last executing test programs: 2m31.234299754s ago: executing program 0 (id=132): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f) write$tun(r1, &(0x7f0000000180)=ANY=[], 0x97) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000400)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000480)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000500), 0x318, 0x0) recvmmsg(r3, &(0x7f0000000540), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xb, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000780)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newlink={0x3c, 0x10, 0x401, 0xfdfffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1243}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r7, {0x1}, {0xf, 0xf}, {0x3, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) r8 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCGSTAMP(r8, 0x8906, 0x0) bind$can_raw(r8, &(0x7f0000000200), 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r8, 0x65, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_raw(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@can={{0x4, 0x0, 0x0, 0x1}, 0x3, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x40040) 2m28.919758401s ago: executing program 0 (id=137): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="200000006c00010029bd7000ffdb633b6539c5aa0c"], 0x20}], 0x1, 0x0, 0x0, 0xd069d254564c1698}, 0xc000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f00000007c0)=ANY=[@ANYBLOB="9feb1b005ffc0000b11e0000020000005a2e"], 0x0, 0xfc5f}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000440), 0x8}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='&', @ANYRES16=r4], 0x50) ioctl$SIOCSIFHWADDR(r3, 0x8946, &(0x7f00000004c0)={'veth0_vlan\x00', @random='\x00\x00\x00\x00\x00 '}) sendmsg$unix(0xffffffffffffffff, 0x0, 0x40000d0) ioctl$XFS_IOC_ERROR_INJECTION(0xffffffffffffffff, 0x40085874, &(0x7f0000000680)={0xffffffffffffffff, 0x1}) ioctl$F2FS_IOC_DEFRAGMENT(0xffffffffffffffff, 0xc010f508, 0x0) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x49}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x3e, &(0x7f0000000e40)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd661d030000012cfffe8000000000000000000000000000aafe8000000000000000000000000000aa8700000700000000b86035141481de7622340a6a0ac7ee143680824461fc7004c0c528b1f2a037b6b5190f9dcbcde99e8c7bcc3c6081a1fcfc1a969c553d098a9463426ea3b74e7a1f0e9fba37595fab46ee4cd8dc76b0f1f1a1a6982672b74c3e8d6f9101356489056ce661d8388f89a6a9e6c7672d60f4d52a"], 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000006c0)='./cgroup.net/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000700), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f0000000740)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f0000000780), 0x12) sync() r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000005c0), 0x8502, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000600)=0xf) ioctl$TCFLSH(r8, 0x400455c8, 0x0) ioctl$int_out(r8, 0x2, &(0x7f0000000640)) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r9}, &(0x7f00000000c0), &(0x7f0000000100)=r2}, 0x20) recvmsg$unix(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/195, 0xc3}], 0x1}, 0x2000) shutdown(r1, 0x1) connect$unix(r1, &(0x7f0000000f00)=@file={0x0, './file0\x00'}, 0x6e) mmap$KVM_VCPU(&(0x7f000057d000/0x4000)=nil, 0x930, 0xf, 0x30, 0xffffffffffffffff, 0x0) 2m26.909797128s ago: executing program 0 (id=141): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f) write$tun(r1, &(0x7f0000000180)=ANY=[], 0x97) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000400)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000480)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000500), 0x318, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xb, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0xfffffffd}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000780)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newlink={0x3c, 0x10, 0x401, 0xfdfffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1243}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r7, {0x1}, {0xf, 0xf}, {0x3, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) r8 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$SIOCGSTAMP(r8, 0x8906, 0x0) bind$can_raw(r8, &(0x7f0000000200)={0x1d, r9}, 0x10) sendmsg$can_raw(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@can={{0x4, 0x0, 0x0, 0x1}, 0x3, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x40040) 2m25.387772863s ago: executing program 0 (id=145): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000003c0)={'syztnl1\x00', &(0x7f0000000340)={'syztnl0\x00', r1, 0x2f, 0x0, 0x0, 0x2, 0x21, @dev={0xfe, 0x80, '\x00', 0x33}, @local, 0x80, 0x40, 0xb, 0xffffff0a}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6(0xa, 0x800, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x6, &(0x7f0000000000), 0x0) close(r2) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e04, 0x101, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}, 0x10000}, 0x1c) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x9, &(0x7f0000000100)={[{@barrier}, {@jqfmt_vfsv0}, {@abort}, {}, {@noquota}, {@usrjquota, 0x2e}], [], 0x2e}, 0x6, 0x48d, &(0x7f0000000980)="$eJzs3EtvG1UbAOB3xnV6/5qv3wV6AQIFEXFJmrRAF2xAIHWDhARIZRnStCpNG9QEiVYVTREqS9RfACyR+AWsYIOAFYgtSGyQEFKFuqGwGjT2TOpcHGzHjil+HsntOTNnfM47M8c+MyfjAAbWSP5PErErIr4fithTzy4vMFL/79bNy9O/37w8nUSWvfRrUiv3283L02XRcrudRWY0jUjfTeLAGvXOX7x0dmp2duZCkR9fOPfG+PzFS4+fOTd1eub0zPnJY8eOHpl46snJJ7oS5+68rfvfnju47/ir11+YPnH9ta8+yZfvKtY3xlE33PJ7b2+yfCRGlu/LBg9F/JRlWct1/N3tbkgnW/rYENpSiYj8cFXz/h97ohK3D96eeP6dvjYO6Kksy7Ktq5ZWysRiBvyDJdF0VbqpDQE2WflFn1//lq9NHH703Y1n6hdAedy3ild9zZZIizLVFde33TQSEScW//ggf8Wa9yEAALrrs3z889ha4780/t9Q7l9Rnxsajoh/R8TeiPhPRPw3Iv4XUSt7V0Tc3Wb9Iyvyq8c/3zabXumKfPz3dDG3dXv8N1SLvzBcKXK7a/FXk1NnZmcOF/tkNKpb8/zEOnV8/tx37y9lti1f1zj+y195/eVYsC79ZcuKG3QnpxamuhB6zY2rS4GuGP8mSzMBSUTsi4j9Hbx/vs/OPPLxwWbr/zr+dXRhnin7KOLh+vFfjBXxl5L15yfHt8XszOHx8qxY7etvrr3YrP4Nxd8FN65G7Fh1/kdj/MNJ43ztfPt1XPvhvabXNJ2e/0PJy7X0ULHsramFhQsTEUPJ4urlk7e3LfNl+Tz+0UNrxZ/W3uPDYrsDEZGfxPdExL0RcV/R9vsj4oGIOLRO/F8+++DrncffW3n8J9s6/u0nKme/+LRZ/a0d/6O11GixpJXPv1YbuJF9BwAAAHeKtPY38Ek6tpRO07GxiFdq93Z3pLNz8wuPnpp78/zJ+t/KD0c1Le90pQ33QyeKe8NlfnJF/kjtvnGWZdn2Wn5sem62V3PqQGt2Nun/uZ8r/W4d0HNtzaM1e6INuCO11f9XPy0E3ME8rw2Dq9X+X+1xO4DN5/sfBtda/f9KxK0+NAXYZL7/YXDp/zC49H8YXPo/DKSNPNe/XmLv8Y43zzZUe/n7Kh1u/mNP9sZ6iUqnm29t42cOepCIdM1V1YjoS3vaSqS9qyI/+drbKj+QrRa+0umJ3XZi2cfEUD8+mwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrhzwAAAP//dNfhIw==") fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000e40)={0xffffffffffffffff, 0xffffffffffffffff, 0x16, 0x0, @val=@iter={0x0}}, 0x20) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r4, 0x402c542c, &(0x7f0000000140)={0x1e59, 0x1005a, 0xffff7002, 0x3, 0x6, "e9d30d0000000000000100", 0xfffffffc, 0x201}) r5 = syz_mount_image$f2fs(&(0x7f0000000400), &(0x7f0000000440)='./file1\x00', 0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="6163746976655f6c6f67733d342c646174615f666c7573682c66617374626f6f742c6a71666d743d76667376312c6e6f696e6c696e655f64656e7472792c7573726a71756f74613d66326673002c00ff371013587045d0d273e856ce75c2b11120ece6d6a76856a2cdd8c835ef14aa3aea583b7f3affd12ff9abc9b21098874a75607f009920ad1a283ce7b8b528e239692ab156e30dd8365f708e6c98cfcd0b30d5304dd70f87da026e2d4e4df1ad07ba72683f43d76541d455d1fa118f0900000009fe28bfded255e7c5806f05b80ec0e186b4f72759eb096a1fe6793e734fe61555f01ff9f23bc11370aa247215e8f1410ea4728bb2a2c2d20bc5e61b0a4c7ddb25da21c75f35f711581d1f5b8db3be07c80000000000000000"], 0x1, 0x54f4, &(0x7f0000000fc0)="$eJzs3M1rI2UYAPBn2u1+uxbx4G0HFqGFTdj0Y9Fb1V38wC7Fj4MnTZM0ZDfJlCZNa08ePIoH/xNR8OTRv8GDZ2/iQfEmKJmZ6tYvhKaNtb8fTJ6ZN2+eed5QCs9MmADOrfn0px+SuBFXImI2Iq5H5PtJueXWivBMRNyMiJnHtqQc/23gYkRcjYgb4+RFzqR865Pbo1ur37/245dfX7pw7dMvvpneqoFpezYietvF/l6viFm7iA/L8fqok8feyqiMxRu9R+VxVsS91maeYa9+OK+ex+V2MT/b3h2MY5LUG+PY7mzl49v94oSDUfswT/6Bh/Wd/LjZ2sxjZ5DlsX1Q1LV/UPxvOxgMizzNMt/7efoYDg9jMd7abxXr2X6Ux0Z/WI4XebNma38cR2UsTxeNrNvM69g8zjf93/Z6p7+7n45aO4NO1k9Xq7XnqrW7ldpO1mwNWyuVeq95dyVdaHfH0yrDVr231s6ydrdVbWS9xXSh3WhUarV04V5rs1Pvp7Vadbl6p7K6WO7dTl9+8HbabaYL4/hip7877HQH6Va2kxafWEyXqsvPL6a3aumb6xvpxhv3769vvPXuvXcevLD+6kvlpD+VlS4s3VlaqtTuVJZqi+do/R+WRU9w/XAsybQLADh79P/ANEyj/9/qTq7/D/3/RJyp/ve89/8nsH44Fv0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC59e3cZ6/kO/PF8bVy/ImIm+Ohp8rjJCJmIuKXvzAbF4/knC3zzP3N/Lk/1PBVEnmG8TkuldvViFgrt5+fPOlvAQAAAP6/Pv/g5sdFt168zE+7IE5TcdFm5vp7E8qXRMTc/HcTyjYzfnl6Qsnyv+8LsT+hbPkFrMsTSlZccrswqWz/yuyRcPmxkBRh5lTLAQAATsXRTuB0uxAAAABO00fTLoDpSOLwVubhveD8l/e/3xC8cuQIAAAAOIOSaRcAAAAAnLi8//+H5/+F5/8BAADA2Vc8/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiVnfvJSR2K4gB8Wuh7vD9GYpy7FWewDJfg0KFhAW6CJeAW3ABrwJlLMGBoS7QGE5PetpF8X9JebkN+nBIm515SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6NJzsZo/3l89tM3Z7tpJczcAAADAMZtiNS9fTKv5v/r6WX3pop5nEZFHxLHefRS/GpmjOqf44v3FpxqeIsqE/Wf8ro+/EXFdH6/nXX8LAAAAcLrWi+Ws6tar03ToguhTtWiT/79JlJdFRDF9SZSW70+XicLK3/c47hKllQtYk0Rh1ZLbOFXat4waw+TDkFVD3ms5AABAL5qdQL9dCAAAAH26HboAhpHFYSvzsBdc/vP+fUPwT2MGAAAA/EDZ0AUAAAAAnSv7f8//AwAAgNNWPf8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACALm2K1Xy9WM7a5mx37aS5GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgjf15R4EQCIMw2Lu+M5n7H1YaNDU1qQLh428MBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9uclBUIgCKJgzvjfSd//sJKgZxAhAhoeVdSiAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudu7nNY4qDgD4d2Z2trYqxig5RETBg17sdlNbe/WgBA/+CUJItzW69Ueagy1FyMWb5NyL6FFEUOKt/0PPLfRSbz3soYJnZWZnmmkacLV0Zpt8PvD2fWcY5n3fJIR8570EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA2eW8vzoqPhWmcVudu3b+2XvS39/WFGzt3lotWxEmbST8dXm0eJEvdJQIAAMDRkdX1fUTczXdXiz5dKOv/vL6mqPl/eH4a1/X8/rq/7uvav2i//3bv5QcDLUzHKW56YWM8OvVoKr0nN8v59sK/XtErn3z57iUrvyDph9svTfLyeSbf3bz5fr8Mj7WRLQDwf5ys+yqofx8q+mGXiQFwZPQahXdd/2cL3eYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0IbJdjxbx0lELPf24sLt+9fWD+pv7NxZrtvZ69d3mvcsbpFHxIWN8ehUi3OZd5evXP1sbTwebbYfvBYR3Y1eBR/PcE1ElxkKHjdIq+/1ecnn6Qg6/sEEAMChk1etqOvv5rurxblkMeLvHx+u/99sxDFj/X/vk7O3mmM16/9hazOcf4OtS18OLl+5+vbGpbWLo4ujz99ZGb47PH3uzJlzg/JdycAbEwAAAB5PP4no76v/08VH1/9PNOKYsf7/6vvhN82xMvX/gfYW/brOBAAA4Gh78fW//kwOOJ/0+/H12tbW5nD6WR3H5kp5vNJBqv/Zsao16/9sseusAAAAgDZMtpOH1v/PN+KYcf3/uZ9e+aV5zywijlfr/yfXvxifb286c62NPyfueo4AAAB063jVmuv/ebn/P32w5SGNiLfemMbVvwGcqf7PPvj25+ZYzf3/p9ub4lxKl6bPo+yXInpLXWcEAADAYfZM1Ypi/498d/XTX0981Lf/HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBt/wQAAP//K8ZAQg==") r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000064c0)='.\x00', 0x20000, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000006500)=0x20) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r5, 0xf507, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000180)=0x91) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) bind$inet6(r8, &(0x7f0000000200)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x50, &(0x7f0000000240)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "910100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x2, 0x3}, '\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000001c0)=0xa) syz_usb_connect$hid(0x6, 0x36, &(0x7f00000002c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x5543, 0x42, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x50, 0x6}}]}}, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x290, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0x0, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x10000000, 0x8000001}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) 2m23.977461438s ago: executing program 0 (id=152): syz_mount_image$ext4(&(0x7f00000022c0)='ext4\x00', &(0x7f0000002300)='./file1\x00', 0x2200002, &(0x7f0000002340)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000002400)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") openat(0xffffffffffffff9c, &(0x7f0000002980)='./file1\x00', 0x8541, 0x1a9) r0 = openat(0xffffffffffffff9c, &(0x7f00000029c0)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f0000002a00)='\f', 0x1, 0x8000c65) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000001c0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000200), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000280)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmmsg$inet(r7, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a'], 0x70}}], 0x1, 0x2000c044) write$binfmt_misc(r5, &(0x7f0000000380), 0xfffffecc) socket$nl_netfilter(0x10, 0x3, 0xc) splice(r4, 0x0, r6, 0x0, 0x4ffdd, 0xf) clock_gettime(0x0, &(0x7f0000004ac0)) openat(0xffffffffffffff9c, &(0x7f0000002a40)='./file1\x00', 0x101042, 0x15) 2m23.727696844s ago: executing program 0 (id=154): r0 = getgid() setfsgid(r0) setfsgid(0xee00) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000004bc0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x3, 0xffffffff}}, 0x10) bind$tipc(r1, &(0x7f0000004b40)=@name={0x1e, 0x2, 0x3, {{0x42}}}, 0x10) bind$tipc(r1, &(0x7f0000004b80)=@name={0x1e, 0x2, 0xfffffffffffffffe, {{0x42, 0x2}, 0x2}}, 0x10) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x80, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0601"]) read$FUSE(r3, &(0x7f0000000200)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000002240)={0x50, 0x0, r4, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r6 = memfd_create(&(0x7f0000004600)='-B\xd5NI\xc5j\x9a\b\x00\x00\x00\b\x84\xa2{\x00\v\x18\x004\x03\x96\x00\x00\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacvN}\xdanh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b&6\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\x003\x12\xd7\xdb\x93\xcc]x\xaa\x8f~\xb90a\xa9\xb2\x04=\xabQ\xf7\x05\x81\x01\xe5\x98\r\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x90\xcf\xb5\x7f\x00\x00\x00\x8d\xf0I{\xf0:\xd7\x802\xf3\r|\x86\x82\xf1\xb2\x06\xb0\x06\xbe\xb1\x0f\xa2\xa6\xedA\xb7\x0f\xda\x9d<\xd6l\xbcF\xcb\xec\x83#?\xf4\x81\x16+\x14\xc0\xb8\x88`W\xa9\xef\'\xe1\xee[\xac^\x00\x00\x00\x98a\xdaM\xfe\t\xfc\xfd\xb8S\x81\xe3', 0x1) r7 = dup(r6) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000004780)=@raw={'raw\x00', 0x9, 0x3, 0x300, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x3, &(0x7f0000004700), {[{{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0xff000000, 0xff, 0xffffff00], [0xff0000ff, 0xff, 0xffffffff], 'bond0\x00', 'lo\x00', {0xff}, {0xff}, 0x33, 0xff, 0x4, 0x1}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x7, 0x17, 0xd7, 'netbios-ns\x00', 'syz0\x00', {0x3c70}}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x3b}, @loopback, [0xff000000, 0xffffff00, 0xff000000, 0xff000000], [0x7f00007f, 0xff, 0xff], 'team_slave_1\x00', 'vlan0\x00', {}, {}, 0x8, 0xda, 0x2, 0x9}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @common=@mh={{0x28}, {'jB'}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x1, 0x4}, {0x2, 0x2, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x360) write$nbd(r7, &(0x7f0000004700)=ANY=[], 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) copy_file_range(r7, &(0x7f0000004740)=0xf, r7, 0x0, 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000004400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_VLAN(r8, &(0x7f00000044c0)={&(0x7f00000043c0)={0x10, 0x0, 0x0, 0x95127c9881cce4f9}, 0xc, &(0x7f0000004480)={&(0x7f0000004440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="280d2cbd7000fedbdf2512000000080034000600000005002f000000000005002e0001000008"], 0x2c}, 0x1, 0x0, 0x0, 0x20004000}, 0xc840) syz_fuse_handle_req(r3, &(0x7f00000022c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000042c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200002, &(0x7f0000004500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESOCT=r3, @ANYRESDEC=r5, @ANYBLOB=',group_id=', @ANYRESDEC=r0, @ANYBLOB="2c616c6c6f775f6fc6746865722c6d61785f726511b4e35a78303030303030303032396638626131362c61706973655f747970653d696d617369672c009888202719232b05e4c52cbc25162b267543160ff0297df4d3d5bdb0b5922d0e18c88946d96e9c74ca99"], 0x0, 0x0, &(0x7f0000008340)="63dcc12b1a23e8e293196e946758743744902b513e9c2a258ed31fff3a357878247247ac9f757659e7049d61ec7667750b3ddc5a4ea6aa6d67653a485d791d9fe0d8485ca2d62a0de20d34e60369c9a62b5ee1f7b931e016ff8ed8951963cfab03fa2c381702a6a2d70f8dceec7d492fea702cd2da2303a2f3ff887d52e60c608887930f87cd3c61d8fd26d9d2c5f381919622dc6c1e37a312a1a405496a5dc51299e84bbcd7ee81dfcb390a4ac4013213bec7cafbd70e60b77e9e1720") r10 = socket(0x2, 0x800, 0x300) sendmmsg(r10, &(0x7f0000006080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x80) 2m23.684374818s ago: executing program 32 (id=154): r0 = getgid() setfsgid(r0) setfsgid(0xee00) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000004bc0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x3, 0xffffffff}}, 0x10) bind$tipc(r1, &(0x7f0000004b40)=@name={0x1e, 0x2, 0x3, {{0x42}}}, 0x10) bind$tipc(r1, &(0x7f0000004b80)=@name={0x1e, 0x2, 0xfffffffffffffffe, {{0x42, 0x2}, 0x2}}, 0x10) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x80, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0601"]) read$FUSE(r3, &(0x7f0000000200)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000002240)={0x50, 0x0, r4, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r6 = memfd_create(&(0x7f0000004600)='-B\xd5NI\xc5j\x9a\b\x00\x00\x00\b\x84\xa2{\x00\v\x18\x004\x03\x96\x00\x00\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacvN}\xdanh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b&6\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\x003\x12\xd7\xdb\x93\xcc]x\xaa\x8f~\xb90a\xa9\xb2\x04=\xabQ\xf7\x05\x81\x01\xe5\x98\r\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x90\xcf\xb5\x7f\x00\x00\x00\x8d\xf0I{\xf0:\xd7\x802\xf3\r|\x86\x82\xf1\xb2\x06\xb0\x06\xbe\xb1\x0f\xa2\xa6\xedA\xb7\x0f\xda\x9d<\xd6l\xbcF\xcb\xec\x83#?\xf4\x81\x16+\x14\xc0\xb8\x88`W\xa9\xef\'\xe1\xee[\xac^\x00\x00\x00\x98a\xdaM\xfe\t\xfc\xfd\xb8S\x81\xe3', 0x1) r7 = dup(r6) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000004780)=@raw={'raw\x00', 0x9, 0x3, 0x300, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x3, &(0x7f0000004700), {[{{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0xff000000, 0xff, 0xffffff00], [0xff0000ff, 0xff, 0xffffffff], 'bond0\x00', 'lo\x00', {0xff}, {0xff}, 0x33, 0xff, 0x4, 0x1}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x7, 0x17, 0xd7, 'netbios-ns\x00', 'syz0\x00', {0x3c70}}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x3b}, @loopback, [0xff000000, 0xffffff00, 0xff000000, 0xff000000], [0x7f00007f, 0xff, 0xff], 'team_slave_1\x00', 'vlan0\x00', {}, {}, 0x8, 0xda, 0x2, 0x9}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @common=@mh={{0x28}, {'jB'}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x1, 0x4}, {0x2, 0x2, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x360) write$nbd(r7, &(0x7f0000004700)=ANY=[], 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) copy_file_range(r7, &(0x7f0000004740)=0xf, r7, 0x0, 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000004400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_VLAN(r8, &(0x7f00000044c0)={&(0x7f00000043c0)={0x10, 0x0, 0x0, 0x95127c9881cce4f9}, 0xc, &(0x7f0000004480)={&(0x7f0000004440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="280d2cbd7000fedbdf2512000000080034000600000005002f000000000005002e0001000008"], 0x2c}, 0x1, 0x0, 0x0, 0x20004000}, 0xc840) syz_fuse_handle_req(r3, &(0x7f00000022c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000042c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200002, &(0x7f0000004500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESOCT=r3, @ANYRESDEC=r5, @ANYBLOB=',group_id=', @ANYRESDEC=r0, @ANYBLOB="2c616c6c6f775f6fc6746865722c6d61785f726511b4e35a78303030303030303032396638626131362c61706973655f747970653d696d617369672c009888202719232b05e4c52cbc25162b267543160ff0297df4d3d5bdb0b5922d0e18c88946d96e9c74ca99"], 0x0, 0x0, &(0x7f0000008340)="63dcc12b1a23e8e293196e946758743744902b513e9c2a258ed31fff3a357878247247ac9f757659e7049d61ec7667750b3ddc5a4ea6aa6d67653a485d791d9fe0d8485ca2d62a0de20d34e60369c9a62b5ee1f7b931e016ff8ed8951963cfab03fa2c381702a6a2d70f8dceec7d492fea702cd2da2303a2f3ff887d52e60c608887930f87cd3c61d8fd26d9d2c5f381919622dc6c1e37a312a1a405496a5dc51299e84bbcd7ee81dfcb390a4ac4013213bec7cafbd70e60b77e9e1720") r10 = socket(0x2, 0x800, 0x300) sendmmsg(r10, &(0x7f0000006080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x80) 2m12.436149851s ago: executing program 3 (id=197): write$tun(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00446cfffe800000000088fc70738daf7b3200aaff020000000000000000000000000001"], 0xfdef) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = epoll_create1(0x80000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/wakeup_count', 0x0, 0x20) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)={0xe000001a}) sendfile(r0, r1, 0x0, 0x8) 2m12.224099123s ago: executing program 3 (id=200): io_setup(0x2, &(0x7f0000000180)=0x0) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x4f59, 0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x2}]) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0xe, &(0x7f0000000500)=ANY=[@ANYBLOB="b70200000000e6ccbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe02000000850000001a000000b7000000100000009500000000000000455781a5fee65e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde43a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d1106fb0289ce67a66afd92c3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a060000009b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece6d311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da326018362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f707777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee23483508818b897e3b677d3d342640e328504ae2dbf8fe1d704765de74891f7c8dae85739c50409c62040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528d46362ea0d8d79c79ddca066da478c1b7d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5f001000000100008000000000ed6f6663677df37de0ec0d0f548b273940be5d1fe0aae14d1a76e0741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ce0000000000000000000000000000000064d3210f806a4877e73c19072e358da1cdbef27967e918e6f2bab4a78ce0103a91789340b00db45df429d650e2f6acfbf9bf2f1b23064f3e60a9ded23b652f110940813a14c97abc84ab3cf728efd94ba2895a0884e7f7c53bc60d1b9768a979929055be8565b8a15dffc8692476ff03963b626afbc18750629666d1f449f02271064768c0731aeccb2c342ae3fa9956354e847f086eee8cd78617ad6ae28f121b23c1128b78f521eea8c487ae31f9112db0e671dd47d95ea9653e51da8c99a996656149a65f8e88032ddf35717407"], &(0x7f0000000900)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000940), 0xfffffffffffffd58, 0x10, &(0x7f0000000980), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x42) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="4eaa00000000000071101200000000009500000000000000753eebc4e2e0325385e7c6060b0ecf027b9025a554cd1969882221f9f98351b4db32cb1294306048e09cba1461c2764387a4646ba999cb9c3b6dbc6b100b5a2ffe8250b640a2d22f663adf5e1c8e9c0008a7cee5bd0224268ab783394d7cb5b219319edb5a5600f235c4"], &(0x7f00000001c0)='syzkaller\x00'}, 