmulticast mode [ 187.753865][ T7348] 9pnet_virtio: no channels available for device syz [ 188.343144][ T7359] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 188.365321][ T7359] binder: 7355:7359 unknown command 1074553619 [ 188.371733][ T7359] binder: 7355:7359 ioctl c0306201 200000000040 returned -22 [ 189.178855][ T28] audit: type=1800 audit(1786085073.084:24): pid=7364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.484" name="attr_allow_any_host" dev="configfs" ino=12787 res=0 errno=0 [ 189.216274][ T7364] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 189.263749][ T28] audit: type=1800 audit(1786085073.114:25): pid=7364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.484" name="addr_trtype" dev="configfs" ino=12788 res=0 errno=0 [ 189.328667][ T28] audit: type=1800 audit(1786085073.114:26): pid=7364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.484" name="addr_adrfam" dev="configfs" ino=12140 res=0 errno=0 [ 189.362505][ T28] audit: type=1800 audit(1786085073.124:27): pid=7364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.484" name="addr_traddr" dev="configfs" ino=12141 res=0 errno=0 [ 189.584374][ T7373] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 190.678451][ T7379] 9pnet_virtio: no channels available for device syz [ 192.140804][ T28] audit: type=1800 audit(1786085076.044:28): pid=7393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.494" name="attr_allow_any_host" dev="configfs" ino=12842 res=0 errno=0 [ 192.155363][ T7393] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 192.199144][ T28] audit: type=1800 audit(1786085076.054:29): pid=7393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.494" name="addr_trtype" dev="configfs" ino=12843 res=0 errno=0 [ 192.236431][ T28] audit: type=1800 audit(1786085076.054:30): pid=7393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.494" name="addr_adrfam" dev="configfs" ino=12844 res=0 errno=0 [ 192.260000][ T28] audit: type=1800 audit(1786085076.064:31): pid=7393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.494" name="addr_traddr" dev="configfs" ino=12845 res=0 errno=0 [ 192.642901][ T7405] 9pnet_virtio: no channels available for device syz [ 194.530841][ T28] audit: type=1800 audit(1786085078.434:32): pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.506" name="attr_allow_any_host" dev="configfs" ino=12229 res=0 errno=0 [ 194.564156][ T7423] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 194.581198][ T28] audit: type=1800 audit(1786085078.434:33): pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.506" name="addr_trtype" dev="configfs" ino=12230 res=0 errno=0 [ 194.602875][ T28] audit: type=1800 audit(1786085078.434:34): pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.506" name="addr_adrfam" dev="configfs" ino=12231 res=0 errno=0 [ 194.624798][ T28] audit: type=1800 audit(1786085078.464:35): pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.506" name="addr_traddr" dev="configfs" ino=12232 res=0 errno=0 [ 194.730936][ T7428] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 194.749860][ T7428] binder: 7425:7428 unknown command 1074553619 [ 194.756334][ T7428] binder: 7425:7428 ioctl c0306201 200000000040 returned -22 [ 195.519413][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.526137][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.766225][ T7433] netlink: 'syz.3.510': attribute type 10 has an invalid length. [ 195.780134][ T7433] netlink: 212412 bytes leftover after parsing attributes in process `syz.3.510'. [ 195.991682][ T7433] openvswitch: netlink: Flow key attr not present in new flow. [ 196.851242][ T7447] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 196.880569][ T7447] binder: 7445:7447 unknown command 1074553619 [ 196.890022][ T7447] binder: 7445:7447 ioctl c0306201 200000000040 returned -22 [ 197.721461][ T28] audit: type=1800 audit(1786085081.624:36): pid=7456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.516" name="attr_allow_any_host" dev="configfs" ino=12927 res=0 errno=0 [ 197.749006][ T7456] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 197.767011][ T28] audit: type=1800 