last executing test programs: 2m42.655713463s ago: executing program 0 (id=17): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0) syz_usb_connect$uac1(0x2, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x1235, 0x8214, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x8, 0x0, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0x13}, [@output_terminal={0x9, 0x24, 0x3, 0x2, 0x405, 0x6, 0x5, 0x44}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x2, 0x1, 0x7f, {0x7, 0x25, 0x1, 0x4, 0x42, 0x367}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x4, 0x10, 0x3, {0x7, 0x25, 0x1, 0xc, 0x3, 0x5}}}}}}}}]}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000014ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x4800) 2m39.457308179s ago: executing program 0 (id=36): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7}, 0x48) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xba7e}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, 0x0}, 0x800) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000100000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$unix(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 2m39.322770235s ago: executing program 0 (id=38): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0x5, 0x1ff001, 0x7f, 0x7b, 0x1}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r0, &(0x7f0000000080), 0x0}, 0x20) r1 = socket(0x10, 0x803, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x8, 0x3, 0x2b0, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x69, 0x8, 0x2}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, [0xff000000], [], 'wg1\x00', 'veth1_to_batadv\x00', {}, {0xff}, 0x0, 0x5, 0x0, 0x1c}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x19, 0xc8ba, 0x7, 0x9, 'syz1\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x310) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 2m39.156069204s ago: executing program 0 (id=40): syz_mount_image$f2fs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x80000c, &(0x7f00000000c0)=ANY=[@ANYBLOB="6673796e635f6d6f64653d706f7369782c6e6f696e6c696e655f646174612c6469736361726400aa19fd46b492dc6cf59d696e6c696e655f64656e7472792c00"], 0x1, 0x550e, &(0x7f0000005980)="$eJzs3M1rI/UfB/BP2u0+//ZXRNDbDixCC5uw6XYXvVXdxQfsUnw4eNI0mYbsJpnSpGntyYNH8eB/IgqePPo3ePDsbfGgeBOUzEx0KwpC08ZuXy+YvGe+mXzm882h8J0pCeDMWkx++akS1+JSRMxHxNWIfL9Sbrm1Ip6PiOsRMffEVinH/xg4HxGXI+LauHhRs1K+9fnN0Y07P7758zffXTh35Yuvv5/drIFZeyEietvF/l6vyKxd5MNyvDHq5NlbHZVZvNF7VB5nRe6lm3mFvcbkvEaet9vF+dn27mCcW91Gc5ztzlY+vt0vLjgYtSd18g88bOzkx610M8/OIMuzfVD0tX9Q/G07GAyLOq2y3kd5+RgOJ1mMp/tpMZ/tR3k2+8NyvKibtdL9cY7KLC8XzazbyvvYPMo3/d/2Vqe/u5+M0p1BJ+snd2r1F2v1u9X6TtZKh+lqtdFr3V1Nltrd8WnVYdrorbWzrN1Na82st5wstZvNar2eLN1LNzuNflKv127XblXvLJd7N5PXHryXdFvJ0jhf6fR3h53uINnKdpLiE8vJSu32S8vJjXryzvpGsvH2/fvrG+9+cO/9By+vv/FqedLhth6nq8nSyq2VlWr9VnWlvnyG5v9J2fQU5w9HUpl1AwCnj/U/MAunff0f1v9TcarWv5O2zur6/xjmD0di/Q8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcGb9sPDl6/nOYnF8pRz/Xzn0THlciYi5iPjtb8zH+UM158s6C/9w/sJfevi2EnmF8TUulNvliFgrt1//f9zfAgAAADy9vvr4+mfFar14WZx1Q5yk4qbN3NUPp1SvEhELi4+nVG1u/PLslIrFcxFxLvaPWOVSmfkNrItH76qQ33I7N61q/8r8obj4RFSKmDvRdgAAgBNxeCVwsqsQAAAATtKns26A2ajE5FHm5Flw/p/3fz4QvHToCAAAADiFKrNuAAAAADh2+frf7/8BAADA0634/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgN/ZuZ+c1KEoDsCnhb7H+5dHjHO34gyW4RIcOjQswE2wBNyCC5A14MwlGDC0JVqDiUlv20i+L2nLvSE/TgmTcy8pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF16Klbz+9uLu7Y52107ae4GAAAAOGZTrObli2k1/lPP/6unzupxFhF5RBzr3Ufxo5E5qnOKT95ffKjhIaJM2H/Gz/r4HRGX9fHyv+tvAQAAAE7B49HZ9WI5q7r16jTtuSoGVS3a5H+vEuVlEVFMnxOl5fvTeaKw8vc9jptEaeUC1iRRWLXkNk6V9iWjxmXy7pJVl7zXcgAAgF40O4F+uxAAAAD6dD10AQwji8NW5mEvuPzn/duG4K/GCAAAAPiGsqELAAAAADpX9v+e/wcAAACnrXr+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF3aFKv5erGctc3Z7tpJczcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwyv68o0AIhEEY7F3fmcz9DysNmpqaVIHw8TcGAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb373l/8TU+NMMvfaWHoeSdZOja1TY+/cOPrD+Po1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX+/OSAiEQBFEwZ/zvpO9/WEnQM4gQAQ2PKmrRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAX/e6X/xNT40wyd9pYOh5J1q4aW1eNvQeNowfj7d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXO/fv20YVBwD8+c7n0gLCCshDEGJggIW6bmnpCgIUMcB/gBSlbgm4/Ggz0KpCysKGMndBMCKEBApb/4fOrdSlbB08lIWx6H7FV7dSTkS+c5rPR3p+X19e7n3fJYryvXcJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApel7szhOX/p5HBXH7jy8sZH2d+f61K2de6tpS+NOk0kfDq9V33QG7SUCAADA0RGX9X0I4X6yu5b2UT+r/5NyTFrz//xiHpf1/HzdX/Zl7Z+2v/588MreRP18nvSkFzcn41NPptJd3CqXxL+PcnOHX9r3E7vZlc/uvcTZFyT6ePvlaZJdz86Pt29/2MvCY4tKHAA4qJNlXwTl70NpP2ozMQCeCb0aY7qVwrus/+P+YvMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWAbT7fB8GXdCCKvdWZy6+/DGxtP6Wzv3Vst27ubNneo501MkIYSLm5PxqQbXsuyuXrv+5fpkMr4yC94P80cWE7weQljwFPsHn9UYE0KbGQoOGkTF9/qy5HM4gpZ/MAEA8MxJipbW9feT3bX0WGclhEe/PF7/v1mJQ836/8Hn5+5U56rW/6PGVtiaDz6tOXC4dfmb4dVr19/evLx+aXxp/NU7p0fvjs6cP3v2/DC7VzJ0xwQAAICD6RWtWv9HK0/u/5+oxKFm/f/tT6Pvq3PFR6v+r2226dd2JgAAAEdWWe7+03naB3u98N361taVUf669/50/tpwrv/LsaJV6/94pe2sAAAAgCZMtzuP7f9fqMSh5v7/C7+++nv1nHEI4XiIsv3/kxtfTy40t5yl1sSfE7e9RgAAANp1vGjV/f8ke/4/2nvkIQohvPVGHhf/BrBW/R9/9MNv1bmqz/+faW6JSyka5Ncj6wchdAdtZwQAAMCh1d9/yHNFS4v9v5PdtS/+OPFJz/P/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE37LwAA//9EikmR") clock_gettime(0xfffffffffffffffe, &(0x7f0000000000)) openat(0xffffffffffffff9c, &(0x7f00000011c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xa142, 