0x80) syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f00000003c0)='./bus\x00', 0xe, &(0x7f00000009c0)={[{}, {@oldalloc}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@block_validity}, {@jqfmt_vfsv1}]}, 0x3, 0x447, &(0x7f0000000a40)="$eJzs28tvG0UYAPBv10lKX8SU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlW0IFSOqBJ3xIEDEn8BJ7gg4ITEFe6oUoV6aeFktPZuYjt2mocTF/z7SdvO7M5q5vPu2DM72QD61kj2TxKxKyJ+j4jhera5wEj9v1s3Lk7/fePidBLV6lt/JbVyN29cnC6KFuftzDOjaUT6aRIH2tQ7f/7C6alKZfZcnh9fOPP++Pz5C8+eOjN1cvbk7NnJY8eOHpl44fnJ57oSZ9amm/s/mju477V3rr4xffzquz9/mxTxt8TRJSMrHXyiWu1ydb21uyGdDPSwIaxJKSKyyzVY6//DUYqlizccr37S08YBm6parVZ3dj58uQr8jyXR6xYAvVH80Gfz32LboqHHHeH6S/UJUBb3rXyrHxmINC8z2DK/7aaRiDh++Z8vsy025zkEAECT77PxzzPtxn9p3N9Q7u58bagcEfdExJ6IuDci9kbEfRG1sg9ExINrrL91kWT5+Ce9tq7AVikb/72Yr201j/+K0V+US3ludy3+weTEqcrs4fwzGY3BbVl+YoU6fnjlt887HWsc/2VbVn8xFszbcW1gW/M5M1MLUxuJudH1jyP2D7SLP1lcCUgiYl9E7F9nHaee+uZgp2O3j38FXVhnqn4V8WT9+l+OlvgLycrrk+N3RWX28HhxVyz3y69X3uxU/4bi74Ls+u9oe/8vxl9OGtdr59dex5U/Pus4p1nd/V+91HhOdv8PJW/X0kP5vg+nFhbOTUQMJa/XG924f3Lp3CJflM/iHz3Uvv/viaVP4kBEZDfxQxHxcEQ8krf90Yh4LCIOrRD/Ty8//t76499cWfwza7r+S4mhaN3TPlE6/eN3TZWW1xJ/dv2P1lKj+Z7VfP+tpl3ru5sBAADgvyeNiF2RpGOL6TQdG6v/vfze2JFW5uYXnj4x98HZmfo7AuUYTIsnXcMNz0Mn8ml9kZ+M+LoxfyR/bvxFaXstPzY9V5npdfDQ53Z26P+ZP0u9bh2w6byvBf1L/4f+pf9D/9L/oX+16f/be9EOYOu1+/2/1IN2AFuvpf9b9oM+Yv4P/Uv/h/6l/0Nfmt8et39JXkJiWSLSO6IZEt1JpBHRtGf5d0W5F19QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG/RvAAAA//831udB") r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000ec0)=@base={0x1, 0x4, 0x40, 0x40, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f80), &(0x7f0000000fc0), 0x1003, r2}, 0x38) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000001000)={r2, &(0x7f0000001040), &(0x7f0000001080)=""/31}, 0x20) 2m11.246524793s ago: executing program 3 (id=202): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x10, 0x10, 0x2}, 0x50) r2 = openat$cgroup_type(r1, &(0x7f0000000080), 0x2, 0x0) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1e9100, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, 0x0) io_pgetevents(0x0, 0x2, 0x0, 0x0, 0x0, 0x0) syz_btf_id_by_name$bpf_lsm(0x0) r4 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) syz_clone(0x40004100, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f00000001c0)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) sendmsg$key(r0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r7, 0x0, 0x0) socket$inet6(0xa, 0x80003, 0x6) 2m10.170992924s ago: executing program 3 (id=209): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=@can_newroute={0x14, 0x18, 0x1, 0x70bd27, 0x25dfdbff, {0x1d, 0x1, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x4004000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8b}, 0x0) getpid() r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0xfffffffb}, 0x10) sendmsg$nl_route(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@getlink={0x28, 0x12, 0x2fa9ccd93d5c0097, 0x70bd3d, 0x0, {0x7, 0x0, 0x0, 0x0, 0x14400, 0x3}, [@IFLA_NUM_TX_QUEUES={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x300884c, &(0x7f0000000600)={[{@debug}]}, 0x3, 0x515, &(0x7f0000000640)="$eJzs3V9oHHkdAPDvbJOY6+W6FQ7U49Cg4B2eJm2T63kcyB34j3optfFFGyhJu01CN9mQbLSJoBWLFHzxSYRK0T4oiGJ87JuKoMWiD4WiL6VIQS20harPkdnd6YVk02zbdCdJPx+Yzm9+2+zvO/PNbGZ+O/ObAJ5ZvRHxdkTsiojXIqLYqC80pjhbn9L/NzawNJFOSSwvD99LIomIQwNLE9l7JY358403eDUift+ZxNi5te3OLSyeHi2XS7ON5f7q1Ez/3MLipyanRsdL46XpgTff+PTBgdcHDw5s2rreHD029cvK0Fs/u334Nx/++CfuJfF29DReW7kem6U3ehvbpDNeWPlCEvH1zW4sZ90ryklHjoHQsj+/8fIP844BAGi/QuPYv6N2/F+MXVE/eOu+NnK/GLf+st7PHRq5+O92xgkAAAA8vuXljzTmAAAAwM6VOPcHAACAHS67DuDQwNJENrXr2oPbX2hXS6znzjsRsbee/+z+7vorHY17erujMyJ2/yeJlbf1Jqvu+X0c1c9F9MY3/lg9+4NT6RRP6T5stqalf+QdAXnqGsw7AvL00pfzjoA8/fV83hGQp2t38o6APB0dzjsC8nT4YN4RkKcL9/KOgN++Ux8AcG3/X6E25l/Wy7O6/yctP/eEbd8tRPRG969W1un/aa+s/29sTf9f4UH/3651+v/2tNjG5a9d/1Cz+i9+Nc3/8FjW//fJkR+X0vbT+ROvGC25852Ilzqa5T95kP9knfwXW2zjD1cHm/b0/25Pmv+f/yLNdzbJf3st/zTilWie/0zy8PFZ+09Nlkv76v82beOj9//5v2b1039L83/lM9n+n05p+9l3ATx96f6/e538b/T5v7fFNi5N3mra0zvck+b/lW89PP+F213JV2q/jF2NmjOj1ers/oiu5N219QcedQs8W7JtlG3DNP+vfqz53/8P1ubNP//T34n3t9jmu8cKbzWrH/x1mv/vf97+n580/yc32P/X+/v/YqttXL852qx+4rNp/o9ekn8AAAAAAAAAeDKFiOiJpND3oFwo9PXVn+H9YuwulCtz1ddOVeanT0btWdl7o7OQXelVrC8n6fL+xvVA2fKBVcsDjetFzhefqy33naiUT+a98gAAALDD9UTcOPbdyx94ftX5/7+K9fN/AAAAYPtLz/9f/snFC2n5v60O5AMAAABsK+n5//3v3b0Szv8BAABgx+rpdv4PAAAAO132/f+RoaE4MjS0nD33b7oyPnl6YubNA/v6puZP9J2ozM70jVcq47UR+6Y2ft9ypTKz//WYP9NfLc1V++cWFo9PVeanq8drz409Xupsw7oBGzv398sjeccAAAC0T8864/+/sGLs/n0RsScirhY735eN9Q8AAABsfT0RN770o2/+aW5h8fRouVyaVXjUwvK3I7ZAGAprCtlFJlslnm1ZyPkDCgAA2HTvHfTnHQkAAAAAAAAAAAAAAAAAAAA8u9oxnFje6wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD28f8AAAD//0FW/Wk=") r4 = openat(r3, &(0x7f0000000b80)='./file1\x00', 0x42, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000bc0)={0x400, 0x3ff, 0x6, 0x7, 0x9, 0xa7}) connect$unix(0xffffffffffffffff, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000c40)='./trace\x00', &(0x7f0000000c80)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000cc0)='./trace/error_log\x00', 0x1a1481, 0x168) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = socket$tipc(0x1e, 0x1, 0x0) bind$tipc(r5, &(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000340), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000380), 0x80002c1, 0x2, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x7, 0xb}, {0xe, 0x6}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x2, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) 2m8.422343233s ago: executing program 3 (id=217): syz_mount_image$ext4(&(0x7f00000022c0)='ext4\x00', &(0x7f0000002300)='./file1\x00', 0x2200002, &(0x7f0000002340)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000002400)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000002980)='./file1\x00', 0x8541, 0x1a9) r1 = openat(0xffffffffffffff9c, &(0x7f00000029c0)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f0000002a00)='\f', 0x1, 0x8000c65) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000001c0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000200), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000280)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmmsg$inet(r7, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a'], 0x70}}], 0x1, 0x2000c044) write$binfmt_misc(r5, &(0x7f0000000380), 0xfffffecc) socket$nl_netfilter(0x10, 0x3, 0xc) splice(r4, 0x0, r6, 0x0, 0x4ffdd, 0xf) syz_open_dev$tty1(0xc, 0x4, 0x1) clock_gettime(0x0, &(0x7f0000004ac0)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r0, 0x28, 0x6, &(0x7f0000004b00)={r8, r9/1000+60000}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000002a40)='./file1\x00', 0x101042, 0x15) 2m3.443342123s ago: executing program 3 (id=230): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f) write$tun(r1, &(0x7f0000000180)=ANY=[], 0x97) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000400)=0x5) connect$unix(0xffffffffffffffff, &(0x7f0000000480)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000500), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xb, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0xfffffffd}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000780)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newlink={0x3c, 0x10, 0x401, 0xfdfffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1243}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0xf, 0xf}, {0x3, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$SIOCGSTAMP(r6, 0x8906, 0x0) bind$can_raw(r6, &(0x7f0000000200)={0x1d, r7}, 0x10) sendmsg$can_raw(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@can={{0x4, 0x0, 0x0, 0x1}, 0x3, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x40040) 2m3.338917074s ago: executing program 33 (id=230): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f) write$tun(r1, &(0x7f0000000180)=ANY=[], 0x97) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000400)=0x5) connect$unix(0xffffffffffffffff, &(0x7f0000000480)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000500), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xb, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x4, &(0x7f0000000740)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0xfffffffd}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000780)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newlink={0x3c, 0x10, 0x401, 0xfdfffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1243}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0xf, 0xf}, {0x3, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$SIOCGSTAMP(r6, 0x8906, 0x0) bind$can_raw(r6, &(0x7f0000000200)={0x1d, r7}, 0x10) sendmsg$can_raw(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@can={{0x4, 0x0, 0x0, 0x1}, 0x3, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x40040) 51.417491138s ago: executing program 1 (id=453): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x10, 0x10, 0x2}, 0x50) r2 = openat$cgroup_type(r1, &(0x7f0000000080), 0x2, 0x0) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1e9100, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, 0x0) io_pgetevents(0x0, 0x2, 0x0, 0x0, 0x0, 0x0) syz_btf_id_by_name$bpf_lsm(0x0) r4 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) mkdir(0x0, 0x0) syz_clone(0x40004100, 0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180), 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)=0x1, 0x12) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) sendmsg$key(r0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000740)={{{@in=@broadcast, @in6=@dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x8, 0x2, 0x0, 0x1000000000000}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private=0xffffffff, 0x20000000, 0x6c}, 0xa, @in=@rand_addr=0x64010101, 0xfffffffc, 0x0, 0x3, 0x7}}, 0xe8) 50.786785592s ago: executing program 1 (id=458): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002100, &(0x7f0000002900)={0x77359400}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) creat(&(0x7f00000012c0)='./bus\x00', 0xf3) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x2000003, 0x2013, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 47.88138676s ago: executing program 1 (id=474): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_IOC_CATATONIC(r2, 0x9362, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x1, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x14318}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x6}]}]}]}, 0x44}}, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x400, 0x126) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000e80), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000fd4000/0x18000)=nil, &(0x7f0000000ec0)=[@text64={0x40, 0x0}], 0x1, 0xc, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0xe, &(0x7f0000000240)=ANY=[@ANYBLOB="b7000000f8000000bfa300000000000007030000f4ffffff620af0fff8ffffff71a4f0ff000000002d100200000000001d400200000000004704000001ed000062030000000700001d440000000000007a0a00fe00ffffffc3030000e10000009f000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028af0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00672f0814bf895e3a6dfbc711243f58a817895f5c4eaf7de8411a831ef65508f416ae3fd1db8386f6aae40515273adcff6196bb45476ec0a5279ed223f772aee25947b1f0d275c0e495b050f10a0b5d19b578a2b4096b9df527211bb39a29224c34a517dc344a195697b0c158d3519c04fe7621ebeef0bc369a1431a90c4117bdfe358e0e869e9f3e5443813261c1c3c78ab2584603e4468de7d0dc93691491050666f4ea5f083a1b281ed230569921856befe07538fbf33f43fa4ad583867bee301ae1e2566ae7a7afb7fc54895a2fef928d91a162affb4d373c7628a2871d7d19eaf06ed5f58f799c8ff391d3752b115073702ee257ade173dd2f736ed5939f219ba42f7650b9a262f6ee4af52aba3e669a835555ea1674f89d7f98ee1a1c7f977e0a93fdf91606d01c1a9dacfd4328502948bed0bc9514e4f66846bc1f245aa5abad88d56679092fee01007cade7ee72a49a498d51a26ba5cf0896cd9143d457262976f682bf31833ee99b5301f349dd2815e76a8b9a6cec5e000bd6bdafcb9536379b6cd0351cfe345abb1f"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000e00), 0x8, 0x10, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0xffffffff}, 0x10}, 0x94) close(r1) ioctl$KVM_GET_SREGS(r5, 0x8138ae83, &(0x7f0000000f00)) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) 47.061131175s ago: executing program 1 (id=481): syz_mount_image$ext4(&(0x7f00000022c0)='ext4\x00', &(0x7f0000002300)='./file1\x00', 0x2200002, &(0x7f0000002340)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000002400)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") openat(0xffffffffffffff9c, &(0x7f0000002980)='./file1\x00', 0x8541, 0x1a9) r0 = openat(0xffffffffffffff9c, &(0x7f00000029c0)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f0000002a00)='\f', 0x1, 0x8000c65) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000001c0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000200), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000280)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmmsg$inet(r7, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a'], 0x70}}], 0x1, 0x2000c044) write$binfmt_misc(r5, &(0x7f0000000380), 0xfffffecc) splice(r4, 0x0, r6, 0x0, 0x4ffdd, 0xf) syz_open_dev$tty1(0xc, 0x4, 0x1) 46.126218741s ago: executing program 1 (id=487): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x100b, 0x3}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x23, 0x0, 0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r3) write(0xffffffffffffffff, &(0x7f00000007c0)="2400000058004f0f9c00f4f90085b3a85c91fddf080001000501009f0800028001010000", 0x24) sendmsg$nl_route(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="440000001000010027bd70010000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000021000008001b00000000001c001a80130002800c0001"], 0x44}, 0x1, 0x0, 0x0, 0xc4}, 0x0) renameat(0xffffffffffffffff, &(0x7f00000008c0)='.\x00', 0xffffffffffffffff, &(0x7f0000002a80)='./file0\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000280)=[@acquire], 0xffffffffffffff47}) dup3(r1, r0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x100, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1500000008000000010001000900000001000000", @ANYRES32, @ANYBLOB="f8ffff02e364d700"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond_slave_0\x00'}) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0) write$9p(0xffffffffffffffff, &(0x7f0000000040)="ca360cc5516b5bd1be1a103c8bfd9d8fb52e83d283b4f58bf69941041bb4", 0x1e) 45.83578168s ago: executing program 1 (id=488): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYRESDEC, @ANYRES16], 0x54}}, 0x24000041) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x2, 0x3e0, 0x1f8, 0x2f8, 0x1f8, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'vxcan1\x00', 'nr0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac, @broadcast}}}, {{@arp={@remote, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg\x00', 'vcan0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "dcbc4f0fcafe5fd600342efa7968d220b64d039e8a81d171eeb2e9630554"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) socket$inet6(0xa, 0x2, 0xffffffff) syz_usb_connect(0x4, 0x0, 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x1, 0x152d, &(0x7f0000000780)="$eJzs3AucjdX6OPDnWWu9Y0jaTXIZ1lrPy04uiyTJJUkuSZIkSW4JSZMcSUgMuSUNSUguQ3IPyWVi0rjf75eEJGmSJCS3ZP0/E/NXp87/dM7p5Pf/zfP9fPZn1trrfdb7vPuZd+/3XZv5pvOQGo1qVm1ARPAfwYs/EgEgFgAGAMA1ABAAQNm4snEZ49klJv5nO2F/roemXekM2JXE9c/auP5ZG9c/a+P6Z21c/6yN65+1cf2zNq4/Y1nZ5un5r+VH1n3w+n9Wxp///4uklxzzxdqS13cBiPmjIVz////hfxDL9f9fK/gjG3H9szauf1YVe6UTYP8D8PmfFWT7hyNc/6yN689YVvbLteBYuPLr0X/1AyL/ze9AfM+Lr/KVP85/ePyMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxthf4Iy/TAFAZvtK58UYY4wxxhhjjLE/j892pTNgjDHGGGOMMcbYfx+CAAkKAoiBbBAL2SEHCICYzPFrIQ6ug9xwPeSBvJAP8kM8FICCoMGABYIQCkFhiMINUARuhKJQDIpDCXBQEkrBTVAaboYycAuUhVuhHNwG5aECVIRKcDtUhjugCtwJVeEuqAbVoQbUhLuhFtwDteFeqAP3QV24H+rBA1AfHoQG8BA0hIehETwCjeFRaAJNoRk0hxb/VvwL0B1ehB7QExKhF/SGl6AP9IV+0B8GwMswEF6BQfAqJMFgGAKvwdAg87UYASPhTRgFb8FoGANjYRwkw3iYAG/DRHgHJsFkmAJTYRpMhxnwLsyEWTAb3oM58D7MhXkwHxZACnwAC2ERpMKHsBg+gjRYAkthGSyHFbASVsFqWANrYR2shw2wETbBZtgCW2EbbIcdsBM+hl3wCeyGPbAXPoV98Nm/GH/67+K7ICCgQIEKFcZgDMZiLObAHJgTc2IuzIURjGAcxmFuzI15MA/mw3wYj/FYEAuiQYOEhIWwEEYxikWwCBbFolgci6NDh6UQsDTejGWwDJbFslgOy2F5rIAVsBJWwspYGatgFayKVbEaVsMaWAPvxruxF9bG2lgH62BdrJu5PIUNsAE2xIbYCBthY2yMTbAJNsNm2AJbYEtsia2wFbbBNtgW22I7bIcJmIDtsT12wA7YETtiJ+yEnbEzdsGu2DX9hWyAL+KL2BOriV7YG3tjH0zK1g/7Y398GQfiK/gKvopJOBiH4Gv4Gr6Ow/AUDr8wAkfiSKws3sLROAZJjMNkTMYJOAEn4kSchJNxMk7FaTgdZ+AMnImzcBa+h3PwfXwf5+E8XIApmIILcRGmYiouxtOYhktwKS7D5bgCl+MqXI2rcC2uw7W4ATfgJtyEW3ALbsNtuAN34MeoAPAT3IN7MAn34T7cj/vxAB7Ag3gQ0zEdD+EhPIyH8QgewaN4FI/hcTyBx/EknsRTeBrP4Bk8h+fwPD4X/1XDj4utSQKRQQklYkSMiBWxIofIIXKKnCKXyCUiIiLiRJzILXKLPCKPyCfyiXgRLwqKgsIII0iEGe8UIiqioogoIoqKoqK4KC6ccKKUKCVKi9KijCgjyopbRTlxmygvKojWrpKoJCqLNq6KuFNUFVVFNVFd1BA1RU1RS9QStUVtUUfUEXVFXVFPPCDqi17YDx8SGZVpJAZjYzEEm4imQl46K1uKYdhKtBZtxBNiBA7HdqKlSxBPi/ZiNHYQfxNj8FnRSYzDzuJ50UV0Fd3EC6K7aOV6iJ5iEvYSvcVU7CP6in6iv5iJ1cV7OCd7DfGqSBKDxRDxmliAr4th4g0xXIwQI8WbYpR4S4wWY8RYMU4ki/FignhbTBTviElispgipoppYrqYId4VM8UsMVu8J+aI98VcMU/MFwtEivhALBSLRKr4UCwWH4k0sUQsFcvEcrFCrBSrxGqxRqwV68R6sUFsFJvEZrFFbBXbxHaxQ+wUH4td4hOxW+wRe8WnYp/4TOwXn4sD4gtxUHwp0sVX4pD4WhwW34gj4ltxVHwnjonj4oT4XpwUP4hT4rQ4I86Kc+JHcV78JC4IL0CiFFJKJQMZI7PJWJld5pBXyZwy803vWhknr5O55fUyj8wr88n8Ml4WkAWllkZaSTKUhWRhGZU3yCLyRllUFpPFZQnpZElZSt4kS8ubZRl5iywrb5Xl5G2yvKwgK8pK8nZZWd4hIXJxH9VkdVlD1pR3y0S4R9aW98o68j5ZV94v68kHZH35oGwgH5IN5cOykXxENpaPyiayqWwmm8sW8jHZUj4uW8nWso18QraVT8p28imZIJ+W7aW/9CvyrOwkn5Od5fOyi+wqu8mf5AXpZQ/ZU0IvkL3lS7KP7Cv7yf5ygHxZDpSvyEHyVZkkB8sh8jU5VL4uh8k35HA5Qo6Ub8pR8i05Wo6RY+U4mSzHywnybTlRviMnyclyipwqp8npst+lmWZL+U/j3/6d+EE/732T3Cy3yK1ym9wud8id8mO5S+6Su+VuuVfulfvkPrlf7pcH5AF5UB6U6TJdHpKH5GF5WB6RR+RReVQek8flWfm9PCl/kKfkaXlanpXn5Dl5/tJrAAqVUFIpFagYlU3Fquwqh7pK5VRXq1zqGhVR16o4dZ3Kra5XeVRelU/lV/GqgCqotDLKKlKhKqQKq6i6AS/9wqjiqoRyqqQqpW76V+JVEXWjKqqK/So+M7/Ef5BfC9VCtVQtVSvVSrVRbVRb1Va1U+1UgkpQ7VV71UF1UB1VR9VJdVKdVWfVRXVR3VQ31V11Vz1UD5WoElVv9ZLqo/qqfqq/GqBeFhnHMEgNUkkqSQ1RQ9RQNVQNU8PUcDVcjVQj1Sg1So1Wo9VYNVYlq2Q1QU1QE9VENUlNUlPUFDVNTVMz1Aw1U81Us9VsNUfNUXPVXDVfzVcpKkUtVAtVqkpVi9VilaaWqCVqmVqmVqgVapVapdaoNWqdWqc2qA0qTW1Wm9VWtVVtV9vVTrVT7VK71G61W+1Ve9U+tU/tV/vVAXVAHVQHVbpKV4fUIXVYHVZH1BF1VB1Vx9QxdUKdUCfVSXVKnVJn1Bl1Tp1T59V5dUFdyLjsC0QgAhWoICaICWKD2CBHkCPIGeQMcgW5gkgQCeKCuCB3cH2QJ8gb5AvyB/FBgaBgoAMT2EBcKno0uCEoEtwYFA2KBcWDEoELSgalgpuC0sHNQZnglqBscGtQLrgtKB9UCCoGlYLbg8rBHUGV4M6ganBXUC2oHtQIagZ3B7WCe4Lawb1BneC+oG5wf1AveCCoHzwYNAgeChoGDweNgkeCxsGjQZOgadAsaB60+FPn9/5U3sddD91TJ+peurd+SffRfXU/3V8P0C/rgfoVPUi/qpP0YD1Ev6aH6tf1MP2GHq5H6JH6TT1Kv6VH6zF6rB6nk/V4PUG/rSfqd/QkPVlP0VP1NJ1xiryrZ+pZerZ+T8/R7+u5ep6erxfoFP2BXqgX6VT9oV6sP9Jpeoleqpfp5XqFXqlX6dV6jV6r1+n1eoPeqDfpzXqL3qq36e16h96pP9a79Cd6t96j9+pP9T79md6vP9cH9Bf6oP5Sp+uv9CH9tT6sv9FH9Lf6qP5OH9PHdRn9vT6pf9Cn9Gl9Rp/V5/SP+rz+SV/QPuPiPuPj3SijTIyJMbEm1uQwOUxOk9PkMrlMxERMnIkzuU1uk8fkMflMPhNv4k1BU9BkIEOmkClkoiZqipgipqgpaoqb4sYZZ0qZUqa0KW3KmDKmrClryplyprwpbyqaiuZ2c7u5w9xh7jR3mrvMXaa6qW5qmpqmlqllapvapo6pY+qauqaeqWfqm/qmgWlgGpqGppFpZBqbxqaJaWKamWamhWlhWpqWppVpZdqYNqataWvamXYmwSSY9qa96WA6mI6mo+lkOpnOprPpYrqYbqab6W66mx6mh0k0iaa36W36mD6mn+lnBpgBZqAZaAaZQSbJJJkhZogZaoaaYWaYGW5GmJEZF6rmLTPajDFjzTiTbJLNBDPBTDQTzSQzyWTeTs0wM8xMM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXvp89KbWJvd5rBX2Zz2apvLXmP/vp/P5rfxtoAtaLXNY/P+qm+stUVtMVvclrDOlrSl7E2/6Ze3FWxFW8nebivbO2yV3/Rr2XtsbXuvrWPvszXt3b/q17X323r2EVsfEcA2tQ1tc9vIPmIb20dtE9vUNrPNbVv7pG1nn7IJ9mnb3j7zm/5Cu8iutmvsWrvO7rZ77Bl71h6239hz9kfbw/a0A+zLdqB9xQ6yr9okO/g3/ZH2TTvKvmVH2zF2rB33m/4UO9VOs9PtDPuunWln/aafYj+wc2yqnWvn2fl2wc/9jJxS7Yd2sf3IptkAltpldrldYVfaVf8312V2g91oN9ld9hO71W6z2+0OuzPzQtjusXvtp3af/cwesl/bA/YLe9Aesen2q5/7Gcd3xH5rj9rv7DF73J6w39uT9geVGZ1x7N/bn+wF6y0QEpAkRQHFUDaKpeyUg66inHQ15aJrKELXUhxdR7npespDeSkf5ad4KkAFSZMhS0QhFaLCFKUbKDO94lSCHJWkUnQTlaabqQzdQmXpVipHt1F5qkAVqRLdTpXpDqpCd1JVuouqUXWqQTXpbqpF91Btupfq0H1Ul+6nevQA1acHqQE9RA3pYWpEj1BjepSaUFNqRs2pBT1GLelxakWtqQ09QW3pSWpHT1ECPU3t6RnqQH+jjvQsdaLnqDM9T12oK3WjF6g7vUg9qCclUi/qTS9RH+pL/ag/DaCXaSC9QoPoVUqiwTSEXqOh9DoNozdoOI2gkfQmjaK3aDSNobE0jpJpPE2gt2kivUOTaDJNoak0jabTDHqXZtIsmk3v0Rx6n+bSPJpPCyiFPqCFtIhS6UNaTB9RGi2hpbSMltMKWkmraDWtobW0jtbTBtpIm2gzbaGttI220w7aSR/TLvqEdtMe2kuf0j76jPbT53SAvqCD9CWl01d0iL6mw/QNHaFvfU/6jo7RcTpB39NJ+oFO0Wk6Q2fpHP1I5+knukCeIMRQhDJUYRDGhNnC2DB7mCO8KswZXh3mCq8JI+G1YVx4XZg7vD7ME+YN84X5w/iwQFgw1KEJbUhhGBYKC4fR8IawSHhjWDQsFhYPS4QuLBmWCm8KS4c3h2XCW8Ky4a1hufC2sHxYIXzkvkrh7WHl8I6wSnhnWDW8K6wWVg9rhDXDu8Na4T1h7fDesE54X1gmvD+sFz4Q1g8fDBuED4UNw4fDRuEjYePw0bBJ2DRsFjYPW4SPhS3Dx8NWYeuwTXhV2DZ8MmwXPhUmhE+H7cNnfh6/f1Hm+BO/GU8Me4W9w5fCl0Lv75XzowuiKdEPoguji6Kp0Q+ji6MfRdOiS6JLo8uiy6Mroiujq6Kro2uia6ProuujG6Ibo5ui3tfMBg6dcNIpF7gYl83Fuuwuh7vK5XRXu1zuGhdx17o4d53L7a53eVxel8/ld/GugCvotDPOOnKhK+QKu6i7wRVxN7qirpgr7ko450q6Uq65a+FauJbucdfKtXZt3BPuCfeke9I95Z5yT7v27hnXwf3NdXTPuk7uOfece951cV1dN/eC6+7G57p4Tia63q636+P6uH6unxvgBriBbqAb5Aa5JJfkhrghbqgb6oa5YW64G+5GupFulBvlRrvRbqwb65JdspvgJriJbqKb5Ca5KW6Km+amuRluhpvpZrrKsy7uZa6b6+a7+S7FpbiFLuOaMdUtdotdmktzS91St9wtdyvdSrfarXZr3Vq33q13G91Gt9ltdlvdVrfdbXc73U63y+1yu/01Fyd1+9x+t98dcAfcQfelS3dfuUPua3fYfeOOuG/dUfedO+aOuxPue3fS/eBOudPujDvrzrkf3Xn3k7vgvEuOjI9MiLwdmRh5JzIpMjkyJTI1Mi0yPTIj8m5kZmRWZHbkvcicyPuRuZF5kfmRBZGUyAeRhZFFkdTIh5HFkY8iaZElkaWRZZHlkRUR7wtsDX0hX9hH/Q2+iL/RF/XFfHFfwjtf0pfyN/nSF/NO8/5WX87f5sv7Cr6if9Q38U19M9/ct/CP+Zb+cd/Kt/Zt/BO+rX/St/NP+QT/tG/vn/Ed/N98R/+s7+Sf8539876L7+q7+Rd8d/+i7+F7+kTfy/f2L/k+vq/v5/v7Af5lP9C/4gf5V32SH+yH+Nf8UP+6H+bf8MP9CD8y5k0/KvMWGcb5ZD/eT/Bv+4n+HT/JT/ZT/FQ/zU/3M/y7fqaf5Wf79/wc/76f6+f5+X6BT/Ef+IV+kU/1H/rF/iOf5pdkLpT6lX6VX+3X+LV+nV/vN/iNfpPf7Lf4rX6b3+53+J3+Y7/Lf+J3+z1+r//U7/Of+f3+c3/Af+EP+i99uv/KH/Jf+8P+G3/Ef+uP+u/8MX/cn/Df+5P+B3/Kn/Zn/Fl/zv/oz/uf/AX+P2uMMcYYY3/I+MtN8euRi8v5vX4nRvxi494AcPW2/Om/HM+4olyf52K7r4iPzfj5dM/OD2U+qlVLTEy8tG2ahKDwPIDMb4Iy/LxWdqm/BNrAk5AAraH07+bfV3Q9R/9k/uitADl+EZORUGb/8vyfA2Di78z/2BMjF5YLz8T9P+afB1C08OWY7HC5vwTa/Ly+0hrK/IP887b8J/ln/yIZoNUvYnLC5f7l/EvB4/AMJPxqS8YYY4wxxhhj7KK+omLHzPvPzH/x+Xv35/Hqckw2uNz/Z/fnjDHGGGOMMcYYu/Ke7drtqccSElp3/NcbVf6tqD/caAz/rZm58bsN7wEyn1EA8G9PKH5uAGQ8I//Ko9jyl+wr6dKp8/dDy8/6AP5nlPLPaFzhNybGGGOMMcbYn+7yRf+vn1dXKiHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYYywL+iv+nNiVPkbGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGPsSvs/AQAA///tlfNv") prlimit64(0x0, 0xe, &(0x7f0000001cc0)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001d00)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000001d40)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001dc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001e00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000001e80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001ec0), 0x4000087, 0x2, 0x0) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001f00), 0x2000) socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r4, &(0x7f0000001f40)={0x9, {"a2e3ad214fc752f91b5d090932f70e0dd038e7ff7fc6e5539b324c078b089b3434076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319521800ffe8d178708c523c921b1b5b353b0d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) syz_io_uring_setup(0x126b, &(0x7f0000002f80)={0x0, 