audit(1786085081.654:37): pid=7456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.516" name="addr_trtype" dev="configfs" ino=12928 res=0 errno=0 [ 197.816985][ T28] audit: type=1800 audit(1786085081.654:38): pid=7456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.516" name="addr_adrfam" dev="configfs" ino=12929 res=0 errno=0 [ 197.893666][ T28] audit: type=1800 audit(1786085081.654:39): pid=7456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.516" name="addr_traddr" dev="configfs" ino=12930 res=0 errno=0 [ 199.283791][ T7480] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 200.330539][ T28] audit: type=1800 audit(1786085084.234:40): pid=7486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.526" name="attr_allow_any_host" dev="configfs" ino=13370 res=0 errno=0 [ 200.365919][ T28] audit: type=1800 audit(1786085084.274:41): pid=7486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.526" name="addr_trtype" dev="configfs" ino=13372 res=0 errno=0 [ 200.396289][ T28] audit: type=1800 audit(1786085084.274:42): pid=7486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.526" name="addr_adrfam" dev="configfs" ino=13374 res=0 errno=0 [ 200.427015][ T7486] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 200.474325][ T28] audit: type=1800 audit(1786085084.304:43): pid=7486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.526" name="addr_traddr" dev="configfs" ino=12962 res=0 errno=0 [ 200.660866][ T7489] netlink: 'syz.3.527': attribute type 3 has an invalid length. [ 200.775141][ T7483] loop0: detected capacity change from 0 to 32768 [ 200.819014][ T7483] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 200.847247][ T7498] syzkaller0: entered promiscuous mode [ 200.861683][ T7498] syzkaller0: entered allmulticast mode [ 200.870433][ T7483] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 200.901044][ T7483] BTRFS info (device loop0): turning off barriers [ 200.915402][ T7483] BTRFS info (device loop0): setting nodatasum [ 200.953537][ T7483] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 200.978312][ T7483] BTRFS info (device loop0): use zstd compression, level 3 [ 200.994626][ T7483] BTRFS info (device loop0): using free space tree [ 201.053709][ T5999] BTRFS warning (device loop0): checksum verify failed on logical 5312512 mirror 1 wanted 0x6ee40500 found 0x6ee483f7 level 0 [ 201.104607][ T7483] BTRFS error (device loop0: state C): failed to load root csum [ 201.177188][ T7483] BTRFS error (device loop0: state C): open_ctree failed: -5 [ 202.208393][ T7525] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 202.696032][ T28] audit: type=1800 audit(1786085086.574:44): pid=7529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.535" name="attr_allow_any_host" dev="configfs" ino=13011 res=0 errno=0 [ 202.840255][ T7529] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 202.950453][ T28] audit: type=1800 audit(1786085086.644:45): pid=7529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.535" name="addr_trtype" dev="configfs" ino=13013 res=0 errno=0 [ 203.078887][ T28] audit: type=1800 audit(1786085086.684:46): pid=7529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.535" name="addr_adrfam" dev="configfs" ino=13014 res=0 errno=0 [ 203.133343][ T28] audit: type=1800 audit(1786085086.704:47): pid=7529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.535" name="addr_traddr" dev="configfs" ino=13015 res=0 errno=0 [ 203.460172][ T7546] netlink: 'syz.3.543': attribute type 3 has an invalid length. [ 204.089911][ T7543] loop0: detected capacity change from 0 to 32768 [ 204.105067][ T7543] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.542 (7543) [ 204.128279][ T7543] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 204.148470][ T7543] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 204.162320][ T7543] BTRFS info (device loop0): turning off barriers [ 204.173396][ T7543] BTRFS info (device loop0): setting nodatasum [ 204.181074][ T7543] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 204.195651][ T7543] BTRFS info (device loop0): use zstd compression, level 3 [ 204.203214][ T7543] BTRFS info (device loop0): using free space tree [ 204.233131][ T5999] BTRFS warning (device loop0): checksum