0x72e0, 0x0, 0x40000, 0x3ab, 0x0, r3}, &(0x7f0000003000), &(0x7f0000003040), &(0x7f0000000040)) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000030c0), 0xffffffffffffffff) getsockname$packet(r3, &(0x7f0000003100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003140)=0xfffffd5d) 30.808970001s ago: executing program 34 (id=488): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYRESDEC, @ANYRES16], 0x54}}, 0x24000041) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x2, 0x3e0, 0x1f8, 0x2f8, 0x1f8, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'vxcan1\x00', 'nr0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac, @broadcast}}}, {{@arp={@remote, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg\x00', 'vcan0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "dcbc4f0fcafe5fd600342efa7968d220b64d039e8a81d171eeb2e9630554"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) socket$inet6(0xa, 0x2, 0xffffffff) syz_usb_connect(0x4, 0x0, 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, &(0x7f0000000140)=ANY=[], 0x1, 0x152d, &(0x7f0000000780)="$eJzs3AucjdX6OPDnWWu9Y0jaTXIZ1lrPy04uiyTJJUkuSZIkSW4JSZMcSUgMuSUNSUguQ3IPyWVi0rjf75eEJGmSJCS3ZP0/E/NXp87/dM7p5Pf/zfP9fPZn1trrfdb7vPuZd+/3XZv5pvOQGo1qVm1ARPAfwYs/EgEgFgAGAMA1ABAAQNm4snEZ49klJv5nO2F/roemXekM2JXE9c/auP5ZG9c/a+P6Z21c/6yN65+1cf2zNq4/Y1nZ5un5r+VH1n3w+n9Wxp///4uklxzzxdqS13cBiPmjIVz////hfxDL9f9fK/gjG3H9szauf1YVe6UTYP8D8PmfFWT7hyNc/6yN689YVvbLteBYuPLr0X/1AyL/ze9AfM+Lr/KVP85/ePyMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxthf4Iy/TAFAZvtK58UYY4wxxhhjjLE/j892pTNgjDHGGGOMMcbYfx+CAAkKAoiBbBAL2SEHCICYzPFrIQ6ug9xwPeSBvJAP8kM8FICCoMGABYIQCkFhiMINUARuhKJQDIpDCXBQEkrBTVAaboYycAuUhVuhHNwG5aECVIRKcDtUhjugCtwJVeEuqAbVoQbUhLuhFtwDteFeqAP3QV24H+rBA1AfHoQG8BA0hIehETwCjeFRaAJNoRk0hxb/VvwL0B1ehB7QExKhF/SGl6AP9IV+0B8GwMswEF6BQfAqJMFgGAKvwdAg87UYASPhTRgFb8FoGANjYRwkw3iYAG/DRHgHJsFkmAJTYRpMhxnwLsyEWTAb3oM58D7MhXkwHxZACnwAC2ERpMKHsBg+gjRYAkthGSyHFbASVsFqWANrYR2shw2wETbBZtgCW2EbbIcdsBM+hl3wCeyGPbAXPoV98Nm/GH/67+K7ICCgQIEKFcZgDMZiLObAHJgTc2IuzIURjGAcxmFuzI15MA/mw3wYj/FYEAuiQYOEhIWwEEYxikWwCBbFolgci6NDh6UQsDTejGWwDJbFslgOy2F5rIAVsBJWwspYGatgFayKVbEaVsMaWAPvxruxF9bG2lgH62BdrJu5PIUNsAE2xIbYCBthY2yMTbAJNsNm2AJbYEtsia2wFbbBNtgW22I7bIcJmIDtsT12wA7YETtiJ+yEnbEzdsGu2DX9hWyAL+KL2BOriV7YG3tjH0zK1g/7Y398GQfiK/gKvopJOBiH4Gv4Gr6Ow/AUDr8wAkfiSKws3sLROAZJjMNkTMYJOAEn4kSchJNxMk7FaTgdZ+AMnImzcBa+h3PwfXwf5+E8XIApmIILcRGmYiouxtOYhktwKS7D5bgCl+MqXI2rcC2uw7W4ATfgJtyEW3ALbsNtuAN34MeoAPAT3IN7MAn34T7cj/vxAB7Ag3gQ0zEdD+EhPIyH8QgewaN4FI/hcTyBx/EknsRTeBrP4Bk8h+fwPD4X/1XDj4utSQKRQQklYkSMiBWxIofIIXKKnCKXyCUiIiLiRJzILXKLPCKPyCfyiXgRLwqKgsIII0iEGe8UIiqioogoIoqKoqK4KC6ccKKUKCVKi9KijCgjyopbRTlxmygvKojWrpKoJCqLNq6KuFNUFVVFNVFd1BA1RU1RS9QStUVtUUfUEXVFXVFPPCDqi17YDx8SGZVpJAZjYzEEm4imQl46K1uKYdhKtBZtxBNiBA7HdqKlSxBPi/ZiNHYQfxNj8FnRSYzDzuJ50UV0Fd3EC6K7aOV6iJ5iEvYSvcVU7CP6in6iv5iJ1cV7OCd7DfGqSBKDxRDxmliAr4th4g0xXIwQI8WbYpR4S4wWY8RYMU4ki/FignhbTBTviElispgipoppYrqYId4VM8UsMVu8J+aI98VcMU/MFwtEivhALBSLRKr4UCwWH4k0sUQsFcvEcrFCrBSrxGqxRqwV68R6sUFsFJvEZrFFbBXbxHaxQ+wUH4td4hOxW+wRe8WnYp/4TOwXn4sD4gtxUHwp0sVX4pD4WhwW34gj4ltxVHwnjonj4oT4XpwUP4hT4rQ4I86Kc+JHcV78JC4IL0CiFFJKJQMZI7PJWJld5pBXyZwy803vWhknr5O55fUyj8wr88n8Ml4WkAWllkZaSTKUhWRhGZU3yCLyRllUFpPFZQnpZElZSt4kS8ubZRl5iywrb5Xl5G2yvKwgK8pK8nZZWd4hIXJxH9VkdVlD1pR3y0S4R9aW98o68j5ZV94v68kHZH35oGwgH5IN5cOykXxENpaPyiayqWwmm8sW8jHZUj4uW8nWso18QraVT8p28imZIJ+W7aW/9CvyrOwkn5Od5fOyi+wqu8mf5AXpZQ/ZU0IvkL3lS7KP7Cv7yf5ygHxZDpSvyEHyVZkkB8sh8jU5VL4uh8k35HA5Qo6Ub8pR8i05Wo6RY+U4mSzHywnybTlRviMnyclyipwqp8npst+lmWZL+U/j3/6d+EE/732T3Cy3yK1ym9wud8id8mO5S+6Su+VuuVfulfvkPrlf7pcH5AF5UB6U6TJdHpKH5GF5WB6RR+RReVQek8flWfm9PCl/kKfkaXlanpXn5Dl5/tJrAAqVUFIpFagYlU3Fquwqh7pK5VRXq1zqGhVR16o4dZ3Kra5XeVRelU/lV/GqgCqotDLKKlKhKqQKq6i6AS/9wqjiqoRyqqQqpW76V+JVEXWjKqqK/So+M7/Ef5BfC9VCtVQtVSvVSrVRbVRb1Va1U+1UgkpQ7VV71UF1UB1VR9VJdVKdVWfVRXVR3VQ31V11Vz1UD5WoElVv9ZLqo/qqfqq/GqBeFhnHMEgNUkkqSQ1RQ9RQNVQNU8PUcDVcjVQj1Sg1So1Wo9VYNVYlq2Q1QU1QE9VENUlNUlPUFDVNTVMz1Aw1U81Us9VsNUfNUXPVXDVfzVcpKkUtVAtVqkpVi9VilaaWqCVqmVqmVqgVapVapdaoNWqdWqc2qA0qTW1Wm9VWtVVtV9vVTrVT7VK71G61W+1Ve9U+tU/tV/vVAXVAHVQHVbpKV4fUIXVYHVZH1BF1VB1Vx9QxdUKdUCfVSXVKnVJn1Bl1Tp1T59V5dUFdyLjsC0QgAhWoICaICWKD2CBHkCPIGeQMcgW5gkgQCeKCuCB3cH2QJ8gb5AvyB/FBgaBgoAMT2EBcKno0uCEoEtwYFA2KBcWDEoELSgalgpuC0sHNQZnglqBscGtQLrgtKB9UCCoGlYLbg8rBHUGV4M6ganBXUC2oHtQIagZ3B7WCe4Lawb1BneC+oG5wf1AveCCoHzwYNAgeChoGDweNgkeCxsGjQZOgadAsaB60+FPn9/5U3sddD91TJ+peurd+SffRfXU/3V8P0C/rgfoVPUi/qpP0YD1Ev6aH6tf1MP2GHq5H6JH6TT1Kv6VH6zF6rB6nk/V4PUG/rSfqd/QkPVlP0VP1NJ1xiryrZ+pZerZ+T8/R7+u5ep6erxfoFP2BXqgX6VT9oV6sP9Jpeoleqpfp5XqFXqlX6dV6jV6r1+n1eoPeqDfpzXqL3qq36e16h96pP9a79Cd6t96j9+pP9T79md6vP9cH9Bf6oP5Sp+uv9CH9tT6sv9FH9Lf6qP5OH9PHdRn9vT6pf9Cn9Gl9Rp/V5/SP+rz+SV/QPuPiPuPj3SijTIyJMbEm1uQwOUxOk9PkMrlMxERMnIkzuU1uk8fkMflMPhNv4k1BU9BkIEOmkClkoiZqipgipqgpaoqb4sYZZ0qZUqa0KW3KmDKmrClryplyprwpbyqaiuZ2c7u5w9xh7jR3mrvMXaa6qW5qmpqmlqllapvapo6pY+qauqaeqWfqm/qmgWlgGpqGppFpZBqbxqaJaWKamWamhWlhWpqWppVpZdqYNqataWvamXYmwSSY9qa96WA6mI6mo+lkOpnOprPpYrqYbqab6W66mx6mh0k0iaa36W36mD6mn+lnBpgBZqAZaAaZQSbJJJkhZogZaoaaYWaYGW5GmJEZF6rmLTPajDFjzTiTbJLNBDPBTDQTzSQzyWTeTs0wM8xMM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXvp89KbWJvd5rBX2Zz2apvLXmP/vp/P5rfxtoAtaLXNY/P+qm+stUVtMVvclrDOlrSl7E2/6Ze3FWxFW8nebivbO2yV3/Rr2XtsbXuvrWPvszXt3b/q17X323r2EVsfEcA2tQ1tc9vIPmIb20dtE9vUNrPNbVv7pG1nn7IJ9mnb3j7zm/5Cu8iutmvsWrvO7rZ77Bl71h6239hz9kfbw/a0A+zLdqB9xQ6yr9okO/g3/ZH2TTvKvmVH2zF2rB33m/4UO9VOs9PtDPuunWln/aafYj+wc2yqnWvn2fl2wc/9jJxS7Yd2sf3IptkAltpldrldYVfaVf8312V2g91oN9ld9hO71W6z2+0OuzPzQtjusXvtp3af/cwesl/bA/YLe9Aesen2q5/7Gcd3xH5rj9rv7DF73J6w39uT9geVGZ1x7N/bn+wF6y0QEpAkRQHFUDaKpeyUg66inHQ15aJrKELXUhxdR7npespDeSkf5ad4KkAFSZMhS0QhFaLCFKUbKDO94lSCHJWkUnQTlaabqQzdQmXpVipHt1F5qkAVqRLdTpXpDqpCd1JVuouqUXWqQTXpbqpF91Btupfq0H1Ul+6nevQA1acHqQE9RA3pYWpEj1BjepSaUFNqRs2pBT1GLelxakWtqQ09QW3pSWpHT1ECPU3t6RnqQH+jjvQsdaLnqDM9T12oK3WjF6g7vUg9qCclUi/qTS9RH+pL/ag/DaCXaSC9QoPoVUqiwTSEXqOh9DoNozdoOI2gkfQmjaK3aDSNobE0jpJpPE2gt2kivUOTaDJNoak0jabTDHqXZtIsmk3v0Rx6n+bSPJpPCyiFPqCFtIhS6UNaTB9RGi2hpbSMltMKWkmraDWtobW0jtbTBtpIm2gzbaGttI220w7aSR/TLvqEdtMe2kuf0j76jPbT53SAvqCD9CWl01d0iL6mw/QNHaFvfU/6jo7RcTpB39NJ+oFO0Wk6Q2fpHP1I5+knukCeIMRQhDJUYRDGhNnC2DB7mCO8KswZXh3mCq8JI+G1YVx4XZg7vD7ME+YN84X5w/iwQFgw1KEJbUhhGBYKC4fR8IawSHhjWDQsFhYPS4QuLBmWCm8KS4c3h2XCW8Ky4a1hufC2sHxYIXzkvkrh7WHl8I6wSnhnWDW8K6wWVg9rhDXDu8Na4T1h7fDesE54X1gmvD+sFz4Q1g8fDBuED4UNw4fDRuEjYePw0bBJ2DRsFjYPW4SPhS3Dx8NWYeuwTXhV2DZ8MmwXPhUmhE+H7cNnfh6/f1Hm+BO/GU8Me4W9w5fCl0Lv75XzowuiKdEPoguji6Kp0Q+ji6MfRdOiS6JLo8uiy6Mroiujq6Kro2uia6ProuujG6Ibo5ui3tfMBg6dcNIpF7gYl83Fuuwuh7vK5XRXu1zuGhdx17o4d53L7a53eVxel8/ld/GugCvotDPOOnKhK+QKu6i7wRVxN7qirpgr7ko450q6Uq65a+FauJbucdfKtXZt3BPuCfeke9I95Z5yT7v27hnXwf3NdXTPuk7uOfece951cV1dN/eC6+7G57p4Tia63q636+P6uH6unxvgBriBbqAb5Aa5JJfkhrghbqgb6oa5YW64G+5GupFulBvlRrvRbqwb65JdspvgJriJbqKb5Ca5KW6Km+amuRluhpvpZrrKsy7uZa6b6+a7+S7FpbiFLuOaMdUtdotdmktzS91St9wtdyvdSrfarXZr3Vq33q13G91Gt9ltdlvdVrfdbXc73U63y+1yu/01Fyd1+9x+t98dcAfcQfelS3dfuUPua3fYfeOOuG/dUfedO+aOuxPue3fS/eBOudPujDvrzrkf3Xn3k7vgvEuOjI9MiLwdmRh5JzIpMjkyJTI1Mi0yPTIj8m5kZmRWZHbkvcicyPuRuZF5kfmRBZGUyAeRhZFFkdTIh5HFkY8iaZElkaWRZZHlkRUR7wtsDX0hX9hH/Q2+iL/RF/XFfHFfwjtf0pfyN/nSF/NO8/5WX87f5sv7Cr6if9Q38U19M9/ct/CP+Zb+cd/Kt/Zt/BO+rX/St/NP+QT/tG/vn/Ed/N98R/+s7+Sf8539876L7+q7+Rd8d/+i7+F7+kTfy/f2L/k+vq/v5/v7Af5lP9C/4gf5V32SH+yH+Nf8UP+6H+bf8MP9CD8y5k0/KvMWGcb5ZD/eT/Bv+4n+HT/JT/ZT/FQ/zU/3M/y7fqaf5Wf79/wc/76f6+f5+X6BT/Ef+IV+kU/1H/rF/iOf5pdkLpT6lX6VX+3X+LV+nV/vN/iNfpPf7Lf4rX6b3+53+J3+Y7/Lf+J3+z1+r//U7/Of+f3+c3/Af+EP+i99uv/KH/Jf+8P+G3/Ef+uP+u/8MX/cn/Df+5P+B3/Kn/Zn/Fl/zv/oz/uf/AX+P2uMMcYYY3/I+MtN8euRi8v5vX4nRvxi494AcPW2/Om/HM+4olyf52K7r4iPzfj5dM/OD2U+qlVLTEy8tG2ahKDwPIDMb4Iy/LxWdqm/BNrAk5AAraH07+bfV3Q9R/9k/uitADl+EZORUGb/8vyfA2Di78z/2BMjF5YLz8T9P+afB1C08OWY7HC5vwTa/Ly+0hrK/IP887b8J/ln/yIZoNUvYnLC5f7l/EvB4/AMJPxqS8YYY4wxxhhj7KK+omLHzPvPzH/x+Xv35/Hqckw2uNz/Z/fnjDHGGGOMMcYYu/Ke7drtqccSElp3/NcbVf6tqD/caAz/rZm58bsN7wEyn1EA8G9PKH5uAGQ8I//Ko9jyl+wr6dKp8/dDy8/6AP5nlPLPaFzhNybGGGOMMcbYn+7yRf+vn1dXKiHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYYywL+iv+nNiVPkbGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGPsSvs/AQAA///tlfNv") prlimit64(0x0, 0xe, &(0x7f0000001cc0)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001d00)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000001d40)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001dc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001e00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000001e80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001ec0), 0x4000087, 0x2, 0x0) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001f00), 0x2000) socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r4, &(0x7f0000001f40)={0x9, {"a2e3ad214fc752f91b5d090932f70e0dd038e7ff7fc6e5539b324c078b089b3434076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319521800ffe8d178708c523c921b1b5b353b0d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) syz_io_uring_setup(0x126b, &(0x7f0000002f80)={0x0, 0x72e0, 0x0, 0x40000, 0x3ab, 0x0, r3}, &(0x7f0000003000), &(0x7f0000003040), &(0x7f0000000040)) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000030c0), 0xffffffffffffffff) getsockname$packet(r3, &(0x7f0000003100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003140)=0xfffffd5d) 4.208927408s ago: executing program 7 (id=756): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x2, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0xff, 0x1, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x201}}}}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) ioctl(r0, 0x8914, &(0x7f0000000240)="7573623000000000000000000000000003") 4.159716923s ago: executing program 4 (id=762): mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000a80)='./dev\x00', &(0x7f0000000ac0)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./dev/kmsg\x00', 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000380)=@delqdisc={0x434, 0x25, 0x100, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xf}, {0xa, 0x7}, {0x0, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x3, 0xfffffff8, 0x4, 0x40, 0x2, 0x2, 0x5, 0x7fff, 0x4, 0x1, 0x6, 0x1cc, 0x7, 0x0, 0x5, 0x0, 0x8, 0x9, 0x9, 0x9, 0xf5, 0x200, 0x1, 0x5, 0x6, 0xfff, 0x9, 0x1, 0x80, 0x10000, 0x0, 0x6, 0xff, 0x4, 0x6, 0x9, 0xe6c1, 0x6, 0x65, 0x6, 0x5, 0x71, 0x1f146d7e, 0x80000001, 0x89, 0xe9, 0x80000001, 0x2, 0xff, 0x8, 0xffff8dc2, 0x400, 0x0, 0x2, 0xffff, 0x10001, 0x3ff, 0x0, 0x5, 0xa000000, 0x0, 0x5, 0x8, 0x3, 0x0, 0x401, 0x5, 0x8, 0x4ad1, 0x1, 0x25ae, 0x1, 0xfff, 0x6, 0xe, 0xffffffff, 0x7, 0x5, 0x3ff, 0xfff, 0x8, 0xf, 0x0, 0x4, 0x626cfd3b, 0x0, 0x60df8662, 0x2, 0x5, 0x4, 0xc6, 0x8, 0x7, 0xfffffffa, 0x9, 0x4, 0x1, 0x3, 0x0, 0x7, 0x616, 0xffff8000, 0xe13, 0x8, 0x7, 0xc, 0xfdc1, 0x7ff, 0x4, 0xffffffec, 0x4, 0x7fff, 0x40, 0x1, 0x1f1f, 0x3, 0x665195e5, 0x5, 0x7, 0x5, 0x8, 0x7, 0x4, 0x800, 0x101, 0x400, 0x2, 0x6, 0xd, 0xa, 0x7, 0xc2, 0x99, 0x4, 0x2e9, 0x4, 0x3, 0x401, 0xfffffffe, 0x7, 0x80000000, 0x8, 0x0, 0x4, 0x37, 0x4, 0x31, 0x2, 0x2, 0x3, 0x6, 0x1, 0x690c, 0x0, 0x9, 0x2, 0xe, 0xb, 0x8, 0x1, 0x3, 0x4, 0x7fff, 0x62, 0xf6, 0x5, 0x0, 0x7fffffff, 0x9, 0x9, 0x2, 0x100, 0x8, 0x101, 0x5, 0x2, 0x3, 0x4, 0xfc8d, 0x8, 0x3ff, 0x3, 0xaeb3, 0x3, 0x5, 0x9, 0xfc, 0x8000, 0x1, 0x7, 0x20000, 0x2, 0x2, 0x9f85, 0x65, 0x85, 0x4, 0x2, 0x2, 0x6, 0x7, 0xd92, 0x40, 0xfff, 0xe1, 0x8, 0x426, 0x9, 0x9, 0x1, 0x1000, 0x9, 0x36ae765f, 0x800, 0x9, 0x200000, 0x3, 0x4, 0x5, 0x0, 0x89, 0x8, 0x80000000, 0x4007, 0x1, 0x41632842, 0x6, 0x10, 0x2, 0x8001, 0x5, 0x100, 0x8, 0x9, 0xfe64, 0xd, 0x1c2, 0x2, 0x7, 0x2, 0x80000001, 0xa, 0x6, 0xfffffffc, 0x5, 0x3, 0x7f, 0x8001, 0x5, 0x3, 0x6, 0x8001, 0x10001, 0x9, 0xb, 0x7]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) ppoll(&(0x7f0000000240), 0x20000000000000dc, 0x0, 0x0, 0x30) 4.114170988s ago: executing program 4 (id=765): prlimit64(0x0, 0xe, &(0x7f00000006c0)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000700)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000740)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000007c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000840), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000880), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000008c0)=0x6) writev(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000b80)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000bc0)='./trace\x00', &(0x7f0000000c00)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffff9c, &(0x7f0000000c40)='./trace/events/mac80211/enable\x00', 0x40000, 0x1) readv(r3, &(0x7f0000000c80)=[{&(0x7f0000000cc0)=""/4096, 0x1000}], 0x1) 3.263524495s ago: executing program 4 (id=772): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201020153a42908f00a71729188110203010902240001060000000904020002ff"], 0x0) 3.1194829s ago: executing program 6 (id=773): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4ca7e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r4, 0x100000000000011, 0x2000, 0x2f93) 2.782509454s ago: executing program 5 (id=775): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)={0x14, 0x1002, 0x10, 0x0, 0x0, "", [@generic='I']}, 0x14}], 0x1, 0x0, 0x0, 0x800}, 0x10) 2.717746531s ago: executing program 5 (id=776): mknodat$md(0xffffffffffffff9c, &(0x7f0000000940)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000980)='./md0\x00', 0x2, 0x0) ioctl$SET_ARRAY_INFO(r0, 0x40480923, &(0x7f0000000240)={0xfffffffe, 0x77, 0x0, 0x0, 0x5, 0x72f, 0x0, 0x2, 0x0, 0x1000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000a80)={0x1, {0x1, 0x1}, 0x1, 0x6}) 2.715410561s ago: executing program 5 (id=777): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x100, 0x6}, 0x4) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002100)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002140)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000002180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000002200), 0x0, 0x0) read$msr(r2, &(0x7f0000002240)=""/102368, 0x18fe0) r3 = socket(0x840000000002, 0x3, 0x100) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) 2.313127752s ago: executing program 5 (id=778): setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) syz_mount_image$erofs(&(0x7f0000000440), &(0x7f0000000480)='./file1\x00', 0x2014050, &(0x7f00000004c0)=ANY=[], 0x0, 0x205, &(0x7f0000000540)="$eJzslT1v00AYx//nuLaDKsHcBSQqUQb8FkAslcLCxIDES8WARETdquBSlHiglRDwCRArGwMfA6msfAQGVJB4kRAswHzoXuxcwlmJkkCGPr/h8j/f+fHzPOf8DYIgDi0fP/w+4L9WvwQAFrEMX1//2ujvcYz974Mfj95cvrT27Nart/5B2ByM5uOo/H0y9vNdAPsXGyjU1OOcc3N9Wf9eg1Pp63BwWus1MIRa34aDG1pnYLip9V1D74j9YbixlWfhnZ18XYhYDIkYUjG0hvP7/pRhXc9FfkxJWXtvd+9eJ8+z7kzEIoC/l+yd2/9W5RcAq0Z+xnktfYbKNjb6l8BBonULDFfRxgkAF+CXvVEtMepfcrFQxjdeDUv9HqZsxCcA/Ssbs+msXXjiURPdDrBxzh7H9Ov4L6sYJaKs23v+zrrUgBTlidbFac8v+SkF3JkF5D4w73JqxOu2Or8q1cdqPrx5weovo07ZM+Iw1x7Z0vnKP/lLhlOGP6kQL+SnJiq2H0S93b0zW9udzWwzu5+mrfPx2Tg+l0bSiNRot0AZvyn96Ug/frNur8c8POwURTdRYzVP1WhzXEf6n4OVk8r/hJt6Q3F/lh8Dvc70fUyqlfLPFQzcxGpLIgiC+C8cB5OeLH25FPprUi1wnl6Zc54EQRAEQRAEQRAEQUzOnwAAAP//jqtW4g==") syz_emit_ethernet(0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x100000040000006, 0x100) signalfd4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$SO_TIMESTAMP(r1, 0x1, 0x3e, 0x0, &(0x7f00000004c0)) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/mem_sleep', 0x20001, 0x18f) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000180)={r2, 0x0, {0x0, 0x0, 0x0, 0x9, 0x4010000000000ffc, 0x0, 0x0, 0x19, 0x14, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "670100000000000000cc14180203dae400", [0x7fffffff, 0x6]}}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) syz_mount_image$ext4(&(0x7f0000000900)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000500), 0x1, 0x62b, &(0x7f0000000b40)="$eJzs3c9rm2UcAPDvm/R31XZF1HnQgugGunbtNhkiuCF4mmP+OAhejGs35rIfrBXtnKyDeRHEiwfBkwfnwf9BB4In/wEPXjzJZIjsogyNvOmbmLVJmtYm2ZrPB9K8T543eb7vum+fJ0+eN28APWsy/ZGL2BkR55OIiZq6vsgqJ1f2u/XHpePpLYlS6bXfk7h0OVmufa0kux+NiLTi77FIfoiIifzadheWLp4uFIvzF7Ly9OKZ89MLSxf3nDpTODl/cv7s7LOzBw/sP3BwZm/Ns068tNHj21GzfeTqO++NfXz0za++uJ3MfP3z0SQOVYNOj2ujr72eyZiMUqb28fTf9eBWN9Yl+er/k/8kqx9Y7cU2BsSGVH5//RHxcIxFvua3ORYfvdLV4IC2KiVR7aOAXpPIf+hRlXFA5b19a++DB9o8KgE64ebhiKeq+d8fEZX871uZG4yh8tzAyK3kjnmeJCL2bkH7aRs/fn/0anqLNs3DAfUtXxnMpsBX9/9JOTfHY6hcGrmVuyP/c9k07ng2f/hq82bGGlVMripn7Q9u9niA1i1fiYhH6o3/95R/Nsv/t7L79PG3N9l+g/wHAAAAAAAANuH64Yh4pt7nf7nq+p+BOut/RiPi0Ba0v/7nf7kbW9AMUMfNwxHP113/m6vsMp7PSveX1wP0JydOFef3RsQDEbE7+gfT8kzti35T8+yI2PPJxOeN2q9d/5fe0vYrawGzOG70rVoNNFdYLGzBoUPPu3kl4tG+evmfVPv/pE7/n+b3+RbbmHjy2rFGdevnP9AupS8jdtXt/5PqPknz7+eYLo8HpiujgrUe++DTbxu1L/+he9L+f6R5/g8mtd/Xs7Cx1x+IiH1LfaVG9evlfzr0rzf+H0hez0fNmYjvFxYXL8xEDCRH1j4+u7GY4V4y1PquH0ZEOR8q+ZLm/+4nms//Vcf/NXk4nH3HVyse+mf0l0Z1+n/onjT/55r3/+N39v8b35i9Nv5do/aPtTT/t7/cp+/OHjH/B821mqDdjhMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW5iLgvktxUdTuXm5qKGI2IB2MkVzy3sPj0iXPvnp1L68rX/89VrvQ7tlJOKtf/H68pz64q74uIHRHxWX64XJ46fq441+2DBwAAAAAAAAAAAAAAAAAAgLvE6MrdmvP/U7/mmz/35faHB7RbX3a/Tr4D21BftwMAukb+Q++S/9C7Guf/n7dLZR0NB+igVvv/0uU2BwJ03CbH/z4ugG3A+3/oVf2t7TbU7jiAbtD/AwAAAADAtrLj8es/JRGx/Nxw+ZYayOqqHwwOdys6oJ1yjSoGOxsH0Hn5GOt2CECXWPoDvavFxb/ANpZUt/6qe7J/49X/SXsCAgAAAAAAAAAAAADW2LWzhfP/gW2p4fn/wLbX5Bpe9U7scckv2Eac/w+9y9d8AZXBfqMr/Tv/HwAAAAAAAAAAAADuAkMXTxeKxfkLC0stb1zeyM7/f+O3aFT1QifD2KqN5cJdEca9sNEfEauqStnlqk8Xim9EZ+OpZEwn2hroYFsNNrr09wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFjj3wAAAP///EInsA==") 2.209121393s ago: executing program 6 (id=779): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.166627917s ago: executing program 5 (id=780): r0 = openat$binfmt_register(0xffffff9c, &(0x7f0000000740), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000780)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x1, 0x3a, '/_\x7f\xf0R\xf6\xedI\xf3\xf4\x12I\xb1\xeb\x0f\xa9\x13r\xbaS$\x81<\x1b3a\xf7\xb2\x93\x8bw0\xa2m\xb7n3\x80K\x11n`\x7fo\xdd#\x8f3\xdb\xb1\x10$%\x92j\xbf\x11\xf7{\x06z\x83M^\xfb\xa8\x00O\xa7\r8\xc0c\xb6x\xd1\xcaO\xb8\x0fcfj\x1fU\xba', 0x3a, '\\xAK-^{', 0x3a, './file0'}, 0x84) 2.097984755s ago: executing program 5 (id=781): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f00000000c0)=""/188, 0xba) write$char_usb(r1, 0x0, 0x0) read$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) 1.795038686s ago: executing program 4 (id=785): socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0)) r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) write(0xffffffffffffffff, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 1.758260179s ago: executing program 4 (id=786): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x10003, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000240)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000002c0), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000300), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') fchdir(r2) mount(0x0, &(0x7f0000000400)='.\x00', &(0x7f0000000440)='proc\x00', 0x80, 0x0) r3 = syz_clone(0x40411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r3, &(0x7f00000004c0)='net/unix\x00') wait4(r3, 0x0, 0x2, 0x0) 1.130393894s ago: executing program 7 (id=790): openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000001f80), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001d80)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000001dc0)='27', 0x2) getuid() r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000001f40)={0x28, 0x0, 0x0, @local}, 0x10) listen(r1, 0x0) accept4$unix(r1, 0x0, 0x0, 0x0) 1.07209835s ago: executing program 7 (id=791): openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x141) write(r0, &(0x7f0000000500)='-:s/', 0x4) 1.07195668s ago: executing program 7 (id=792): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048049}, 0x0) 1.064521191s ago: executing program 7 (id=793): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000006c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$cgroup(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180), 0x44, 0x0) 1.040135383s ago: executing program 6 (id=794): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000001440)={0x1, &(0x7f0000001480)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) syz_clone3(&(0x7f00000014c0)={0x180801400, &(0x7f0000001540), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) 880.51796ms ago: executing program 6 (id=795): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000640)={0x3, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="020300030f0000002cbd7000ffdbdf250100090000000000050006003c0400000a004e2400000008ff010400000000000000000000000001000000000000000002000100000000000000070a000000c0050005"], 0x78}, 0x1, 0x7}, 0x0) 839.365193ms ago: executing program 6 (id=797): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000480), 0x318, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000500)=0x2) mkdir(&(0x7f0000000540)='./file0\x00', 0x97) mkdir(&(0x7f0000000580)='./file1\x00', 0x13b) mkdir(&(0x7f00000005c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000600)='./bus\x00', &(0x7f0000000640), 0x0, &(0x7f0000000680)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 838.916604ms ago: executing program 2 (id=798): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) 804.151187ms ago: executing program 2 (id=799): r0 = syz_io_uring_setup(0xb8a, &(0x7f0000000000)={0x0, 0xe66, 0x1408, 0x3, 0x24b}, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit$UBLK(r1, r2, r3, &(0x7f0000000140)=@ublk_io_commit_and_fetch_sqe={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0107521, 0x0, 0x0, 0x0, 0x0, {0x4}, 0x0, 0x0, '\x00', {0x0, 0xfc5, 0xe, 0x0}}) syz_io_uring_submit$UBLK(r1, r2, r3, &(0x7f00000001c0)=@ublk_add_dev_sqe={0x2e, 0x59, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xff, 0x0, r4, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}) io_uring_enter(r0, 0x317d, 0x5, 0x2, 0x0, 0x0) 803.790437ms ago: executing program 2 (id=800): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB='H'], 0x48}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x0, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x82, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0xc, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000003}, 0x94) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 341.188835ms ago: executing program 4 (id=801): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f00000001c0)={0x0, 0x12, 0x1, "84"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000340)={0x0, 0x30, 0x1, 'D'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 278.796271ms ago: executing program 2 (id=802): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./proc\x00', 0x4) mount(0x0, &(0x7f00000005c0)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./proc/thread-self/fail-nth\x00', 0x60601, 0xb) write(r1, &(0x7f0000000680)='9', 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_DELETE_BATCH(0x1b, 0x0, 0x0) fcntl$lock(r0, 0x6, 0x0) 30.808107ms ago: executing program 2 (id=803): r0 = socket(0x15, 0x5, 0x0) connect$unix(r0, &(0x7f0000000180)=@abs={0xa}, 0x6e) 30.498477ms ago: executing program 2 (id=804): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001240)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="b702000001000000b703000000000000b7040000000000008500000032000000b7000000010000009500"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000440)={@map=r5, r6, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000480)={r5, &(0x7f00000004c0), &(0x7f0000000500)=@tcp=r3}, 0x20) sendto(r4, &(0x7f0000000540)="01020304", 0x4, 0x0, 0x0, 0x0) 30.400387ms ago: executing program 7 (id=805): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', 0x0, &(0x7f0000000480)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x17f) umount2(&(0x7f0000000540)='./file0\x00', 0x2) 0s ago: executing program 6 (id=806): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x18808, 0x0, 0xf7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x8, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000009c00)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000009c40)='0', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) rmdir(&(0x7f0000000300)='./file0/file1\x00') kernel console output (not intermixed with test programs): 0/0x390 [ 128.369524][ T1489] xt_hashlimit: size too large, truncated to 1048576 [ 128.371132][ T1482] ? __x64_sys_mount+0xd0/0xd0 [ 128.371154][ T1482] ? do_user_addr_fault+0x9a5/0x1030 [ 128.371183][ T1482] __x64_sys_mount+0xbf/0xd0 [ 128.383164][ T374] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 128.387897][ T1482] x64_sys_call+0x65d/0x9a0 [ 128.399818][ T374] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.401527][ T1482] do_syscall_64+0x4c/0xa0 [ 128.414059][ T374] usb 2-1: Product: syz [ 128.418384][ T1482] ? clear_bhb_loop+0x30/0x80 [ 128.418412][ T1482] ? clear_bhb_loop+0x30/0x80 [ 128.429812][ T374] usb 2-1: Manufacturer: syz [ 128.431926][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 128.438378][ T1490] loop5: detected capacity change from 0 to 256 [ 128.442390][ T1482] RIP: 0033:0x7f5e949a0d8a [ 128.442412][ T1482] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.448737][ T374] usb 2-1: SerialNumber: syz [ 128.453062][ T1482] RSP: 002b:00007f5e958b6e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 128.483308][ T1490] FAT-fs (loop5): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 128.485713][ T1482] RAX: ffffffffffffffda RBX: 00007f5e958b6ee0 RCX: 00007f5e949a0d8a [ 128.503662][ T1482] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007f5e958b6ea0 [ 128.511675][ T1482] RBP: 0000200000000180 R08: 00007f5e958b6ee0 R09: 000000000080078b [ 128.519655][ T1482] R10: 000000000080078b R11: 0000000000000246 R12: 00002000000001c0 [ 128.527660][ T1482] R13: 00007f5e958b6ea0 R14: 0000000000000491 R15: 00002000000000c0 [ 128.535667][ T1482] [ 128.538692][ T1482] ---[ end trace 0000000000000000 ]--- [ 128.587140][ T1482] ------------[ cut here ]------------ [ 128.592682][ T1482] EA inode 11 i_nlink=2 [ 128.592820][ T1482] WARNING: CPU: 0 PID: 1482 at fs/ext4/xattr.c:1006 ext4_xattr_inode_update_ref+0x4f9/0x560 [ 128.607238][ T1482] Modules linked in: [ 128.611178][ T1482] CPU: 0 PID: 1482 Comm: syz.6.270 Tainted: G W syzkaller #0 [ 128.619968][ T1482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 128.630058][ T1482] RIP: 0010:ext4_xattr_inode_update_ref+0x4f9/0x560 [ 128.636663][ T1482] Code: 40 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 e7 e8 1a 22 ba ff 49 8b 34 24 48 c7 c7 80 52 b5 85 44 89 fa e8 87 05 45 ff <0f> 0b 49 bd 00 00 00 00 00 fc ff df 4c 8b 74 24 08 4c 8b 64 24 10 [ 128.656309][ T1482] RSP: 0018:ffffc90000b970a0 EFLAGS: 00010246 [ 128.662425][ T1482] RAX: 45cd1e7f229fc600 RBX: ffff888150a3ef70 RCX: 0000000000080000 [ 128.670429][ T1482] RDX: ffffc90001599000 RSI: 000000000007ffff RDI: 0000000000080000 [ 128.678412][ T1482] RBP: ffffc90000b97188 R08: ffff8881f6e2759b R09: 1ffff1103edc4eb3 [ 128.686454][ T1482] R10: dffffc0000000000 R11: ffffed103edc4eb4 R12: ffff888150a3ee50 [ 128.694500][ T1482] R13: dffffc0000000000 R14: ffff888150a3ee10 R15: 0000000000000002 [ 128.702555][ T1482] FS: 00007f5e958b76c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 128.711532][ T1482] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.718225][ T1482] CR2: 000000110c280de2 CR3: 0000000127fda000 CR4: 00000000003506b0 [ 128.726272][ T1482] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 128.734280][ T1482] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 128.742333][ T1482] Call Trace: [ 128.745636][ T1482] [ 128.748590][ T1482] ? ext4_xattr_block_csum+0x560/0x560 [ 128.754140][ T1482] ? __kasan_check_write+0x14/0x20 [ 128.759291][ T1482] ? ext4_xattr_inode_iget+0x284/0x370 [ 128.764817][ T1482] ext4_xattr_set_entry+0xc7d/0x2230 [ 128.770171][ T1482] ext4_xattr_ibody_set+0x25b/0x720 [ 128.775401][ T1482] ext4_expand_extra_isize_ea+0x1416/0x1dd0 [ 128.781350][ T1482] __ext4_expand_extra_isize+0x2fe/0x3e0 [ 128.787005][ T1482] __ext4_mark_inode_dirty+0x398/0x5d0 [ 128.792495][ T1482] ext4_evict_inode+0xbec/0x1450 [ 128.797449][ T1482] ? __cfi_ext4_evict_inode+0x10/0x10 [ 128.802848][ T1482] ? __ext4_iget+0x2dae/0x3e70 [ 128.807626][ T1482] ? __cfi_ext4_evict_inode+0x10/0x10 [ 128.813032][ T1482] evict+0x4c4/0x8c0 [ 128.816949][ T1482] ? memset+0x35/0x40 [ 128.820956][ T1482] ? proc_nr_inodes+0x2f0/0x2f0 [ 128.825824][ T1482] ? _raw_spin_lock+0x94/0xf0 [ 128.830537][ T1482] ? __cfi__raw_spin_lock+0x10/0x10 [ 128.835850][ T1482] ? __kasan_check_write+0x14/0x20 [ 128.841004][ T1482] iput+0x633/0x690 [ 128.844833][ T1482] ext4_process_orphan+0x298/0x300 [ 128.849983][ T1482] ext4_orphan_cleanup+0xb5d/0x1270 [ 128.855201][ T1482] ? __cfi_ext4_orphan_cleanup+0x10/0x10 [ 128.860880][ T1482] ? errseq_check_and_advance+0x66/0x130 [ 128.866529][ T1482] ext4_fill_super+0x6a53/0x73e0 [ 128.871548][ T1482] ? __cfi_ext4_fill_super+0x10/0x10 [ 128.876861][ T1482] ? set_blocksize+0x1cc/0x470 [ 128.881674][ T1482] ? sb_set_blocksize+0xaa/0xf0 [ 128.886547][ T1482] get_tree_bdev+0x450/0x6a0 [ 128.891175][ T1482] ? __cfi_ext4_fill_super+0x10/0x10 [ 128.896483][ T1482] ext4_get_tree+0x1c/0x20 [ 128.900953][ T1482] vfs_get_tree+0x9a/0x270 [ 128.905389][ T1482] do_new_mount+0x251/0xb40 [ 128.909934][ T1482] ? security_capable+0x99/0xc0 [ 128.914802][ T1482] path_mount+0x640/0xfd0 [ 128.919166][ T1482] __se_sys_mount+0x320/0x390 [ 128.923907][ T1482] ? __x64_sys_mount+0xd0/0xd0 [ 128.928692][ T1482] ? do_user_addr_fault+0x9a5/0x1030 [ 128.934052][ T1482] __x64_sys_mount+0xbf/0xd0 [ 128.938673][ T1482] x64_sys_call+0x65d/0x9a0 [ 128.943246][ T1482] do_syscall_64+0x4c/0xa0 [ 128.947696][ T1482] ? clear_bhb_loop+0x30/0x80 [ 128.952592][ T1482] ? clear_bhb_loop+0x30/0x80 [ 128.957289][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 128.963225][ T1482] RIP: 0033:0x7f5e949a0d8a [ 128.967657][ T1482] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.987301][ T1482] RSP: 002b:00007f5e958b6e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 128.995763][ T1482] RAX: ffffffffffffffda RBX: 00007f5e958b6ee0 RCX: 00007f5e949a0d8a [ 129.003783][ T1482] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007f5e958b6ea0 [ 129.011783][ T1482] RBP: 0000200000000180 R08: 00007f5e958b6ee0 R09: 000000000080078b [ 129.019806][ T1482] R10: 000000000080078b R11: 0000000000000246 R12: 00002000000001c0 [ 129.027795][ T1482] R13: 00007f5e958b6ea0 R14: 0000000000000491 R15: 00002000000000c0 [ 129.035806][ T1482] [ 129.038829][ T1482] ---[ end trace 0000000000000000 ]--- [ 129.044860][ T1482] EXT4-fs (loop6): 1 orphan inode deleted [ 129.050669][ T1482] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 129.075860][ T1493] xt_hashlimit: size too large, truncated to 1048576 [ 129.083150][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 129.135021][ T1496] loop4: detected capacity change from 0 to 256 [ 129.164212][ T1496] FAT-fs (loop4): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 129.238447][ T374] (unnamed net_device) (uninitialized): Assigned a random MAC address: 92:5a:10:f5:01:9e [ 129.248649][ T1474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.257547][ T1474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.290380][ T374] rtl8150 2-1:1.0: eth1: rtl8150 is detected [ 130.562323][ T1508] loop6: detected capacity change from 0 to 2048 [ 130.871958][ T28] audit: type=1400 audit(1793850173.189:292): avc: denied { search } for pid=142 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.988149][ T1508] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 130.997029][ T1508] ext4 filesystem being mounted at /9/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 131.079824][ T28] audit: type=1400 audit(1793850173.219:293): avc: denied { read } for pid=142 comm="dhcpcd" name="n16" dev="tmpfs" ino=2555 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 131.101356][ T28] audit: type=1400 audit(1793850173.219:294): avc: denied { open } for pid=142 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=2555 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 131.737125][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 131.909608][ T28] audit: type=1400 audit(1793850173.219:295): avc: denied { getattr } for pid=142 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=2555 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 131.924217][ T666] usb 2-1: USB disconnect, device number 4 [ 131.966041][ T1526] loop1: detected capacity change from 0 to 512 [ 131.972449][ T1527] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 132.044428][ T28] audit: type=1400 audit(1793850174.359:296): avc: denied { read } for pid=1529 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.067829][ T28] audit: type=1400 audit(1793850174.359:297): avc: denied { open } for pid=1529 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.094836][ T28] audit: type=1400 audit(1793850174.359:298): avc: denied { getattr } for pid=1529 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.142375][ T1535] __nla_validate_parse: 87 callbacks suppressed [ 132.142393][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.182339][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.200389][ T28] audit: type=1400 audit(1793850174.509:299): avc: denied { write } for pid=1528 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=493 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.225064][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.243927][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.256132][ T28] audit: type=1400 audit(1793850174.509:300): avc: denied { add_name } for pid=1528 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 132.269953][ T1549] binder: 1534:1549 ioctl c0306201 200000000240 returned -14 [ 132.285067][ T1551] xt_hashlimit: size too large, truncated to 1048576 [ 132.349606][ T28] audit: type=1400 audit(1793850174.509:301): avc: denied { create } for pid=1528 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 132.372400][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.408669][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.412054][ T1560] loop4: detected capacity change from 0 to 512 [ 132.417706][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.435001][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.451048][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.452684][ T308] Bluetooth: hci0: Frame reassembly failed (-84) [ 132.466726][ T1535] netlink: 3 bytes leftover after parsing attributes in process `syz.2.280'. [ 132.480999][ T1535] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 132.494076][ T1560] ext3: Unknown parameter '.' [ 132.700306][ T1570] loop4: detected capacity change from 0 to 256 [ 133.235176][ T1575] loop1: detected capacity change from 0 to 512 [ 133.371435][ T1576] loop2: detected capacity change from 0 to 256 [ 133.400909][ T1574] xt_hashlimit: size too large, truncated to 1048576 [ 133.434132][ T1575] ext3: Unknown parameter '.' [ 133.461984][ T1576] FAT-fs (loop2): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 133.630133][ T835] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 133.702654][ T1582] loop4: detected capacity change from 0 to 512 [ 133.751949][ T1582] ext3: Unknown parameter '.' [ 134.861910][ T1586] loop5: detected capacity change from 0 to 256 [ 134.870389][ T339] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 134.892674][ T1586] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 134.988375][ T1585] loop1: detected capacity change from 0 to 256 [ 135.355126][ T1595] loop4: detected capacity change from 0 to 256 [ 136.446341][ T1596] loop2: detected capacity change from 0 to 2048 [ 137.660356][ T1596] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 137.663313][ T1612] xt_hashlimit: size too large, truncated to 1048576 [ 137.668885][ T1596] ext4 filesystem being mounted at /33/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 137.739208][ T1618] loop4: detected capacity change from 0 to 256 [ 137.792012][ T1618] FAT-fs (loop4): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 137.862315][ T1626] loop6: detected capacity change from 0 to 512 [ 137.921956][ T315] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 137.948548][ T807] EXT4-fs (loop2): unmounting filesystem. [ 138.053926][ T1625] loop1: detected capacity change from 0 to 2048 [ 138.099229][ T1634] xt_hashlimit: size too large, truncated to 1048576 [ 138.111738][ T1625] loop1: p1 < > p4 [ 138.113903][ T1625] loop1: p4 size 722688 extends beyond EOD, truncated [ 138.283097][ T1639] loop1: detected capacity change from 0 to 512 [ 138.305749][ T1639] ext3: Unknown parameter '.' [ 138.415439][ T1643] __nla_validate_parse: 87 callbacks suppressed [ 138.415466][ T1643] netlink: 4 bytes leftover after parsing attributes in process `syz.4.300'. [ 138.775750][ T1645] loop1: detected capacity change from 0 to 256 [ 139.757558][ T1647] loop4: detected capacity change from 0 to 1024 [ 139.797929][ T1647] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 139.878027][ T1649] fuse: Bad value for 'fd' [ 139.930999][ T1647] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 141.577856][ T811] EXT4-fs (loop4): unmounting filesystem. [ 141.613089][ T1656] loop2: detected capacity change from 0 to 1024 [ 141.632521][ T1660] loop1: detected capacity change from 0 to 512 [ 141.661809][ T1660] ext3: Unknown parameter '.' [ 141.690148][ T1656] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 141.829101][ T1656] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 141.984731][ T1672] loop1: detected capacity change from 0 to 256 [ 143.119224][ T1680] loop6: detected capacity change from 0 to 1024 [ 143.467591][ T1680] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 143.494323][ T1682] loop1: detected capacity change from 0 to 2048 [ 143.629457][ T1680] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 143.698029][ T807] EXT4-fs (loop2): unmounting filesystem. [ 143.821945][ T315] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 143.844075][ T1686] loop1: detected capacity change from 0 to 512 [ 144.890601][ T1697] netlink: 4 bytes leftover after parsing attributes in process `syz.5.311'. [ 144.912590][ T1686] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a842c018, mo2=0002] [ 144.959315][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 145.081263][ T1691] xt_hashlimit: size too large, truncated to 1048576 [ 145.093175][ T1686] System zones: 0-7 [ 145.097610][ T1686] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 145.112483][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 145.112500][ T28] audit: type=1400 audit(1793850187.429:306): avc: denied { search } for pid=1690 comm="syz.2.310" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 145.241050][ T28] audit: type=1400 audit(1793850187.429:307): avc: denied { read } for pid=1690 comm="syz.2.310" name="id" dev="tracefs" ino=2203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 145.247622][ T1704] xt_hashlimit: size too large, truncated to 1048576 [ 145.286476][ T1702] xt_hashlimit: size too large, truncated to 1048576 [ 145.326080][ T847] EXT4-fs (loop1): unmounting filesystem. [ 145.381685][ T43] Bluetooth: hci0: Frame reassembly failed (-84) [ 145.385478][ T1712] loop1: detected capacity change from 0 to 1024 [ 145.394857][ T43] Bluetooth: hci1: Frame reassembly failed (-84) [ 145.417861][ T1706] xt_hashlimit: size too large, truncated to 1048576 [ 145.461599][ T1712] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 145.501020][ T1712] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 146.652826][ T847] EXT4-fs (loop1): unmounting filesystem. [ 146.974341][ T1728] loop1: detected capacity change from 0 to 512 [ 147.409902][ T1065] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 147.416137][ T338] Bluetooth: hci1: command 0x1003 tx timeout [ 147.416159][ T339] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 147.428407][ T338] Bluetooth: hci0: command 0x1003 tx timeout [ 147.614299][ T28] audit: type=1400 audit(1793850189.929:308): avc: denied { accept } for pid=1732 comm="syz.4.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 147.763286][ T1750] netlink: 4 bytes leftover after parsing attributes in process `syz.5.323'. [ 148.176612][ T1755] loop1: detected capacity change from 0 to 1024 [ 148.204057][ T1755] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 148.320366][ T1755] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 148.864083][ T1768] xt_hashlimit: size too large, truncated to 1048576 [ 149.192236][ T1774] loop2: detected capacity change from 0 to 512 [ 149.199081][ T1776] xt_hashlimit: size too large, truncated to 1048576 [ 149.261613][ T10] Bluetooth: hci0: Frame reassembly failed (-84) [ 149.262056][ T1774] EXT4-fs: Ignoring removed oldalloc option [ 149.315082][ T1774] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 149.379391][ T1774] EXT4-fs (loop2): 1 truncate cleaned up [ 149.441996][ T1774] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 149.739568][ T807] EXT4-fs (loop2): unmounting filesystem. [ 149.814360][ T1782] loop2: detected capacity change from 0 to 1024 [ 149.874403][ T1782] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 149.940751][ T1782] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 151.222828][ T1801] loop5: detected capacity change from 0 to 256 [ 151.241831][ T1801] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 151.329927][ T1065] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 151.329958][ T339] Bluetooth: hci0: command 0x1003 tx timeout [ 151.592853][ T1803] loop4: detected capacity change from 0 to 512 [ 151.638563][ T1803] EXT4-fs: Ignoring removed oldalloc option [ 151.682888][ T1803] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 151.781328][ T1803] EXT4-fs (loop4): 1 truncate cleaned up [ 151.787305][ T1803] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 151.884679][ T847] EXT4-fs (loop1): unmounting filesystem. [ 151.904201][ T1812] xt_hashlimit: size too large, truncated to 1048576 [ 151.978735][ T1816] loop6: detected capacity change from 0 to 256 [ 152.003943][ T811] EXT4-fs (loop4): unmounting filesystem. [ 152.021407][ T1816] FAT-fs (loop6): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 152.076240][ T1820] loop4: detected capacity change from 0 to 512 [ 152.114563][ T1820] EXT4-fs: Ignoring removed oldalloc option [ 152.151704][ T1820] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 152.189978][ T1820] EXT4-fs (loop4): 1 truncate cleaned up [ 152.200925][ T1820] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 152.396299][ T811] EXT4-fs (loop4): unmounting filesystem. [ 153.014222][ T1829] loop6: detected capacity change from 0 to 512 [ 153.059207][ T1829] ext3: Unknown parameter '.' [ 153.388535][ T1831] loop6: detected capacity change from 0 to 256 [ 154.573466][ T1834] binder: 1833:1834 ioctl c0306201 200000000240 returned -14 [ 154.584617][ T1836] loop4: detected capacity change from 0 to 512 [ 154.627615][ T1836] ext3: Unknown parameter '.' [ 154.649707][ T1838] xt_hashlimit: size too large, truncated to 1048576 [ 154.925640][ T1842] loop4: detected capacity change from 0 to 256 [ 156.044809][ T1845] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 156.110825][ T1845] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 156.236870][ T1855] loop5: detected capacity change from 0 to 512 [ 156.254135][ T1859] loop4: detected capacity change from 0 to 512 [ 156.301261][ T1859] ext3: Unknown parameter '.' [ 156.311351][ T1855] ext3: Unknown parameter '.' [ 156.325280][ T1862] device xfrm0 entered promiscuous mode [ 156.376731][ T1862] netlink: 12 bytes leftover after parsing attributes in process `syz.1.353'. [ 157.707965][ T1863] loop5: detected capacity change from 0 to 256 [ 157.718505][ T1865] loop4: detected capacity change from 0 to 256 [ 157.754629][ T339] Bluetooth: hci0: command 0x1003 tx timeout [ 157.840065][ T1065] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 158.340779][ T1869] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28780 sclass=netlink_route_socket pid=1869 comm=syz.5.355 [ 158.493982][ T807] EXT4-fs (loop2): unmounting filesystem. [ 158.547327][ T1874] loop5: detected capacity change from 0 to 1024 [ 158.627432][ T1879] xt_hashlimit: size too large, truncated to 1048576 [ 158.661406][ T1874] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 158.686976][ T1881] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 158.710462][ T1881] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 158.731634][ T1882] loop2: detected capacity change from 0 to 256 [ 158.739104][ T1874] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 158.787919][ T1882] FAT-fs (loop2): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 159.061312][ T1898] loop6: detected capacity change from 0 to 1024 [ 159.190677][ T1898] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 159.861071][ T1898] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 159.890332][ T28] audit: type=1400 audit(1793850202.209:309): avc: denied { write } for pid=1906 comm="syz.1.368" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 160.038431][ T1918] loop4: detected capacity change from 0 to 256 [ 160.067041][ T1918] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 160.089195][ T993] EXT4-fs (loop5): unmounting filesystem. [ 160.882185][ T1928] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 160.957585][ T1928] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 161.132654][ T1930] loop2: detected capacity change from 0 to 512 [ 161.197296][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 161.209958][ T1930] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 161.218701][ T1930] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 161.241618][ T1924] loop1: detected capacity change from 0 to 40427 [ 161.251178][ T1924] F2FS-fs (loop1): fault_injection options not supported [ 161.256220][ T1920] loop5: detected capacity change from 0 to 40427 [ 161.265677][ T1924] F2FS-fs (loop1): fault_type options not supported [ 161.280266][ T1924] F2FS-fs (loop1): invalid crc value [ 161.287210][ T1930] EXT4-fs warning (device loop2): ext4_update_dynamic_rev:1087: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 161.302707][ T1924] F2FS-fs (loop1): Found nat_bits in checkpoint [ 161.303005][ T1933] loop6: detected capacity change from 0 to 1024 [ 161.328671][ T1920] F2FS-fs (loop5): Unrecognized mount option "ÿ00000000000000000000004" or missing value [ 161.338770][ T1933] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 161.422109][ T1930] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.373: bg 0: block 248: padding at end of block bitmap is not set [ 161.447767][ T835] I/O error, dev loop5, sector 40192 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 161.458516][ T1933] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 161.499895][ T1924] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 161.526117][ T1930] Quota error (device loop2): write_blk: dquota write failed [ 161.549203][ T1930] Quota error (device loop2): qtree_write_dquot: Error -28 occurred while creating quota [ 161.580607][ T28] audit: type=1400 audit(1793850203.899:310): avc: denied { read write } for pid=1923 comm="syz.1.371" name="uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 161.630527][ T1930] EXT4-fs error (device loop2): ext4_acquire_dquot:6828: comm syz.2.373: Failed to acquire dquot type 1 [ 161.824645][ T1930] EXT4-fs (loop2): 1 truncate cleaned up [ 161.967753][ T28] audit: type=1400 audit(1793850203.919:311): avc: denied { open } for pid=1923 comm="syz.1.371" path="/dev/uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 162.439627][ T1930] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 162.475372][ T1947] xt_hashlimit: size too large, truncated to 1048576 [ 162.522551][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 162.559525][ T1948] FAT-fs (loop5): Unrecognized mount option "shortname=lowerÿÿÿÿ_xlate=1" or missing value [ 162.591889][ T1952] EXT4-fs: Ignoring removed oldalloc option [ 162.623070][ T1952] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 162.691442][ T1952] EXT4-fs (loop1): 1 truncate cleaned up [ 162.721831][ T1952] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 162.876168][ T1960] netlink: 4 bytes leftover after parsing attributes in process `syz.6.378'. [ 162.911219][ T847] EXT4-fs (loop1): unmounting filesystem. [ 162.923556][ T28] audit: type=1400 audit(2000000000.000:312): avc: denied { create } for pid=1929 comm="syz.2.373" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 163.076804][ T28] audit: type=1400 audit(2000000000.050:313): avc: denied { remount } for pid=1929 comm="syz.2.373" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 163.153248][ T370] Quota error (device loop2): do_check_range: Getting block 0 out of range 1-5 [ 163.173005][ T370] EXT4-fs error (device loop2): ext4_release_dquot:6864: comm kworker/u4:4: Failed to release dquot type 1 [ 163.213839][ T1957] EXT4-fs (loop2): re-mounted. Quota mode: writeback. [ 163.343605][ T807] EXT4-fs (loop2): unmounting filesystem. [ 163.405779][ T1972] netlink: 4 bytes leftover after parsing attributes in process `syz.5.382'. [ 163.511638][ T1974] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 163.749885][ T1974] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 163.781230][ T1974] overlayfs: missing 'lowerdir' [ 163.810528][ T1977] set_capacity_and_notify: 2 callbacks suppressed [ 163.810546][ T1977] loop2: detected capacity change from 0 to 512 [ 163.910719][ T1977] ext3: Unknown parameter '.' [ 163.945518][ T1980] loop1: detected capacity change from 0 to 1024 [ 164.101636][ T1980] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 164.430224][ T1982] loop2: detected capacity change from 0 to 256 [ 165.648227][ T1980] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 165.734468][ T1991] loop2: detected capacity change from 0 to 512 [ 165.763330][ T1991] ext3: Unknown parameter '.' [ 165.790966][ T315] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 166.239614][ T2005] loop2: detected capacity change from 0 to 256 [ 167.065617][ T2006] loop6: detected capacity change from 0 to 256 [ 167.308161][ T847] EXT4-fs (loop1): unmounting filesystem. [ 167.316279][ T2006] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 167.397735][ T2011] loop1: detected capacity change from 0 to 512 [ 167.414696][ T2011] EXT4-fs: Ignoring removed oldalloc option [ 167.429904][ T2011] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 167.464011][ T2011] EXT4-fs (loop1): 1 truncate cleaned up [ 167.477487][ T2011] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 167.727326][ T847] EXT4-fs (loop1): unmounting filesystem. [ 167.762695][ T28] audit: type=1400 audit(2000000004.840:314): avc: denied { ioctl } for pid=2021 comm="syz.2.395" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=24434 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 167.793451][ T2023] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 167.827670][ T2023] overlayfs: missing 'lowerdir' [ 167.840783][ T2026] loop4: detected capacity change from 0 to 512 [ 167.976560][ T2031] loop1: detected capacity change from 0 to 16 [ 167.983447][ T2031] erofs: (device loop1): mounted with root inode @ nid 36. [ 167.993191][ T28] audit: type=1400 audit(2000000005.070:315): avc: denied { read } for pid=2030 comm="syz.1.398" name="file1" dev="loop1" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 168.218125][ T2033] device bridge_slave_0 left promiscuous mode [ 168.224818][ T2033] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.238374][ T2035] device bridge_slave_1 left promiscuous mode [ 168.245114][ T2035] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.349410][ T28] audit: type=1400 audit(2000000005.420:316): avc: denied { accept } for pid=2040 comm="syz.5.400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 168.504624][ T2044] loop5: detected capacity change from 0 to 1024 [ 168.534532][ T2044] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 168.573149][ T2044] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 169.288955][ T2054] loop1: detected capacity change from 0 to 512 [ 169.311755][ T2058] FAULT_INJECTION: forcing a failure. [ 169.311755][ T2058] name failslab, interval 1, probability 0, space 0, times 1 [ 169.448774][ T2054] EXT4-fs: Ignoring removed oldalloc option [ 169.471627][ T2054] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 169.481841][ T2058] CPU: 1 PID: 2058 Comm: syz.2.406 Tainted: G W syzkaller #0 [ 169.490623][ T2058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 169.500690][ T2058] Call Trace: [ 169.503981][ T2058] [ 169.506919][ T2058] __dump_stack+0x21/0x24 [ 169.511271][ T2058] dump_stack_lvl+0x110/0x170 [ 169.515963][ T2058] ? __cfi_dump_stack_lvl+0x8/0x8 [ 169.521005][ T2058] dump_stack+0x15/0x24 [ 169.525172][ T2058] should_fail_ex+0x3bf/0x510 [ 169.529951][ T2058] ? vm_area_alloc+0xe9/0x1a0 [ 169.534647][ T2058] __should_failslab+0xac/0xf0 [ 169.539429][ T2058] should_failslab+0x9/0x20 [ 169.543946][ T2058] kmem_cache_alloc+0x3b/0x320 [ 169.548732][ T2058] vm_area_alloc+0xe9/0x1a0 [ 169.553255][ T2058] mmap_region+0xfab/0x2130 [ 169.557785][ T2058] ? __cfi_mmap_region+0x10/0x10 [ 169.562744][ T2058] ? cap_capable+0x1a6/0x230 [ 169.567350][ T2058] ? cap_capable+0x1a6/0x230 [ 169.571952][ T2058] ? security_capable+0x99/0xc0 [ 169.576817][ T2058] do_mmap+0x858/0xdd0 [ 169.580910][ T2058] ? __cfi_do_mmap+0x10/0x10 [ 169.585520][ T2058] ? release_firmware_map_entry+0x190/0x190 [ 169.591431][ T2058] vm_mmap_pgoff+0x206/0x3f0 [ 169.596036][ T2058] ? __kasan_check_read+0x11/0x20 [ 169.601073][ T2058] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 169.606199][ T2058] ? irqentry_exit+0x37/0x40 [ 169.610807][ T2058] ksys_mmap_pgoff+0xf6/0x1d0 [ 169.615676][ T2058] __x64_sys_mmap+0xfa/0x110 [ 169.620284][ T2058] x64_sys_call+0x8fd/0x9a0 [ 169.624809][ T2058] do_syscall_64+0x4c/0xa0 [ 169.629237][ T2058] ? clear_bhb_loop+0x30/0x80 [ 169.634014][ T2058] ? clear_bhb_loop+0x30/0x80 [ 169.638705][ T2058] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 169.644611][ T2058] RIP: 0033:0x7f2b1819fb19 [ 169.649129][ T2058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 169.668746][ T2058] RSP: 002b:00007f2b19036028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 169.677178][ T2058] RAX: ffffffffffffffda RBX: 00007f2b18425fa0 RCX: 00007f2b1819fb19 [ 169.685170][ T2058] RDX: 0000000000000002 RSI: 0000000000008000 RDI: 0000000000000000 [ 169.693159][ T2058] RBP: 00007f2b19036090 R08: ffffffffffffffff R09: 0000000000000000 [ 169.701149][ T2058] R10: 0000000000002172 R11: 0000000000000246 R12: 0000000000000001 [ 169.709145][ T2058] R13: 00007f2b18426038 R14: 00007f2b18425fa0 R15: 00007ffef4ac76e8 [ 169.717168][ T2058] [ 169.725256][ T993] EXT4-fs (loop5): unmounting filesystem. [ 169.770830][ T2054] EXT4-fs (loop1): 1 truncate cleaned up [ 169.791282][ T2067] loop5: detected capacity change from 0 to 512 [ 169.878973][ T2054] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 170.181961][ T847] EXT4-fs (loop1): unmounting filesystem. [ 170.347027][ T2092] loop1: detected capacity change from 0 to 512 [ 170.366063][ T2092] EXT4-fs: Ignoring removed oldalloc option [ 170.378986][ T2092] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 170.490420][ T2092] EXT4-fs (loop1): 1 truncate cleaned up [ 170.496182][ T2092] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 170.775999][ T847] EXT4-fs (loop1): unmounting filesystem. [ 171.731813][ T2130] loop1: detected capacity change from 0 to 256 [ 171.756838][ T2130] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 172.078559][ T2131] loop5: detected capacity change from 0 to 512 [ 172.108031][ T2131] EXT4-fs (loop5): orphan cleanup on readonly fs [ 172.124372][ T2136] loop2: detected capacity change from 0 to 1024 [ 172.129840][ T2131] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -13 [ 172.145761][ T2131] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 172.146262][ T2136] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 172.160397][ T2131] EXT4-fs error (device loop5): ext4_clear_blocks:883: inode #13: comm syz.5.417: attempt to clear invalid blocks 2 len 1 [ 172.184541][ T2131] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.417: invalid indirect mapped block 1819239214 (level 0) [ 172.239733][ T2131] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.417: invalid indirect mapped block 1819239214 (level 1) [ 172.276917][ T2131] EXT4-fs (loop5): 1 truncate cleaned up [ 172.284049][ T2136] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 172.316742][ T2131] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 172.867487][ T993] EXT4-fs (loop5): unmounting filesystem. [ 173.204258][ T2151] loop6: detected capacity change from 0 to 512 [ 173.229373][ T2151] EXT4-fs: Ignoring removed oldalloc option [ 173.251269][ T2151] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 173.280100][ T2151] EXT4-fs (loop6): 1 truncate cleaned up [ 173.287895][ T2151] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 173.349836][ T295] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 173.418669][ T807] EXT4-fs (loop2): unmounting filesystem. [ 173.486013][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 173.504196][ T2154] xt_hashlimit: size too large, truncated to 1048576 [ 173.511107][ T295] usb 6-1: device descriptor read/64, error -71 [ 173.567482][ T2157] loop6: detected capacity change from 0 to 512 [ 173.628667][ T2157] ext3: Unknown parameter '.' [ 173.809907][ T295] usb 6-1: device descriptor read/64, error -71 [ 173.930750][ T2166] loop6: detected capacity change from 0 to 256 [ 174.089955][ T295] usb 6-1: new low-speed USB device number 3 using dummy_hcd [ 174.289919][ T295] usb 6-1: device descriptor read/64, error -71 [ 174.999846][ T295] usb 6-1: device descriptor read/64, error -71 [ 175.119926][ T295] usb usb6-port1: attempt power cycle [ 175.222467][ T2176] loop6: detected capacity change from 0 to 512 [ 175.245095][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.260589][ T2176] ext3: Unknown parameter '.' [ 175.277406][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.346109][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.355707][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.364802][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.380251][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.399955][ T2180] binder: 2177:2180 ioctl c0306201 200000000240 returned -14 [ 175.407913][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.421569][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.449845][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.459333][ T2178] netlink: 3 bytes leftover after parsing attributes in process `syz.2.431'. [ 175.525944][ T2178] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 175.533383][ T295] usb 6-1: new low-speed USB device number 4 using dummy_hcd [ 175.582807][ T2184] loop6: detected capacity change from 0 to 256 [ 175.594188][ T295] usb 6-1: device descriptor read/8, error -71 [ 175.767333][ T2186] loop1: detected capacity change from 0 to 128 [ 175.881516][ T295] usb 6-1: device descriptor read/8, error -71 [ 175.967340][ T28] audit: type=1400 audit(2000000013.040:317): avc: denied { remount } for pid=2185 comm="syz.1.432" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 176.559875][ T295] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 176.627118][ T295] usb 6-1: device descriptor read/8, error -71 [ 176.679722][ T2194] loop2: detected capacity change from 0 to 512 [ 176.723087][ T2194] EXT4-fs: Ignoring removed oldalloc option [ 176.754724][ T2194] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 176.846281][ T2197] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.853529][ T2197] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.979903][ T2194] EXT4-fs (loop2): 1 truncate cleaned up [ 176.989747][ T2194] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 177.042161][ T2201] xt_hashlimit: size too large, truncated to 1048576 [ 177.175321][ T2208] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 177.216704][ T2210] binder: 2207:2210 ioctl c0306201 200000000240 returned -14 [ 177.256454][ T807] EXT4-fs (loop2): unmounting filesystem. [ 177.274614][ T295] usb 6-1: device descriptor read/8, error -71 [ 177.299907][ T2208] binder: BINDER_SET_CONTEXT_MGR already set [ 177.326213][ T2208] binder: 2207:2208 ioctl 4018620d 200000000300 returned -16 [ 177.399892][ T295] usb usb6-port1: unable to enumerate USB device [ 177.410926][ T28] audit: type=1400 audit(2000000014.490:318): avc: denied { audit_control } for pid=2212 comm="syz.2.439" capability=30 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 177.446544][ T2213] loop2: detected capacity change from 0 to 256 [ 177.475855][ T2213] FAT-fs (loop2): Unrecognized mount option "loginuid" or missing value [ 177.510405][ T28] audit: type=1400 audit(2000000014.590:319): avc: denied { sqpoll } for pid=2216 comm="syz.6.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 177.567528][ T28] audit: type=1400 audit(2000000014.610:320): avc: denied { setattr } for pid=2212 comm="syz.2.439" name="tty1" dev="devtmpfs" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 177.626474][ T2224] xt_hashlimit: size too large, truncated to 1048576 [ 177.700388][ T2228] loop4: detected capacity change from 0 to 256 [ 177.847369][ T2228] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 178.571661][ T2236] loop5: detected capacity change from 0 to 4096 [ 178.589290][ T2236] binder: 2235:2236 ioctl 4018620d 0 returned -22 [ 178.603055][ T2236] binder: 2235:2236 ioctl 4030582b 0 returned -22 [ 178.745316][ T28] audit: type=1400 audit(2000000015.820:321): avc: denied { ioctl } for pid=2246 comm="syz.6.447" path="socket:[27097]" dev="sockfs" ino=27097 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 178.809393][ T2263] loop2: detected capacity change from 0 to 1024 [ 178.833576][ T2263] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 178.877479][ T2263] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 178.888843][ T2265] loop6: detected capacity change from 0 to 512 [ 178.896168][ T2265] EXT4-fs: Ignoring removed oldalloc option [ 178.902800][ T2265] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 178.915679][ T2265] EXT4-fs (loop6): 1 truncate cleaned up [ 178.928075][ T2265] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 179.001526][ T2272] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 179.032080][ T2272] device xfrm0 left promiscuous mode [ 179.055488][ T2273] binder: 2271:2273 ioctl c0306201 200000000240 returned -14 [ 179.747611][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 180.050749][ T807] EXT4-fs (loop2): unmounting filesystem. [ 180.148618][ T2285] xt_hashlimit: size too large, truncated to 1048576 [ 180.470153][ T2305] loop5: detected capacity change from 0 to 512 [ 180.506114][ T28] audit: type=1400 audit(2000000017.580:322): avc: denied { read } for pid=2306 comm="syz.2.460" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 180.593653][ T2312] loop4: detected capacity change from 0 to 512 [ 180.602044][ T2314] __nla_validate_parse: 226 callbacks suppressed [ 180.602061][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.633008][ T2316] loop2: detected capacity change from 0 to 1024 [ 180.640157][ T2312] EXT4-fs: Ignoring removed oldalloc option [ 180.647379][ T2316] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 180.659484][ T2317] binder: 2313:2317 ioctl c0306201 200000000240 returned -14 [ 180.670145][ T2312] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 180.689844][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.700641][ T2312] EXT4-fs (loop4): 1 truncate cleaned up [ 180.706380][ T2312] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 180.715112][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.715699][ T2316] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 180.724380][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.752713][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.761821][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.789945][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.802190][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.821845][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.846028][ T2314] netlink: 3 bytes leftover after parsing attributes in process `syz.5.463'. [ 180.958548][ T2323] loop5: detected capacity change from 0 to 1024 [ 181.036424][ T811] EXT4-fs (loop4): unmounting filesystem. [ 181.099815][ T2323] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 181.294721][ T2323] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 182.044318][ T807] EXT4-fs (loop2): unmounting filesystem. [ 182.081970][ T2335] loop2: detected capacity change from 0 to 1024 [ 182.225386][ T2335] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 182.886035][ T993] EXT4-fs (loop5): unmounting filesystem. [ 182.899940][ T2335] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (32298!=35945) [ 182.920166][ T2335] EXT4-fs: failed to create workqueue [ 182.930966][ T2335] EXT4-fs (loop2): mount failed [ 182.961425][ T2350] xt_hashlimit: size too large, truncated to 1048576 [ 183.065090][ T28] audit: type=1400 audit(2000000020.140:323): avc: denied { read write } for pid=2354 comm="syz.4.473" name="rtc0" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 183.147420][ T2359] loop2: detected capacity change from 0 to 256 [ 183.189602][ T2359] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 183.477598][ T28] audit: type=1400 audit(2000000020.140:324): avc: denied { open } for pid=2354 comm="syz.4.473" path="/dev/rtc0" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 183.513569][ T2363] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 183.553085][ T28] audit: type=1400 audit(2000000020.300:325): avc: denied { ioctl } for pid=2354 comm="syz.4.473" path="/dev/rtc0" dev="devtmpfs" ino=263 ioctlcmd=0x7003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 183.583494][ T2363] binder: 2362:2363 ioctl c0306201 200000000240 returned -14 [ 183.613464][ T2369] loop6: detected capacity change from 0 to 512 [ 183.639478][ T2369] EXT4-fs (loop6): orphan cleanup on readonly fs [ 183.648804][ T2369] EXT4-fs (loop6): Cannot turn on journaled quota: type 0: error -13 [ 183.671675][ T2369] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 183.694498][ T2369] EXT4-fs error (device loop6): ext4_clear_blocks:883: inode #13: comm syz.6.476: attempt to clear invalid blocks 2 len 1 [ 183.717467][ T2369] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #13: comm syz.6.476: invalid indirect mapped block 1819239214 (level 0) [ 183.732617][ T2369] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #13: comm syz.6.476: invalid indirect mapped block 1819239214 (level 1) [ 183.753622][ T2369] EXT4-fs (loop6): 1 truncate cleaned up [ 183.759318][ T2369] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 183.822687][ T2377] FAULT_INJECTION: forcing a failure. [ 183.822687][ T2377] name failslab, interval 1, probability 0, space 0, times 0 [ 183.847746][ T2377] CPU: 0 PID: 2377 Comm: syz.4.479 Tainted: G W syzkaller #0 [ 183.856560][ T2377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 183.867156][ T2377] Call Trace: [ 183.870441][ T2377] [ 183.873372][ T2377] __dump_stack+0x21/0x24 [ 183.877715][ T2377] dump_stack_lvl+0x110/0x170 [ 183.882390][ T2377] ? __cfi_dump_stack_lvl+0x8/0x8 [ 183.887413][ T2377] ? __kasan_check_write+0x14/0x20 [ 183.892529][ T2377] dump_stack+0x15/0x24 [ 183.896685][ T2377] should_fail_ex+0x3bf/0x510 [ 183.901366][ T2377] ? getname_flags+0xba/0x510 [ 183.906046][ T2377] __should_failslab+0xac/0xf0 [ 183.910813][ T2377] should_failslab+0x9/0x20 [ 183.915315][ T2377] kmem_cache_alloc+0x3b/0x320 [ 183.920083][ T2377] getname_flags+0xba/0x510 [ 183.924583][ T2377] __x64_sys_mkdirat+0x7c/0xa0 [ 183.929436][ T2377] x64_sys_call+0x73d/0x9a0 [ 183.933938][ T2377] do_syscall_64+0x4c/0xa0 [ 183.938350][ T2377] ? clear_bhb_loop+0x30/0x80 [ 183.943026][ T2377] ? clear_bhb_loop+0x30/0x80 [ 183.947702][ T2377] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 183.953595][ T2377] RIP: 0033:0x7f1e3339fb19 [ 183.958013][ T2377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.977616][ T2377] RSP: 002b:00007f1e3428d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 183.986031][ T2377] RAX: ffffffffffffffda RBX: 00007f1e33625fa0 RCX: 00007f1e3339fb19 [ 183.994086][ T2377] RDX: 0000000000000004 RSI: 00002000000028c0 RDI: 0000000000000003 [ 184.002057][ T2377] RBP: 00007f1e3428d090 R08: 0000000000000000 R09: 0000000000000000 [ 184.010050][ T2377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.018017][ T2377] R13: 00007f1e33626038 R14: 00007f1e33625fa0 R15: 00007fff5d6cdfc8 [ 184.026008][ T2377] [ 184.085201][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 184.089064][ T2381] loop1: detected capacity change from 0 to 1024 [ 184.118833][ T2381] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 184.145306][ T2384] loop6: detected capacity change from 0 to 1024 [ 184.173078][ T2384] EXT4-fs: Ignoring removed oldalloc option [ 184.181128][ T2384] EXT4-fs: Ignoring removed oldalloc option [ 184.182901][ T2381] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 184.198882][ T2384] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 184.349462][ T2384] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 184.383411][ T2395] loop4: detected capacity change from 0 to 256 [ 184.552546][ T2395] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xd400a224, utbl_chksum : 0xe619d30d) [ 184.593356][ T1308] EXT4-fs (loop6): unmounting filesystem. [ 185.045930][ T847] EXT4-fs (loop1): unmounting filesystem. [ 185.176003][ T2403] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 185.239723][ T2403] binder: 2402:2403 ioctl c0306201 200000000240 returned -14 [ 185.434998][ T2409] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xd400a224, utbl_chksum : 0xe619d30d) [ 185.697788][ T2399] page size migration: [2399 (syz.5.485)] madvise_vma_pad_pages:303: Invalid attempt to madvise padding on MAP_SHARED vma [ 186.114261][ T2399] set_capacity_and_notify: 1 callbacks suppressed [ 186.114385][ T2399] loop5: detected capacity change from 0 to 512 [ 186.181860][ T2399] EXT4-fs (loop5): 1 truncate cleaned up [ 186.290827][ T2399] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 186.370760][ T28] audit: type=1400 audit(2000000023.440:326): avc: denied { setattr } for pid=2398 comm="syz.5.485" name="file0" dev="loop5" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 186.669471][ T993] EXT4-fs (loop5): unmounting filesystem. [ 186.789985][ T2427] loop5: detected capacity change from 0 to 128 [ 186.939978][ T2427] xt_hashlimit: size too large, truncated to 1048576 [ 186.974255][ T2428] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 187.054891][ T2428] FAT-fs (loop5): Filesystem has been set read-only [ 187.288597][ T2432] loop6: detected capacity change from 0 to 2048 [ 187.340477][ T2432] loop6: p1 < > p4 [ 187.346063][ T2432] loop6: p4 size 722688 extends beyond EOD, truncated [ 187.357872][ T2432] overlayfs: './file0' not a directory [ 187.364264][ T28] audit: type=1400 audit(2000000024.430:327): avc: denied { create } for pid=2429 comm="syz.6.492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 187.491863][ T28] audit: type=1400 audit(2000000024.430:328): avc: denied { setopt } for pid=2429 comm="syz.6.492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 187.627614][ T28] audit: type=1400 audit(2000000024.430:329): avc: denied { mounton } for pid=2429 comm="syz.6.492" path="/dev/loop6p1" dev="devtmpfs" ino=1034 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 187.688736][ T28] audit: type=1400 audit(2000000024.430:330): avc: denied { mount } for pid=2429 comm="syz.6.492" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 187.710779][ T28] audit: type=1400 audit(2000000024.430:331): avc: denied { remount } for pid=2429 comm="syz.6.492" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 187.846370][ T28] audit: type=1400 audit(2000000024.920:332): avc: denied { create } for pid=2441 comm="syz.4.495" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 188.080682][ T2451] __nla_validate_parse: 290 callbacks suppressed [ 188.080702][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.131366][ T2454] binder: 2450:2454 ioctl c0306201 200000000240 returned -14 [ 188.137654][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.149882][ T19] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 188.172318][ T2459] loop5: detected capacity change from 0 to 512 [ 188.180691][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.306653][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.335836][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.350931][ T19] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 188.360079][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.644483][ T2465] loop6: detected capacity change from 0 to 256 [ 188.686136][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.734373][ T2465] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 188.769146][ T19] usb 3-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 16 [ 188.841166][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.867922][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 188.867968][ T28] audit: type=1400 audit(2000000025.940:337): avc: denied { create } for pid=2460 comm="syz.6.500" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 188.914915][ T19] usb 3-1: config 1 interface 0 has no altsetting 0 [ 188.919297][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.956746][ T19] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 188.966924][ T19] usb 3-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 16 [ 188.979938][ T19] usb 3-1: config 1 interface 0 has no altsetting 0 [ 188.988255][ T2451] netlink: 3 bytes leftover after parsing attributes in process `syz.4.498'. [ 188.997175][ T19] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 189.016606][ T2451] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 189.023906][ T19] usb 3-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 16 [ 189.038015][ T19] usb 3-1: config 1 interface 0 has no altsetting 0 [ 189.088773][ T19] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 189.108453][ T2470] loop5: detected capacity change from 0 to 1024 [ 189.118018][ T19] usb 3-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 16 [ 189.132363][ T2472] loop4: detected capacity change from 0 to 1024 [ 189.146421][ T2470] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 189.164539][ T2472] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 189.177102][ T19] usb 3-1: config 1 interface 0 has no altsetting 0 [ 189.187633][ T19] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 189.201984][ T19] usb 3-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 16 [ 189.221264][ T19] usb 3-1: config 1 interface 0 has no altsetting 0 [ 189.228697][ T2470] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 189.239435][ T2472] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 189.250215][ T19] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 189.302423][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 189.331064][ T19] usb 3-1: SerialNumber: syz [ 190.719367][ T635] usb 3-1: USB disconnect, device number 4 [ 191.265772][ T993] EXT4-fs (loop5): unmounting filesystem. [ 191.444288][ T811] EXT4-fs (loop4): unmounting filesystem. [ 191.486958][ T2491] loop5: detected capacity change from 0 to 256 [ 191.612527][ T2491] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001fe89, chksum : 0xd400a224, utbl_chksum : 0xe619d30d) [ 195.101476][ T28] audit: type=1400 audit(2000000032.180:338): avc: denied { ioctl } for pid=2499 comm="syz.6.507" path="socket:[29909]" dev="sockfs" ino=29909 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 195.493811][ T2505] FAULT_INJECTION: forcing a failure. [ 195.493811][ T2505] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 195.506930][ T2505] CPU: 1 PID: 2505 Comm: syz.2.506 Tainted: G W syzkaller #0 [ 195.515707][ T2505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 195.525779][ T2505] Call Trace: [ 195.529072][ T2505] [ 195.532019][ T2505] __dump_stack+0x21/0x24 [ 195.536457][ T2505] dump_stack_lvl+0x110/0x170 [ 195.541149][ T2505] ? __cfi_dump_stack_lvl+0x8/0x8 [ 195.546186][ T2505] dump_stack+0x15/0x24 [ 195.550348][ T2505] should_fail_ex+0x3bf/0x510 [ 195.555125][ T2505] should_fail+0xb/0x10 [ 195.559391][ T2505] should_fail_usercopy+0x1a/0x20 [ 195.564521][ T2505] _copy_to_user+0x1e/0x90 [ 195.569127][ T2505] simple_read_from_buffer+0xe9/0x160 [ 195.574516][ T2505] proc_fail_nth_read+0x1a6/0x220 [ 195.579552][ T2505] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 195.585112][ T2505] ? security_file_permission+0x94/0xb0 [ 195.590680][ T2505] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 195.596236][ T2505] vfs_read+0x286/0x930 [ 195.600409][ T2505] ? __cfi_vfs_read+0x10/0x10 [ 195.605096][ T2505] ? __kasan_check_write+0x14/0x20 [ 195.610221][ T2505] ? mutex_lock+0x93/0x1b0 [ 195.614651][ T2505] ? __cfi_mutex_lock+0x10/0x10 [ 195.619523][ T2505] ? __fdget_pos+0x2cd/0x380 [ 195.624128][ T2505] ? ksys_read+0x70/0x260 [ 195.628558][ T2505] ksys_read+0x14a/0x260 [ 195.632813][ T2505] ? __cfi_ksys_read+0x10/0x10 [ 195.637588][ T2505] ? fpregs_restore_userregs+0x128/0x260 [ 195.643238][ T2505] __x64_sys_read+0x7b/0x90 [ 195.647766][ T2505] x64_sys_call+0x2f/0x9a0 [ 195.652203][ T2505] do_syscall_64+0x4c/0xa0 [ 195.656629][ T2505] ? clear_bhb_loop+0x30/0x80 [ 195.661324][ T2505] ? clear_bhb_loop+0x30/0x80 [ 195.666017][ T2505] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 195.671925][ T2505] RIP: 0033:0x7f2b1816034e [ 195.676349][ T2505] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 195.695973][ T2505] RSP: 002b:00007f2b18ff3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 195.704413][ T2505] RAX: ffffffffffffffda RBX: 00007f2b18ff46c0 RCX: 00007f2b1816034e [ 195.712410][ T2505] RDX: 000000000000000f RSI: 00007f2b18ff40a0 RDI: 0000000000000006 [ 195.720660][ T2505] RBP: 00007f2b18ff4090 R08: 0000000000000000 R09: 0000000000000000 [ 195.728651][ T2505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.736633][ T2505] R13: 00007f2b18426218 R14: 00007f2b18426180 R15: 00007ffef4ac76e8 [ 195.744650][ T2505] [ 196.111477][ T28] audit: type=1400 audit(2000000033.190:339): avc: denied { write } for pid=2509 comm="syz.5.509" name="igmp6" dev="proc" ino=4026532352 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 196.259316][ T2519] __nla_validate_parse: 93 callbacks suppressed [ 196.259338][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 196.510263][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 196.519086][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 196.584157][ T2525] binder: 2518:2525 ioctl c0306201 200000000240 returned -14 [ 196.818673][ T2528] loop4: detected capacity change from 0 to 256 [ 196.976967][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 196.998733][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 197.009024][ T2528] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 197.045301][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 197.076018][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 197.115802][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 197.149515][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 197.175722][ T2534] loop2: detected capacity change from 0 to 512 [ 197.184181][ T2519] netlink: 3 bytes leftover after parsing attributes in process `syz.5.512'. [ 197.219625][ T2534] ext3: Unknown parameter '.' [ 197.313770][ T2537] loop5: detected capacity change from 0 to 1024 [ 197.352833][ T2537] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 197.493155][ T2541] loop2: detected capacity change from 0 to 256 [ 198.538286][ T2537] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 198.658379][ T2544] loop2: detected capacity change from 0 to 1024 [ 198.676795][ T2544] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 199.023996][ T2544] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 199.535505][ T993] EXT4-fs (loop5): unmounting filesystem. [ 199.919978][ T807] EXT4-fs (loop2): unmounting filesystem. [ 200.551498][ T2566] loop4: detected capacity change from 0 to 1024 [ 200.625487][ T2566] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 200.715099][ T2566] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 200.848758][ T2563] loop2: detected capacity change from 0 to 512 [ 200.880906][ T2563] EXT4-fs (loop2): orphan cleanup on readonly fs [ 201.050037][ T2563] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -13 [ 201.281489][ T2567] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.503365][ T2567] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.520311][ T2567] device bridge_slave_0 entered promiscuous mode [ 201.537137][ T2563] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 201.570718][ T2567] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.608555][ T2567] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.639353][ T2567] device bridge_slave_1 entered promiscuous mode [ 201.679342][ T2563] EXT4-fs error (device loop2): ext4_clear_blocks:883: inode #13: comm syz.2.521: attempt to clear invalid blocks 2 len 1 [ 201.800582][ T2563] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.521: invalid indirect mapped block 1819239214 (level 0) [ 201.843712][ T811] EXT4-fs (loop4): unmounting filesystem. [ 201.892158][ T2563] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.521: invalid indirect mapped block 1819239214 (level 1) [ 201.940702][ T2563] EXT4-fs (loop2): 1 truncate cleaned up [ 201.948737][ T2584] loop5: detected capacity change from 0 to 512 [ 201.965592][ T2563] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 201.976745][ T2587] __nla_validate_parse: 88 callbacks suppressed [ 201.976764][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.002624][ T2584] EXT4-fs: Ignoring removed oldalloc option [ 202.015513][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.028470][ T2588] binder: BINDER_SET_CONTEXT_MGR already set [ 202.070280][ T2584] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 202.087764][ T2588] binder: 2586:2588 ioctl 4018620d 200000000300 returned -16 [ 202.117626][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.151031][ T2584] EXT4-fs (loop5): 1 truncate cleaned up [ 202.156728][ T2584] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 202.171937][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.200834][ T807] EXT4-fs (loop2): unmounting filesystem. [ 202.219401][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.296342][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.630327][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.639368][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.648493][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.657693][ T2587] netlink: 3 bytes leftover after parsing attributes in process `syz.4.527'. [ 202.701082][ T2587] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 202.801634][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 202.811902][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 202.840367][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 202.860352][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 202.869589][ T993] EXT4-fs (loop5): unmounting filesystem. [ 202.892156][ T491] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.899263][ T491] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.936956][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 202.952750][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 202.966355][ T491] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.973461][ T491] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.993866][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 203.017024][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 203.034848][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 203.050462][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 203.084917][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.154990][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 203.165360][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 203.184201][ T2621] netlink: 'syz.5.537': attribute type 8 has an invalid length. [ 203.205193][ T2567] device veth0_vlan entered promiscuous mode [ 203.212147][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 203.230331][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 203.250255][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 203.260176][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 203.271471][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 203.290036][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 203.298541][ T2567] device veth1_macvtap entered promiscuous mode [ 203.312395][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 203.321334][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 203.329644][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 203.352331][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 203.369804][ T19] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 203.377702][ T491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 203.441807][ T2629] loop7: detected capacity change from 0 to 2048 [ 203.471030][ T8] device veth0_vlan left promiscuous mode [ 203.499888][ T666] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 203.500229][ T2629] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 203.543037][ T2629] EXT4-fs (loop7): re-mounted. Quota mode: none. [ 203.581166][ T19] usb 5-1: Using ep0 maxpacket: 32 [ 203.594275][ T19] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 203.609815][ T19] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 203.626086][ T28] audit: type=1400 audit(2000000040.700:340): avc: denied { mounton } for pid=2628 comm="syz.7.522" path="/0/file1/file0" dev="loop7" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 203.650460][ T19] usb 5-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 203.661781][ T19] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.671766][ T19] usb 5-1: Product: syz [ 203.678302][ T2635] 9pnet: p9_errstr2errno: server reported unknown error [ 203.679799][ T19] usb 5-1: Manufacturer: syz [ 203.690406][ T19] usb 5-1: SerialNumber: syz [ 203.692272][ T666] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 203.704032][ T19] usb 5-1: config 0 descriptor?? [ 203.710045][ T2637] SELinux: Context system_u:object_r:dhcp_state_t:s0 is not valid (left unmapped). [ 203.714030][ T28] audit: type=1400 audit(2000000040.790:341): avc: denied { relabelfrom } for pid=2628 comm="syz.7.522" name="" dev="pipefs" ino=30314 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 203.726781][ T666] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.752171][ T2629] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.759409][ T2629] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.770338][ T19] hub 5-1:0.0: bad descriptor, ignoring hub [ 203.776276][ T19] hub: probe of 5-1:0.0 failed with error -5 [ 203.790133][ T666] usb 6-1: Product: syz [ 203.793036][ T28] audit: type=1400 audit(2000000040.830:342): avc: denied { relabelto } for pid=2628 comm="syz.7.522" name="" dev="pipefs" ino=30314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:object_r:dhcp_state_t:s0" [ 203.801858][ T666] usb 6-1: Manufacturer: syz [ 203.861503][ T666] usb 6-1: SerialNumber: syz [ 204.090009][ T666] usb 5-1: USB disconnect, device number 5 [ 204.139809][ T635] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 204.339915][ T635] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 204.349019][ T635] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.498891][ T2567] EXT4-fs (loop7): unmounting filesystem. [ 204.809830][ T635] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 204.817525][ T666] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 204.999847][ T666] usb 5-1: Using ep0 maxpacket: 16 [ 205.006280][ T666] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 205.017623][ T666] usb 5-1: config 0 interface 0 has no altsetting 0 [ 205.025321][ T635] usb 8-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 205.034729][ T635] usb 8-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 205.043203][ T635] usb 8-1: Product: syz [ 205.047592][ T666] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 205.056685][ T635] usb 8-1: Manufacturer: syz [ 205.061550][ T666] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.069523][ T666] usb 5-1: Product: syz [ 205.073717][ T635] usb 8-1: SerialNumber: syz [ 205.078537][ T666] usb 5-1: Manufacturer: syz [ 205.083410][ T635] usb 8-1: config 0 descriptor?? [ 205.088445][ T666] usb 5-1: SerialNumber: syz [ 205.095875][ T666] usb 5-1: config 0 descriptor?? [ 205.249806][ T635] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 205.429805][ T635] usb 7-1: Using ep0 maxpacket: 32 [ 205.436169][ T635] usb 7-1: config 0 has an invalid interface number: 12 but max is 0 [ 205.444362][ T635] usb 7-1: config 0 has no interface number 0 [ 205.450505][ T635] usb 7-1: config 0 interface 12 has no altsetting 0 [ 205.458457][ T635] usb 7-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 205.467539][ T635] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.475573][ T635] usb 7-1: Product: syz [ 205.479776][ T635] usb 7-1: Manufacturer: syz [ 205.484387][ T635] usb 7-1: SerialNumber: syz [ 205.489512][ T635] usb 7-1: config 0 descriptor?? [ 205.704218][ T19] usb 5-1: USB disconnect, device number 6 [ 206.235969][ T19] usb 6-1: USB disconnect, device number 6 [ 206.669861][ T19] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 206.682331][ T318] usb 3-1: USB disconnect, device number 5 [ 206.849824][ T28] audit: type=1400 audit(2000000043.920:343): avc: denied { nlmsg_read } for pid=2674 comm="syz.2.552" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 206.870292][ T19] usb 6-1: Using ep0 maxpacket: 8 [ 206.881710][ T19] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 206.890881][ T19] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.898957][ T19] usb 6-1: Product: syz [ 206.903225][ T19] usb 6-1: Manufacturer: syz [ 206.907936][ T19] usb 6-1: SerialNumber: syz [ 206.917002][ T19] usb 6-1: config 0 descriptor?? [ 207.209822][ T19] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 207.319827][ T318] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 207.389802][ T19] usb 3-1: Using ep0 maxpacket: 16 [ 207.396069][ T19] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 207.407388][ T19] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 207.416542][ T19] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.424556][ T19] usb 3-1: Product: syz [ 207.428740][ T19] usb 3-1: Manufacturer: syz [ 207.433365][ T19] usb 3-1: SerialNumber: syz [ 207.438749][ T19] usb 3-1: config 0 descriptor?? [ 207.499812][ T318] usb 5-1: Using ep0 maxpacket: 32 [ 207.506028][ T318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 207.516983][ T318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 207.526770][ T318] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 207.535683][ T635] usb 8-1: USB disconnect, device number 2 [ 207.535855][ T318] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.553090][ T318] usb 5-1: config 0 descriptor?? [ 207.851099][ T2691] usb usb1: usbfs: interface 0 claimed by hub while 'syz.7.558' sets config #7 [ 207.953046][ T1698] usb 7-1: USB disconnect, device number 2 [ 207.964093][ T318] hid-generic 