verify failed on logical 5312512 mirror 1 wanted 0x6ee40500 found 0x6ee483f7 level 0 [ 204.277412][ T7543] BTRFS error (device loop0: state C): failed to load root csum [ 204.471519][ T7543] BTRFS error (device loop0: state C): open_ctree failed: -5 [ 205.551538][ T7581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.550'. [ 206.849974][ T7601] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 206.964297][ T7606] nvmet_rdma: malformed ip/port passed: 172.20.20.20: [ 207.004553][ T28] audit: type=1800 audit(1786085090.864:48): pid=7606 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.558" name="attr_allow_any_host" dev="configfs" ino=13119 res=0 errno=0 [ 207.025835][ C1] vkms_vblank_simulate: vblank timer overrun [ 207.181956][ T28] audit: type=1800 audit(1786085090.864:49): pid=7606 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.558" name="addr_trtype" dev="configfs" ino=13120 res=0 errno=0 [ 207.382995][ T28] audit: type=1800 audit(1786085090.864:50): pid=7606 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.558" name="addr_adrfam" dev="configfs" ino=13121 res=0 errno=0 [ 207.424789][ T28] audit: type=1800 audit(1786085090.864:51): pid=7606 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.558" name="addr_traddr" dev="configfs" ino=13122 res=0 errno=0 [ 209.241761][ T7651] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 209.419671][ T7658] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 210.247127][ T7672] netlink: 'syz.1.572': attribute type 10 has an invalid length. [ 210.255434][ T7672] hsr0: entered promiscuous mode [ 210.289151][ T7672] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 210.704083][ T23] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 210.925658][ T23] usb 4-1: unable to get BOS descriptor or descriptor too short [ 210.943697][ T23] usb 4-1: not running at top speed; connect to a high speed hub [ 210.953809][ T23] usb 4-1: config 8 has an invalid interface number: 191 but max is 0 [ 210.962119][ T23] usb 4-1: config 8 has no interface number 0 [ 211.003863][ T23] usb 4-1: config 8 interface 191 has no altsetting 0 [ 211.036590][ T23] usb 4-1: New USB device found, idVendor=04da, idProduct=3904, bcdDevice=12.d1 [ 211.068339][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.093865][ T23] usb 4-1: Product: syz [ 211.098858][ T23] usb 4-1: Manufacturer: syz [ 211.123725][ T23] usb 4-1: SerialNumber: syz [ 211.236940][ T7691] syzkaller0: entered promiscuous mode [ 211.283175][ T7691] syzkaller0: entered allmulticast mode [ 211.350049][ T23] usb 4-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 211.380819][ T23] usb 4-1: USB disconnect, device number 5 [ 211.391459][ T5788] udevd[5788]: setting mode of /dev/bus/usb/004/005 to 020664 failed: No such file or directory [ 211.432636][ T5788] udevd[5788]: setting owner of /dev/bus/usb/004/005 to uid=0, gid=0 failed: No such file or directory [ 211.855932][ T7701] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 212.302939][ T7707] loop3: detected capacity change from 0 to 8 [ 212.397554][ T7707] ======================================================= [ 212.397554][ T7707] WARNING: The mand mount option has been deprecated and [ 212.397554][ T7707] and is ignored by this kernel. Remove the mand [ 212.397554][ T7707] option from the mount to silence this warning. [ 212.397554][ T7707] ======================================================= [ 212.894056][ T7707] unable to read inode lookup table [ 213.085346][ T7711] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 214.898563][ T7720] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 216.347339][ T7734] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 217.842958][ T7750] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 218.373046][ T7759] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 219.025005][ T28] audit: type=1800 audit(1786085102.934:52): pid=7786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.602" name="nexus" dev="configfs" ino=14434 res=0 errno=0 [ 222.254833][ T7814] netlink: 'syz.0.609': attribute type 3 has an invalid length. [ 222.772519][ T7826] syzkaller0: entered promiscuous mode [ 222.778437][ T7826] syzkaller0: entered allmulticast mode [ 224.577975][ T7881] netlink: 'syz.1.625': attribute type 3 has an invalid length. [ 227.598421][ T7907] netlink: 'syz.2.634': attribute type 3 has an invalid length. [ 228.058982][ T7915] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 228.107593][ T7914] syzkaller0: entered promiscuous mode [ 228.135752][ T7914] syzkaller0: entered allmulticast mode [ 230.815424][ T7947] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 231.008900][ T7951] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 231.101216][ T7954] netlink: 'syz.0.650': attribute type 3 has an invalid length. [ 232.240001][ T7971] binder: 7970:7971 ioctl 4018620d 0 returned -22 [ 232.625229][ T7982] syzkaller0: entered promiscuous mode [ 232.631817][ T7982] syzkaller0: entered allmulticast mode [ 234.538500][ T7997] loop3: detected capacity change from 0 to 32768 [ 234.549396][ T7997] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.665 (7997) [ 234.590289][ T7997] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 234.609416][ T7997] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 234.618552][ T7997] BTRFS info (device loop3): turning off barriers [ 234.634005][ T7997] BTRFS info (device loop3): setting nodatasum [ 234.669092][ T7997] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 234.679064][ T7997] BTRFS info (device loop3): use zstd compression, level 3 [ 234.708623][ T7997] BTRFS info (device loop3): using free space tree [ 234.800662][ T60] BTRFS warning (device loop3): checksum verify failed on logical 5312512 mirror 1 wanted 0x6ee40500 found 0x6ee483f7 level 0 [ 234.815998][ T7997] BTRFS error (device loop3: state C): failed to load root csum [ 234.917477][ T7997] BTRFS error (device loop3: state C): open_ctree failed: -5 [ 235.697769][ T8016] 9pnet_virtio: no channels available for device syz [ 237.272147][ T8019] Mass Storage Function, version: 2009/09/11 [ 237.279320][ T8019] LUN: removable file: (no medium) [ 237.286966][ T8019] LUN: removable file: (no medium) [ 237.293878][ T8019] [ 237.296458][ T8019] ====================================================== [ 237.303660][ T8019] WARNING: possible circular locking dependency detected [ 237.310885][ T8019] syzkaller #0 Not tainted [ 237.315306][ T8019] ------------------------------------------------------ [ 237.322882][ T8019] syz.3.667/8019 is trying to acquire lock: [ 237.330176][ T8019] ffffffff8ddf7170 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: configfs_rmdir+0x63c/0x980 [ 237.341086][ T8019] [ 237.341086][ T8019] but task is already holding lock: [ 237.348548][ T8019] ffff88805cf31090 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: vfs_rmdir+0xee/0x4b0 [ 237.358581][ T8019] [ 237.358581][ T8019] which lock already depends on the new lock. [ 237.358581][ T8019] [ 237.369396][ T8019] [ 237.369396][ T8019] the existing dependency chain (in reverse order) is: [ 237.379335][ T8019] [ 237.379335][ T8019] -> #2 (&sb->s_type->i_mutex_key#20){++++}-{3:3}: [ 237.390438][ T8019] down_write+0x97/0x200 [ 237.395680][ T8019] configfs_depend_item_unlocked+0x157/0x430 [ 237.403298][ T8019] usbg_make_tpg+0x1f7/0x580 [ 237.409091][ T8019] target_fabric_make_tpg+0xa4/0x6d0 [ 237.415262][ T8019] configfs_mkdir+0x515/0x9e0 [ 237.420573][ T8019] vfs_mkdir+0x2a5/0x470 [ 237.425406][ T8019] do_mkdirat+0x1dc/0x450 [ 237.430259][ T8019] __x64_sys_mkdirat+0x89/0xa0 [ 237.435539][ T8019] do_syscall_64+0x55/0xb0 [ 237.440495][ T8019] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.446969][ T8019] [ 237.446969][ T8019] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 237.456501][ T8019] __mutex_lock+0x135/0xc80 [ 237.461975][ T8019] tcm_set_name+0x2a/0x90 [ 237.467371][ T8019] function_make+0x199/0x350 [ 237.472864][ T8019] configfs_mkdir+0x515/0x9e0 [ 237.478166][ T8019] vfs_mkdir+0x2a5/0x470 [ 237.482964][ T8019] do_mkdirat+0x1dc/0x450 [ 237.488095][ T8019] __x64_sys_mkdirat+0x89/0xa0 [ 237.493516][ T8019] do_syscall_64+0x55/0xb0 [ 237.499439][ T8019] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.507081][ T8019] [ 237.507081][ T8019] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 237.515437][ T8019] __lock_acquire+0x37ef/0x7d80 [ 237.521642][ T8019] lock_acquire+0x19e/0x420 [ 237.526763][ T8019] __mutex_lock+0x135/0xc80 [ 237.531798][ T8019] configfs_rmdir+0x63c/0x980 [ 237.537116][ T8019] vfs_rmdir+0x352/0x4b0 [ 237.541974][ T8019] do_rmdir+0x29f/0x590 [ 237.546658][ T8019] __x64_sys_rmdir+0x49/0x50 [ 237.551771][ T8019] do_syscall_64+0x55/0xb0 [ 237.556832][ T8019] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.563264][ T8019] [ 237.563264][ T8019] other info that might help us debug this: [ 237.563264][ T8019] [ 237.573495][ T8019] Chain exists of: [ 237.573495][ T8019] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#20 [ 237.573495][ T8019] [ 237.588483][ T8019] Possible unsafe locking scenario: [ 237.588483][ T8019] [ 237.596023][ T8019] CPU0 CPU1 [ 237.601403][ T8019] ---- ---- [ 237.606763][ T8019] lock(&sb->s_type->i_mutex_key#20); [ 237.612404][ T8019] lock(&opts->dep_lock); [ 237.619346][ T8019] lock(&sb->s_type->i_mutex_key#20); [ 237.627812][ T8019] lock(gadget_subsys.su_mutex); [ 237.632980][ T8019] [ 237.632980][ T8019] *** DEADLOCK *** [ 237.632980][ T8019] [ 237.641305][ T8019] 3 locks held by syz.3.667/8019: [ 237.646855][ T8019] #0: ffff88801fae6418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 237.656179][ T8019] #1: ffff8880767ef910 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: do_rmdir+0x1c6/0x590 [ 237.666677][ T8019] #2: ffff88805cf31090 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: vfs_rmdir+0xee/0x4b0 [ 237.677829][ T8019] [ 237.677829][ T8019] stack backtrace: [ 237.683947][ T8019] CPU: 1 PID: 8019 Comm: syz.3.667 Not tainted syzkaller #0 [ 237.691413][ T8019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.704067][ T8019] Call Trace: [ 237.707447][ T8019] [ 237.710717][ T8019] dump_stack_lvl+0x18c/0x250 [ 237.715416][ T8019] ? load_image+0x420/0x420 [ 237.719940][ T8019] ? show_regs_print_info+0x20/0x20 [ 237.725185][ T8019] ? print_circular_bug+0x12b/0x1a0 [ 237.730425][ T8019] check_noncircular+0x2fc/0x400 [ 237.735387][ T8019] ? print_deadlock_bug+0x5d0/0x5d0 [ 237.740588][ T8019] ? lockdep_lock+0xf5/0x230 [ 237.745379][ T8019] ? _find_first_zero_bit+0xd6/0x100 [ 237.750761][ T8019] __lock_acquire+0x37ef/0x7d80 [ 237.755636][ T8019] ? verify_lock_unused+0x140/0x140 [ 237.760931][ T8019] ? verify_lock_unused+0x140/0x140 [ 237.766141][ T8019] lock_acquire+0x19e/0x420 [ 237.770745][ T8019] ? configfs_rmdir+0x63c/0x980 [ 237.775641][ T8019] ? __might_sleep+0xe0/0xe0 [ 237.780257][ T8019] ? read_lock_is_recursive+0x20/0x20 [ 237.785917][ T8019] __mutex_lock+0x135/0xc80 [ 237.790612][ T8019] ? configfs_rmdir+0x63c/0x980 [ 237.795914][ T8019] ? configfs_rmdir+0x63c/0x980 [ 237.801044][ T8019] ? mutex_lock_nested+0x20/0x20 [ 237.806239][ T8019] ? __lock_acquire+0x7d80/0x7d80 [ 237.811355][ T8019] ? lockref_put_or_lock+0x72/0xb0 [ 237.816472][ T8019] ? dput+0x3b/0x1e0 [ 237.820368][ T8019] ? dput+0x3b/0x1e0 [ 237.824521][ T8019] configfs_rmdir+0x63c/0x980 [ 237.829323][ T8019] vfs_rmdir+0x352/0x4b0 [ 237.833715][ T8019] do_rmdir+0x29f/0x590 [ 237.837867][ T8019] ? __check_object_size+0x4fc/0xa40 [ 237.843257][ T8019] ? d_delete_notify+0x150/0x150 [ 237.848187][ T8019] ? getname_flags+0x20a/0x500 [ 237.852956][ T8019] __x64_sys_rmdir+0x49/0x50 [ 237.857559][ T8019] do_syscall_64+0x55/0xb0 [ 237.861987][ T8019] ? clear_bhb_loop+0x40/0x90 [ 237.866689][ T8019] ? clear_bhb_loop+0x40/0x90 [ 237.871389][ T8019] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.877325][ T8019] RIP: 0033:0x7f9f25b9e0d9 [ 237.881793][ T8019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.901414][ T8019] RSP: 002b:00007f9f269e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 237.909834][ T8019] RAX: ffffffffffffffda RBX: 00007f9f25e25fa0 RCX: 00007f9f25b9e0d9 [ 237.917815][ T8019] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000200 [ 237.925873][ T8019] RBP: 00007f9f25c35024 R08: 0000000000000000 R09: 0000000000000000 [ 237.933846][ T8019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 237.941824][ T8019] R13: 00007f9f25e26038 R14: 00007f9f25e25fa0 R15: 00007ffd9f738318 [ 237.949881][ T8019] [ 238.859829][ T5771] ffs_data_put(): freeing