0003:0403:6030.0001: unknown main item tag 0x0 [ 207.973395][ T28] audit: type=1326 audit(2000000045.050:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2697 comm="syz.6.561" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5e9499fb19 code=0x0 [ 207.973536][ T318] hid-generic 0003:0403:6030.0001: unknown main item tag 0x0 [ 208.005383][ T318] hid-generic 0003:0403:6030.0001: hidraw0: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 209.109816][ T60] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 209.209848][ T318] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 209.267997][ T643] usb 6-1: USB disconnect, device number 7 [ 209.300869][ T60] usb 8-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 209.310321][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.389805][ T318] usb 7-1: Using ep0 maxpacket: 16 [ 209.396011][ T318] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 209.407940][ T318] usb 7-1: config 0 interface 0 has no altsetting 0 [ 209.415968][ T318] usb 7-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 209.425105][ T318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.433111][ T318] usb 7-1: Product: syz [ 209.437282][ T318] usb 7-1: Manufacturer: syz [ 209.441949][ T318] usb 7-1: SerialNumber: syz [ 209.447031][ T318] usb 7-1: config 0 descriptor?? [ 209.949612][ T318] usb 3-1: USB disconnect, device number 6 [ 210.058219][ T60] usb 5-1: USB disconnect, device number 7 [ 210.138938][ T2743] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 211.026828][ T28] audit: type=1400 audit(2000000048.100:345): avc: denied { ioctl } for pid=2753 comm="syz.4.575" path="/dev/uinput" dev="devtmpfs" ino=262 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 211.028045][ T2754] input: syz1 as /devices/virtual/input/input5 [ 211.109377][ T2760] input: syz1 as /devices/virtual/input/input6 [ 211.119455][ T28] audit: type=1400 audit(2000000048.190:346): avc: denied { read } for pid=2759 comm="syz.4.578" name="ppp" dev="devtmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 211.147091][ T28] audit: type=1400 audit(2000000048.190:347): avc: denied { open } for pid=2759 comm="syz.4.578" path="/dev/ppp" dev="devtmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 211.171161][ T28] audit: type=1400 audit(2000000048.190:348): avc: denied { ioctl } for pid=2759 comm="syz.4.578" path="/dev/ppp" dev="devtmpfs" ino=157 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 211.399815][ T318] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 211.419823][ T1698] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 211.581178][ T318] usb 5-1: unable to get BOS descriptor or descriptor too short [ 211.589565][ T318] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 211.599778][ T318] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 211.600009][ T1698] usb 3-1: Using ep0 maxpacket: 16 [ 211.614134][ T318] usb 5-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 211.619161][ T1698] usb 3-1: unable to get BOS descriptor or descriptor too short [ 211.627145][ T318] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.635735][ T1698] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 178, changing to 7 [ 211.642823][ T318] usb 5-1: Product: syz [ 211.655535][ T1698] usb 3-1: New USB device found, idVendor=1235, idProduct=8214, bcdDevice= 0.40 [ 211.658071][ T318] usb 5-1: Manufacturer: syz [ 211.667319][ T1698] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.671777][ T318] usb 5-1: SerialNumber: syz [ 211.679987][ T1698] usb 3-1: Product: syz [ 211.688474][ T1698] usb 3-1: Manufacturer: syz [ 211.693164][ T1698] usb 3-1: SerialNumber: syz [ 211.862550][ T60] usb 8-1: USB disconnect, device number 3 [ 211.891773][ T318] usb 5-1: MIDIStreaming interface descriptor not found [ 211.905715][ T1698] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 211.919538][ T1698] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 211.929615][ T318] usb 5-1: USB disconnect, device number 8 [ 211.969279][ T1698] usb 3-1: USB disconnect, device number 7 [ 212.018720][ T635] usb 7-1: USB disconnect, device number 3 [ 212.138178][ T2786] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 212.147135][ T2786] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 212.339610][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x94 [ 212.348106][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x6832 [ 212.357376][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x21000060a7 [ 212.378880][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x210000017d [ 212.389478][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x21000061a6 [ 212.398480][ T2790] kvm [2789]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 212.410265][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x21000029aa [ 212.420815][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x21000059cf [ 212.432006][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x2100004018 [ 212.445402][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x21000019fd [ 212.455104][ T2790] kvm [2789]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x210000095d [ 212.489821][ T60] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 212.566200][ T28] audit: type=1326 audit(2000000049.640:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2809 comm="syz.2.599" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b1819fb19 code=0x7ffc0000 [ 212.589309][ T2814] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.608328][ T28] audit: type=1326 audit(2000000049.640:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2809 comm="syz.2.599" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f2b1819fb19 code=0x7ffc0000 [ 212.633118][ T28] audit: type=1326 audit(2000000049.640:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2809 comm="syz.2.599" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b1819fb19 code=0x7ffc0000 [ 212.644686][ T2814] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.665165][ T28] audit: type=1400 audit(2000000049.710:352): avc: denied { create } for pid=2815 comm="syz.4.602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 212.691059][ T60] usb 8-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 212.703235][ T60] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 212.708553][ T2822] input: syz1 as /devices/virtual/input/input7 [ 212.724359][ T60] usb 8-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 212.749840][ T60] usb 8-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 212.758903][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.783360][ T60] usb 8-1: config 0 descriptor?? [ 212.789888][ T60] usb 8-1: Found UVC 9.00 device (046d:0825) [ 212.999822][ T635] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 213.151981][ T2827] input: syz1 as /devices/virtual/input/input8 [ 213.181285][ T635] usb 3-1: unable to get BOS descriptor or descriptor too short [ 213.189681][ T635] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.200039][ T635] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 213.214811][ T635] usb 3-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40 [ 213.224069][ T635] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.232122][ T635] usb 3-1: Product: syz [ 213.236387][ T635] usb 3-1: Manufacturer: syz [ 213.241233][ T635] usb 3-1: SerialNumber: syz [ 213.260110][ T2833] HTB: quantum of class FFF10001 is small. Consider r2q change. [ 213.400530][ T60] uvcvideo 8-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 213.410430][ T60] uvcvideo 8-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 213.419391][ T60] uvcvideo 8-1:0.1: Failed to initialize the device (-5). [ 213.428816][ T60] usb 8-1: USB disconnect, device number 4 [ 213.439837][ T1698] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 213.455066][ T635] usb 3-1: MIDIStreaming interface descriptor not found [ 213.464338][ T635] usb 3-1: USB disconnect, device number 8 [ 213.473139][ T2699] udevd[2699]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 213.609881][ T318] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 213.619819][ T1698] usb 7-1: Using ep0 maxpacket: 16 [ 213.626212][ T1698] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 213.636385][ T1698] usb 7-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 213.647283][ T1698] usb 7-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 213.657176][ T1698] usb 7-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 213.670190][ T1698] usb 7-1: config 0 interface 0 has no altsetting 0 [ 213.676813][ T1698] usb 7-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 213.685876][ T1698] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.694561][ T1698] usb 7-1: config 0 descriptor?? [ 213.799805][ T318] usb 6-1: Using ep0 maxpacket: 32 [ 213.806116][ T318] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 213.815710][ T318] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.945751][ T2843] device syzkaller0 entered promiscuous mode [ 213.954217][ T2843] tipc: Started in network mode [ 213.959122][ T2843] tipc: Node identity 7ed930e13046, cluster identity 4711 [ 213.966558][ T2843] tipc: Enabled bearer , priority 0 [ 213.976030][ T2843] tipc: Resetting bearer [ 213.983525][ T2842] tipc: Resetting bearer [ 213.989564][ T2842] tipc: Disabling bearer [ 214.103923][ T1698] logitech-djreceiver 0003:046D:C53A.0002: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.6-1/input0 [ 214.299837][ T60] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 214.316634][ T1698] usb 7-1: USB disconnect, device number 4 [ 214.479836][ T60] usb 3-1: Using ep0 maxpacket: 8 [ 214.486212][ T60] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 214.494527][ T60] usb 3-1: config 179 has no interface number 0 [ 214.500858][ T60] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 214.511979][ T60] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 214.523261][ T60] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 214.534506][ T60] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 214.545945][ T60] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 214.559211][ T60] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 214.568276][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.577408][ T2847] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 214.805113][ T60] usb 3-1: USB disconnect, device number 9 [ 214.811027][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 214.811051][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 214.872578][ T2858] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 214.882161][ T2858] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 215.009739][ T2871] xt_hashlimit: size too large, truncated to 1048576 [ 215.179842][ T643] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 215.360941][ T643] usb 8-1: too many endpoints for config 1 interface 0 altsetting 13: 33, using maximum allowed: 30 [ 215.371957][ T60] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 215.383781][ T643] usb 8-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 215.397041][ T643] usb 8-1: config 1 interface 0 has no altsetting 0 [ 215.410510][ T643] usb 8-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.40 [ 215.419567][ T643] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.427794][ T643] usb 8-1: Product: syz [ 215.432113][ T643] usb 8-1: Manufacturer: syz [ 215.436771][ T643] usb 8-1: SerialNumber: syz [ 215.458664][ T2876] kvm [2875]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x6261 [ 215.570886][ T60] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 215.581207][ T60] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 215.591140][ T60] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 0.00 [ 215.600431][ T60] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 215.608526][ T60] usb 7-1: SerialNumber: syz [ 215.617174][ T60] usb 7-1: 0:2 : does not exist [ 215.848163][ T643] usbhid 8-1:1.0: can't add hid device: -71 [ 215.854244][ T643] usbhid: probe of 8-1:1.0 failed with error -71 [ 215.861416][ T643] usb 8-1: USB disconnect, device number 5 [ 215.970016][ T19] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 216.022321][ T60] usb 7-1: USB disconnect, device number 5 [ 216.150887][ T19] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 216.161196][ T19] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 216.174124][ T19] usb 3-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 216.183265][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.336191][ T60] usb 6-1: USB disconnect, device number 8 [ 216.471667][ T2899] TCP: TCP_TX_DELAY enabled [ 216.515891][ T28] audit: type=1326 audit(2000000053.590:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.542121][ T28] audit: type=1326 audit(2000000053.590:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.577596][ T28] audit: type=1326 audit(2000000053.620:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.605082][ T28] audit: type=1326 audit(2000000053.620:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.630349][ T28] audit: type=1326 audit(2000000053.620:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=424 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.658247][ T28] audit: type=1326 audit(2000000053.620:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.659805][ T666] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 216.682914][ T28] audit: type=1326 audit(2000000053.620:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.682949][ T28] audit: type=1326 audit(2000000053.640:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.682971][ T28] audit: type=1326 audit(2000000053.640:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2903 comm="syz.5.637" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fd1b599fb19 code=0x7ffc0000 [ 216.682995][ T28] audit: type=1326 audit(2000000053.650:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2905 comm="syz.6.638" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e9499fb19 code=0x7ffc0000 [ 216.859928][ T635] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 216.867509][ T1698] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 216.889849][ T666] usb 8-1: Using ep0 maxpacket: 32 [ 216.896212][ T666] usb 8-1: config 0 has an invalid interface number: 12 but max is 0 [ 216.904325][ T666] usb 8-1: config 0 has no interface number 0 [ 216.910452][ T666] usb 8-1: config 0 interface 12 has no altsetting 0 [ 216.918437][ T666] usb 8-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 216.927597][ T666] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.935720][ T666] usb 8-1: Product: syz [ 216.939915][ T666] usb 8-1: Manufacturer: syz [ 216.944526][ T666] usb 8-1: SerialNumber: syz [ 216.950154][ T666] usb 8-1: config 0 descriptor?? [ 217.049859][ T635] usb 5-1: Using ep0 maxpacket: 32 [ 217.056187][ T1698] usb 6-1: too many endpoints for config 1 interface 0 altsetting 13: 33, using maximum allowed: 30 [ 217.067120][ T1698] usb 6-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 217.080181][ T1698] usb 6-1: config 1 interface 0 has no altsetting 0 [ 217.087972][ T635] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 217.089803][ T60] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 217.097279][ T635] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.112747][ T1698] usb 6-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.40 [ 217.119917][ T19] usb 3-1: USB disconnect, device number 10 [ 217.123204][ T635] usb 5-1: Product: syz [ 217.132212][ T1698] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.141331][ T635] usb 5-1: Manufacturer: syz [ 217.146539][ T1698] usb 6-1: Product: syz [ 217.151102][ T635] usb 5-1: SerialNumber: syz [ 217.157907][ T1698] usb 6-1: Manufacturer: syz [ 217.163523][ T635] usb 5-1: config 0 descriptor?? [ 217.168552][ T1698] usb 6-1: SerialNumber: syz [ 217.280897][ T60] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 217.291145][ T60] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 217.304239][ T60] usb 7-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 217.313337][ T60] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.525738][ T378] usb 7-1: USB disconnect, device number 6 [ 217.589612][ T1698] usbhid 6-1:1.0: can't add hid device: -71 [ 217.595654][ T1698] usbhid: probe of 6-1:1.0 failed with error -71 [ 217.605064][ T1698] usb 6-1: USB disconnect, device number 9 [ 217.679863][ T635] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 217.860870][ T635] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 217.871197][ T635] usb 3-1: New USB device found, idVendor=1164, idProduct=0622, bcdDevice= 0.00 [ 217.880291][ T635] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.146969][ T2945] kvm: pic: non byte write [ 218.245360][ T2951] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.252530][ T2951] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.539829][ T19] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 218.720955][ T19] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 218.731142][ T19] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 218.749985][ T19] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 218.759181][ T19] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 218.768090][ T19] usb 7-1: SerialNumber: syz [ 218.794216][ T19] usb 7-1: 0:2 : does not exist [ 218.933026][ T2973] loop5: detected capacity change from 0 to 2048 [ 218.980748][ T2973] Alternate GPT is invalid, using primary GPT. [ 218.987081][ T2973] loop5: p1 p2 p3 [ 219.006303][ T1698] usb 7-1: USB disconnect, device number 7 [ 219.015383][ T2699] udevd[2699]: inotify_add_watch(7, /dev/loop5p2, 10) failed: No such file or directory [ 219.015574][ T2700] udevd[2700]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 219.037244][ T2511] udevd[2511]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 219.363880][ T1698] usb 8-1: USB disconnect, device number 6 [ 219.377245][ T2978] device syzkaller0 entered promiscuous mode [ 219.579525][ T378] usb 5-1: USB disconnect, device number 9 [ 219.648304][ T2998] syz.6.672 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 219.829798][ T1698] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 220.009818][ T1698] usb 8-1: Using ep0 maxpacket: 32 [ 220.016238][ T1698] usb 8-1: config 0 has an invalid interface number: 188 but max is 0 [ 220.024583][ T1698] usb 8-1: config 0 has no interface number 0 [ 220.030806][ T1698] usb 8-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 220.042260][ T1698] usb 8-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 220.051447][ T1698] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.059423][ T1698] usb 8-1: Product: syz [ 220.063682][ T1698] usb 8-1: Manufacturer: syz [ 220.068284][ T1698] usb 8-1: SerialNumber: syz [ 220.073739][ T1698] usb 8-1: config 0 descriptor?? [ 220.079016][ T2980] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 220.119816][ T378] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 220.287856][ T2980] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 220.299798][ T378] usb 6-1: Using ep0 maxpacket: 16 [ 220.306095][ T378] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 220.316627][ T378] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 220.327000][ T378] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 220.336200][ T378] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.344267][ T378] usb 6-1: Product: syz [ 220.348468][ T378] usb 6-1: Manufacturer: syz [ 220.353098][ T378] usb 6-1: SerialNumber: syz [ 220.398457][ T3006] __nla_validate_parse: 94 callbacks suppressed [ 220.398470][ T3006] netlink: 4 bytes leftover after parsing attributes in process `syz.6.678'. [ 220.418015][ T60] usb 3-1: USB disconnect, device number 11 [ 220.435989][ T3006] device bridge_slave_1 left promiscuous mode [ 220.449791][ T3006] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.496181][ T2980] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem [ 220.517829][ T1698] asix 8-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 220.530692][ T1698] asix: probe of 8-1:0.188 failed with error -71 [ 220.578426][ T378] usb 6-1: 0:2 : does not exist [ 220.591678][ T1698] usb 8-1: USB disconnect, device number 7 [ 220.599608][ T378] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 220.628730][ T378] usb 6-1: USB disconnect, device number 10 [ 221.744241][ T28] kauditd_printk_skb: 16 callbacks suppressed [ 221.744259][ T28] audit: type=1400 audit(2000000058.820:379): avc: denied { write } for pid=3060 comm="syz.4.700" name="trace_marker" dev="tracefs" ino=13525 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 221.898124][ T3068] netlink: 52 bytes leftover after parsing attributes in process `syz.4.703'. [ 222.067075][ T3068] netlink: 'syz.4.703': attribute type 8 has an invalid length. [ 222.084488][ T3068] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 222.097813][ T3068] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 222.753852][ T28] audit: type=1400 audit(2000000059.830:380): avc: denied { create } for pid=3078 comm="syz.4.705" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 222.880277][ T28] audit: type=1400 audit(2000000059.930:381): avc: denied { mounton } for pid=3080 comm="syz.5.707" path="/110/file0" dev="tmpfs" ino=632 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 222.913187][ T3084] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 222.929956][ T28] audit: type=1400 audit(2000000059.950:382): avc: denied { mount } for pid=3083 comm="syz.2.709" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 223.100093][ T3090] netlink: 28 bytes leftover after parsing attributes in process `syz.2.712'. [ 223.155556][ T28] audit: type=1400 audit(2000000059.950:383): avc: denied { write } for pid=3083 comm="syz.2.709" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 223.215748][ T28] audit: type=1400 audit(2000000059.950:384): avc: denied { open } for pid=3083 comm="syz.2.709" path="/dev/mapper/control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 223.377718][ T28] audit: type=1400 audit(2000000059.980:385): avc: denied { ioctl } for pid=3083 comm="syz.2.709" path="/dev/mapper/control" dev="devtmpfs" ino=266 ioctlcmd=0xfd0f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 223.490835][ T28] audit: type=1400 audit(2000000060.040:386): avc: denied { unmount } for pid=807 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 223.533432][ T28] audit: type=1400 audit(2000000060.440:387): avc: denied { mount } for pid=3107 comm="syz.2.717" name="/" dev="configfs" ino=14619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 223.582173][ T28] audit: type=1400 audit(2000000060.440:388): avc: denied { search } for pid=3107 comm="syz.2.717" name="/" dev="configfs" ino=14619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 223.628124][ T3113] loop5: detected capacity change from 0 to 2048 [ 223.700047][ T3113] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 223.713195][ T3113] ext4 filesystem being mounted at /111/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 223.766901][ T3113] overlayfs: failed to set xattr on upper [ 223.778896][ T3113] overlayfs: ...falling back to index=off,metacopy=off. [ 223.827076][ T993] EXT4-fs (loop5): unmounting filesystem. [ 223.857099][ T1698] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 223.870053][ T1698] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 223.889809][ T19] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 223.997896][ T295] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 224.086392][ T3145] device ip6gre1 entered promiscuous mode [ 224.100511][ T1698] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 224.109183][ T3145] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 224.118367][ T1698] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 224.129983][ T1698] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 224.180804][ T295] usb 3-1: Using ep0 maxpacket: 32 [ 224.199346][ T295] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 224.228133][ T295] usb 3-1: config 0 has no interface number 0 [ 224.242064][ T295] usb 3-1: config 0 interface 184 has no altsetting 0 [ 224.270416][ T295] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 224.288195][ T295] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.306246][ T295] usb 3-1: Product: syz [ 224.349992][ T295] usb 3-1: Manufacturer: syz [ 224.379087][ T295] usb 3-1: SerialNumber: syz [ 224.434334][ T295] usb 3-1: config 0 descriptor?? [ 224.479614][ T295] smsc75xx v1.0.0 [ 224.509839][ T19] usb 8-1: Using ep0 maxpacket: 8 [ 224.516105][ T19] usb 8-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 224.527133][ T19] usb 8-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 224.543022][ T19] usb 8-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 224.555941][ T19] usb 8-1: config 0 interface 0 has no altsetting 0 [ 224.594465][ T19] usb 8-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00 [ 224.603778][ T19] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.612712][ T19] usb 8-1: config 0 descriptor?? [ 224.739035][ T3165] loop6: detected capacity change from 0 to 256 [ 224.850986][ T1698] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.090067][ T378] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.161251][ T19] input: HID 046d:c623 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:046D:C623.0004/input/input10 [ 225.210931][ T295] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 225.221871][ T295] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 225.241684][ T19] logitech 0003:046D:C623.0004: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 046d:c623] on usb-dummy_hcd.7-1/input0 [ 225.983927][ T3182] IPv6: NLM_F_CREATE should be specified when creating new route [ 226.690495][ T295] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 226.716875][ T295] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 226.735798][ T60] usb 8-1: USB disconnect, device number 8 [ 226.777194][ T295] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 226.837376][ T295] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 226.863909][ T295] usb 3-1: USB disconnect, device number 12 [ 226.880817][ T3201] device veth0_to_bridge entered promiscuous mode [ 226.912279][ T3201] device veth0_to_bridge left promiscuous mode [ 226.960617][ T3209] netlink: 20 bytes leftover after parsing attributes in process `syz.5.757'. [ 227.008182][ T28] kauditd_printk_skb: 21 callbacks suppressed [ 227.008203][ T28] audit: type=1400 audit(2000000064.080:410): avc: denied { write } for pid=3218 comm="syz.4.762" name="kmsg" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kmsg_device_t tclass=chr_file permissive=1 [ 227.262661][ T295] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 227.832451][ T60] usb 8-1: new full-speed USB device number 9 using dummy_hcd [ 227.979811][ T295] usb 3-1: Using ep0 maxpacket: 32 [ 227.986052][ T295] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 227.997090][ T295] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 228.006890][ T295] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 228.015995][ T295] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.024802][ T295] usb 3-1: config 0 descriptor?? [ 228.041755][ T295] hub 3-1:0.0: USB hub found [ 228.121014][ T60] usb 8-1: config 1 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 228.139948][ T60] usb 8-1: config 1 interface 0 altsetting 2 endpoint 0x3 has invalid maxpacket 513, setting to 64 [ 228.163606][ T60] usb 8-1: config 1 interface 0 altsetting 2 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 228.176880][ T643] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 228.197077][ T60] usb 8-1: config 1 interface 0 has no altsetting 0 [ 228.218032][ T60] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 228.246827][ T60] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 228.260023][ T60] usb 8-1: SerialNumber: syz [ 228.272659][ T295] hub 3-1:0.0: 29 ports detected [ 228.278349][ T295] hub 3-1:0.0: insufficient power available to use all downstream ports [ 228.283299][ T3207] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 228.294172][ T3207] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 228.369807][ T643] usb 5-1: Using ep0 maxpacket: 8 [ 228.377271][ T643] usb 5-1: config 6 has an invalid interface number: 2 but max is 0 [ 228.388525][ T643] usb 5-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 228.403248][ T643] usb 5-1: config 6 has no interface number 0 [ 228.409418][ T643] usb 5-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 228.410230][ T28] audit: type=1400 audit(2000000065.490:411): avc: denied { create } for pid=3257 comm="syz.5.776" name="md0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 228.442831][ T28] audit: type=1400 audit(2000000065.500:412): avc: denied { read write } for pid=3257 comm="syz.5.776" name="md0" dev="tmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 228.467966][ T643] usb 5-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 228.478160][ T28] audit: type=1400 audit(2000000065.500:413): avc: denied { open } for pid=3257 comm="syz.5.776" path="/128/md0" dev="tmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 228.500777][ T28] audit: type=1400 audit(2000000065.520:414): avc: denied { unlink } for pid=993 comm="syz-executor" name="md0" dev="tmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 228.500815][ T643] usb 5-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 228.529409][ T3207] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 228.531784][ T643] usb 5-1: Product: syz [ 228.538475][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 228.542797][ T643] usb 5-1: Manufacturer: syz [ 228.550763][ T3207] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 228.564712][ T643] usb 5-1: SerialNumber: syz [ 228.681113][ T295] usb 3-1: USB disconnect, device number 13 [ 228.836134][ T643] usb 5-1: USB disconnect, device number 10 [ 228.854611][ T3263] loop5: detected capacity change from 0 to 16 [ 228.862759][ T3263] erofs: (device loop5): erofs_init_device: empty device tag @ pos 0 [ 228.872824][ T3263] loop6: detected capacity change from 0 to 7 [ 228.893190][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 228.894598][ T3263] loop5: detected capacity change from 0 to 1024 [ 228.903095][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 228.918273][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 228.922764][ T3263] EXT4-fs (loop5): barriers disabled [ 228.928789][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 228.932243][ T3263] JBD2: no valid journal superblock found [ 228.940588][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 228.953161][ T3263] EXT4-fs (loop5): error loading journal [ 228.955898][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 228.969121][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 228.978578][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 228.987776][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 228.995919][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 229.005116][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 229.046995][ T60] cdc_ether 8-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.7-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 229.279239][ T635] usb 8-1: USB disconnect, device number 9 [ 229.287164][ T635] cdc_ether 8-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.7-1, CDC Ethernet Device [ 229.300911][ T3288] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 229.329891][ T378] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 229.365806][ T3294] loop2: detected capacity change from 0 to 2048 [ 229.403383][ T3294] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 229.416680][ T28] audit: type=1400 audit(2000000066.490:415): avc: denied { execmem } for pid=3303 comm="syz.4.786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 229.438460][ T28] audit: type=1400 audit(2000000066.510:416): avc: denied { rename } for pid=3293 comm="syz.2.784" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 229.489557][ T807] EXT4-fs (loop2): unmounting filesystem. [ 229.529824][ T378] usb 6-1: Using ep0 maxpacket: 8 [ 229.536171][ T378] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 229.547814][ T378] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 229.582194][ T378] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 229.600062][ T28] audit: type=1400 audit(2000000066.510:417): avc: denied { rename } for pid=3293 comm="syz.2.784" name="file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 229.614009][ T378] usb 6-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 229.656657][ T3320] FAULT_INJECTION: forcing a failure. [ 229.656657][ T3320] name failslab, interval 1, probability 0, space 0, times 0 [ 229.672919][ T28] audit: type=1400 audit(2000000066.510:418): avc: denied { unlink } for pid=3293 comm="syz.2.784" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 229.679724][ T378] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 229.730037][ T3320] CPU: 0 PID: 3320 Comm: syz.2.789 Tainted: G W syzkaller #0 [ 229.738850][ T3320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 229.748936][ T3320] Call Trace: [ 229.752242][ T3320] [ 229.755197][ T3320] __dump_stack+0x21/0x24 [ 229.759557][ T3320] dump_stack_lvl+0x110/0x170 [ 229.764349][ T3320] ? __cfi_dump_stack_lvl+0x8/0x8 [ 229.768947][ T378] usb 6-1: config 168 interface 0 has no altsetting 0 [ 229.769399][ T3320] dump_stack+0x15/0x24 [ 229.779037][ T28] audit: type=1400 audit(2000000066.560:419): avc: denied { read } for pid=3293 comm="syz.2.784" name="file1" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 229.780320][ T3320] should_fail_ex+0x3bf/0x510 [ 229.780348][ T3320] __should_failslab+0xac/0xf0 [ 229.780375][ T3320] should_failslab+0x9/0x20 [ 229.810004][ T378] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 229.811686][ T3320] __kmem_cache_alloc_node+0x3d/0x2d0 [ 229.816210][ T378] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 229.823571][ T3320] ? legacy_init_fs_context+0x51/0xb0 [ 229.823594][ T3320] ? legacy_init_fs_context+0x51/0xb0 [ 229.823612][ T3320] kmalloc_trace+0x29/0xb0 [ 229.829526][ T378] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 229.840070][ T3320] legacy_init_fs_context+0x51/0xb0 [ 229.840093][ T3320] alloc_fs_context+0x653/0x7d0 [ 229.840121][ T3320] fs_context_for_mount+0x22/0x30 [ 229.840145][ T3320] __se_sys_fsopen+0xa3/0x2f0 [ 229.845928][ T378] usb 6-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 229.850900][ T3320] __x64_sys_fsopen+0x5b/0x70 [ 229.850923][ T3320] x64_sys_call+0x537/0x9a0 [ 229.850945][ T3320] do_syscall_64+0x4c/0xa0 [ 229.910740][ T3320] ? clear_bhb_loop+0x30/0x80 [ 229.915423][ T3320] ? clear_bhb_loop+0x30/0x80 [ 229.920104][ T3320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 229.926000][ T3320] RIP: 0033:0x7f2b1819fb19 [ 229.930416][ T3320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 229.950023][ T3320] RSP: 002b:00007f2b19036028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 229.958434][ T3320] RAX: ffffffffffffffda RBX: 00007f2b18425fa0 RCX: 00007f2b1819fb19 [ 229.966401][ T3320] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000440 [ 229.974369][ T3320] RBP: 00007f2b18237b70 R08: 0000000000000000 R09: 0000000000000000 [ 229.982339][ T3320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 229.990305][ T3320] R13: 00007f2b18426038 R14: 00007f2b18425fa0 R15: 00007ffef4ac76e8 [ 229.998280][ T3320] [ 230.001387][ T378] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 230.022123][ T378] usb 6-1: config 168 interface 0 has no altsetting 0 [ 230.042439][ T378] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 230.051528][ T378] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 230.076893][ T378] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 230.098613][ T378] usb 6-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 230.127950][ T378] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 230.154441][ T378] usb 6-1: config 168 interface 0 has no altsetting 0 [ 230.168953][ T378] usb 6-1: string descriptor 0 read error: -22 [ 230.196738][ T378] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 230.224469][ T378] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.700382][ T378] usb 6-1: USB disconnect, device number 11 [ 230.849198][ T3367] FAULT_INJECTION: forcing a failure. [ 230.849198][ T3367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.862415][ T3367] CPU: 0 PID: 3367 Comm: syz.2.802 Tainted: G W syzkaller #0 [ 230.871201][ T3367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 230.881246][ T3367] Call Trace: [ 230.884542][ T3367] [ 230.887465][ T3367] __dump_stack+0x21/0x24 [ 230.891789][ T3367] dump_stack_lvl+0x110/0x170 [ 230.896453][ T3367] ? __cfi_dump_stack_lvl+0x8/0x8 [ 230.901462][ T3367] ? avc_has_perm+0x163/0x250 [ 230.906127][ T3367] dump_stack+0x15/0x24 [ 230.910275][ T3367] should_fail_ex+0x3bf/0x510 [ 230.914943][ T3367] should_fail+0xb/0x10 [ 230.919083][ T3367] should_fail_usercopy+0x1a/0x20 [ 230.924094][ T3367] _copy_from_user+0x1e/0xc0 [ 230.928695][ T3367] do_fcntl+0x53c/0x1110 [ 230.932929][ T3367] ? match_file+0x130/0x130 [ 230.937438][ T3367] ? kill_fasync+0x210/0x210 [ 230.942017][ T3367] ? __fget_files+0x2d1/0x330 [ 230.946685][ T3367] ? security_file_fcntl+0x95/0xc0 [ 230.951785][ T3367] __se_sys_fcntl+0xdf/0x1b0 [ 230.956362][ T3367] __x64_sys_fcntl+0x7b/0x90 [ 230.960941][ T3367] x64_sys_call+0x1a9/0x9a0 [ 230.965437][ T3367] do_syscall_64+0x4c/0xa0 [ 230.969842][ T3367] ? clear_bhb_loop+0x30/0x80 [ 230.974506][ T3367] ? clear_bhb_loop+0x30/0x80 [ 230.979171][ T3367] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 230.985052][ T3367] RIP: 0033:0x7f2b1819fb19 [ 230.989454][ T3367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.009048][ T3367] RSP: 002b:00007f2b19036028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 231.017450][ T3367] RAX: ffffffffffffffda RBX: 00007f2b18425fa0 RCX: 00007f2b1819fb19 [ 231.025410][ T3367] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 231.033369][ T3367] RBP: 00007f2b18237b70 R08: 0000000000000000 R09: 0000000000000000 [ 231.041509][ T3367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.049498][ T3367] R13: 00007f2b18426038 R14: 00007f2b18425fa0 R15: 00007ffef4ac76e8 [ 231.057548][ T3367] [ 231.129967][ T635] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 231.181901][ T3371] ================================================================== [ 231.190011][ T3371] BUG: KASAN: use-after-free in sk_skb_adjust_room+0x34e/0x610 [ 231.197592][ T3371] Read of size 8 at addr ffff888120712848 by task syz.2.804/3371 [ 231.205333][ T3371] [ 231.207649][ T3371] CPU: 1 PID: 3371 Comm: syz.2.804 Tainted: G W syzkaller #0 [ 231.216392][ T3371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 231.226517][ T3371] Call Trace: [ 231.229787][ T3371] [ 231.232717][ T3371] __dump_stack+0x21/0x24 [ 231.237058][ T3371] dump_stack_lvl+0x110/0x170 [ 231.241731][ T3371] ? __cfi_dump_stack_lvl+0x8/0x8 [ 231.246744][ T3371] ? pskb_expand_head+0x436/0x12b0 [ 231.251862][ T3371] ? sk_skb_adjust_room+0x34e/0x610 [ 231.257051][ T3371] print_address_description+0x71/0x200 [ 231.262591][ T3371] print_report+0x4a/0x60 [ 231.266918][ T3371] kasan_report+0x122/0x150 [ 231.271425][ T3371] ? sk_skb_adjust_room+0x34e/0x610 [ 231.276630][ T3371] __asan_report_load8_noabort+0x14/0x20 [ 231.282247][ T3371] sk_skb_adjust_room+0x34e/0x610 [ 231.287263][ T3371] bpf_prog_e15ab8bd9cea3c06+0x19/0x20 [ 231.292710][ T3371] sk_psock_verdict_recv+0x1c8/0x7b0 [ 231.297993][ T3371] ? skb_recv_datagram+0x140/0x180 [ 231.303106][ T3371] unix_stream_read_skb+0x13d/0x300 [ 231.308299][ T3371] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 231.314178][ T3371] ? __cfi_sk_psock_verdict_recv+0x10/0x10 [ 231.319983][ T3371] ? __cfi_unix_stream_read_skb+0x10/0x10 [ 231.325689][ T3371] ? __kasan_check_write+0x14/0x20 [ 231.330790][ T3371] ? _raw_spin_lock+0x94/0xf0 [ 231.335452][ T3371] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 231.341245][ T3371] sk_psock_verdict_data_ready+0xaf/0x1d0 [ 231.346954][ T3371] unix_stream_sendmsg+0x631/0xa80 [ 231.352076][ T3371] ? __cfi_unix_stream_sendmsg+0x10/0x10 [ 231.357714][ T3371] ? security_socket_sendmsg+0x93/0xb0 [ 231.363166][ T3371] __sys_sendto+0x4ac/0x660 [ 231.367668][ T3371] ? __cfi___sys_sendto+0x10/0x10 [ 231.372690][ T3371] ? __x64_sys_futex+0x100/0x100 [ 231.377626][ T3371] ? __kasan_check_write+0x14/0x20 [ 231.382724][ T3371] __x64_sys_sendto+0xe5/0x100 [ 231.387478][ T3371] x64_sys_call+0x83/0x9a0 [ 231.391882][ T3371] do_syscall_64+0x4c/0xa0 [ 231.396285][ T3371] ? clear_bhb_loop+0x30/0x80 [ 231.400951][ T3371] ? clear_bhb_loop+0x30/0x80 [ 231.405637][ T3371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 231.411530][ T3371] RIP: 0033:0x7f2b1819fb19 [ 231.415938][ T3371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.435536][ T3371] RSP: 002b:00007f2b19036028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 231.443946][ T3371] RAX: ffffffffffffffda RBX: 00007f2b18425fa0 RCX: 00007f2b1819fb19 [ 231.451910][ T3371] RDX: 0000000000000004 RSI: 0000200000000540 RDI: 0000000000000006 [ 231.459870][ T3371] RBP: 00007f2b18237b70 R08: 0000000000000000 R09: 0000000000000000 [ 231.467830][ T3371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.475799][ T3371] R13: 00007f2b18426038 R14: 00007f2b18425fa0 R15: 00007ffef4ac76e8 [ 231.483770][ T3371] [ 231.486775][ T3371] [ 231.489084][ T3371] Allocated by task 1702: [ 231.493393][ T3371] kasan_set_track+0x4b/0x70 [ 231.497980][ T3371] kasan_save_alloc_info+0x1f/0x30 [ 231.503077][ T3371] __kasan_slab_alloc+0x72/0x80 [ 231.507939][ T3371] slab_post_alloc_hook+0x4f/0x2d0 [ 231.513059][ T3371] kmem_cache_alloc+0x166/0x320 [ 231.517898][ T3371] sk_prot_alloc+0x5f/0x320 [ 231.522389][ T3371] sk_alloc+0x3b/0x460 [ 231.526449][ T3371] unix_create1+0xb8/0x710 [ 231.530849][ T3371] unix_create+0x149/0x200 [ 231.535254][ T3371] __sock_create+0x39e/0x7c0 [ 231.539854][ T3371] __sys_socketpair+0x218/0x5b0 [ 231.544718][ T3371] __x64_sys_socketpair+0x9b/0xb0 [ 231.549756][ T3371] x64_sys_call+0x6e/0x9a0 [ 231.554173][ T3371] do_syscall_64+0x4c/0xa0 [ 231.558585][ T3371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 231.564466][ T3371] [ 231.566794][ T3371] The buggy address belongs to the object at ffff888120712800 [ 231.566794][ T3371] which belongs to the cache UNIX-STREAM of size 1152 [ 231.580918][ T3371] The buggy address is located 72 bytes inside of [ 231.580918][ T3371] 1152-byte region [ffff888120712800, ffff888120712c80) [ 231.594178][ T3371] [ 231.596511][ T3371] The buggy address belongs to the physical page: [ 231.602909][ T3371] page:ffffea000481c400 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888120710000 pfn:0x120710 [ 231.614434][ T3371] head:ffffea000481c400 order:2 compound_mapcount:0 compound_pincount:0 [ 231.622749][ T3371] flags: 0x4000000000010200(slab|head|zone=1) [ 231.628823][ T3371] raw: 4000000000010200 ffffea00043f6e00 dead000000000004 ffff8881088a5200 [ 231.637654][ T3371] raw: ffff888120710000 00000000800c000a 00000001ffffffff 0000000000000000 [ 231.646223][ T3371] page dumped because: kasan: bad access detected [ 231.652633][ T3371] page_owner tracks the page as allocated [ 231.658339][ T3371] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 232, tgid 232 (sshd-session), ts 16057603501, free_ts 0 [ 231.678683][ T3371] post_alloc_hook+0x1f5/0x210 [ 231.683470][ T3371] prep_new_page+0x1c/0x110 [ 231.687986][ T3371] get_page_from_freelist+0x2ca9/0x2d20 [ 231.693553][ T3371] __alloc_pages+0x1fa/0x610 [ 231.698155][ T3371] alloc_slab_page+0x6e/0xf0 [ 231.702748][ T3371] new_slab+0x98/0x3e0 [ 231.706815][ T3371] ___slab_alloc+0x70f/0xb70 [ 231.711411][ T3371] __slab_alloc+0x5e/0xa0 [ 231.715745][ T3371] kmem_cache_alloc+0x1a8/0x320 [ 231.720600][ T3371] sk_prot_alloc+0x5f/0x320 [ 231.725116][ T3371] sk_alloc+0x3b/0x460 [ 231.729209][ T3371] unix_create1+0xb8/0x710 [ 231.733637][ T3371] unix_stream_connect+0x1cd/0xda0 [ 231.738765][ T3371] __sys_connect+0x3da/0x460 [ 231.743361][ T3371] __x64_sys_connect+0x7a/0x90 [ 231.748133][ T3371] x64_sys_call+0x88d/0x9a0 [ 231.752637][ T3371] page_owner free stack trace missing [ 231.758004][ T3371] [ 231.760326][ T3371] Memory state around the buggy address: [ 231.765957][ T3371] ffff888120712700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 231.774012][ T3371] ffff888120712780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 231.782066][ T3371] >ffff888120712800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 231.790121][ T3371] ^ [ 231.796546][ T3371] ffff888120712880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 231.804604][ T3371] ffff888120712900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 231.812660][ T3371] ================================================================== [ 231.820944][ T3371] Disabling lock debugging due to kernel taint [ 231.919845][ T635] usb 5-1: Using ep0 maxpacket: 32 [ 231.926046][ T635] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 231.935472][ T635] usb 5-1: config 0 has no interface number 0 [ 231.941862][ T635] usb 5-1: config 0 interface 12 has no altsetting 0 [ 231.949932][ T635] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 231.958956][ T635] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.967002][ T635] usb 5-1: Product: syz [ 231.971205][ T635] usb 5-1: Manufacturer: syz [ 231.975805][ T635] usb 5-1: SerialNumber: syz [ 231.980969][ T635] usb 5-1: config 0 descriptor?? [ 233.830394][ T60] usb 5-1: USB disconnect, device number 11 [ 238.129890][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!