0xe7) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(r0, 0x0, 0x40000000, 0x0) ptrace$poke(0x1f, r0, 0x0, 0x240000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040), 0x208e24b) fdatasync(r1) 2m37.526308418s ago: executing program 0 (id=48): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x50) socket(0x10, 0x2, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prlimit64(r0, 0xc, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9ff03076003008cb89e08f086dd", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2m35.306575813s ago: executing program 0 (id=64): socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x3e8, 0x130, 0x98, 0x1f0, 0x130, 0x98, 0x350, 0x350, 0x350, 0x350, 0x350, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'veth1_to_batadv\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0xb}, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0x81}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dummy0\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x8, 0x8, 0x6}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x3, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x448) 2m34.97303743s ago: executing program 32 (id=64): socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x3e8, 0x130, 0x98, 0x1f0, 0x130, 0x98, 0x350, 0x350, 0x350, 0x350, 0x350, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'veth1_to_batadv\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0xb}, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0x81}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dummy0\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x8, 0x8, 0x6}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x3, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x448) 1m58.453280358s ago: executing program 1 (id=282): socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socket(0x10, 0x3, 0x0) r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000730109000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f00000005c0)=""/73}, 0x20) 1m58.280567916s ago: executing program 1 (id=284): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@flat=@handle={0x73682a85, 0xa, 0x1}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_binder={0x77622a85, 0xb, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) 1m57.988151542s ago: executing program 1 (id=286): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m57.724451166s ago: executing program 1 (id=288): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) umount2(&(0x7f0000000140)='./file0/../file0\x00', 0x2) 1m57.44333492s ago: executing program 1 (id=291): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$NL80211_CMD_LEAVE_IBSS(r2, 0x0, 0x4004010) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x800) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0xe0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xfff3, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x20842}]}}]}, 0x3c}}, 0x4044080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 1m56.763226365s ago: executing program 1 (id=296): ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x3, 0xffffffffffffffff, 0x5}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) socket$alg(0x26, 0x5, 0x0) 1m56.584040404s ago: executing program 33 (id=296): ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x3, 0xffffffffffffffff, 0x5}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) socket$alg(0x26, 0x5, 0x0) 59.861104196s ago: executing program 3 (id=624): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r0 = fsopen(&(0x7f0000000000)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x1aa) getdents64(r2, &(0x7f0000004440)=""/4096, 0x1000) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) 58.792305811s ago: executing program 3 (id=636): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000000080), 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000), 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, 0x0) r1 = open(0x0, 0x143bc2, 0x1c0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={r1, 0xb8, 0x8, 0xfffffffffffffff9}) setxattr$system_posix_acl(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000180)='system.posix_acl_default\x00', 0x0, 0x0, 0x1) 57.802815362s ago: executing program 3 (id=648): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x2, 0x0, 0x70bd28, 0x25dfdbfe}, 0x10}}, 0x40408c0) 56.750224717s ago: executing program 3 (id=651): syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x400a8, 0x0, 0xd, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000180), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40000) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x20) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000300), 0xc1d, 0x42e82) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000000)={r0, 0x0, {0x2a12, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe, 0x14, "fee8a2ab78fc179fd1f809000100aca7ca44c6a4b3e00d9683dda1af01000000c0ff12001000000000000000000300", "2809e8dbe1b22d0000b420a1a93c7540f476779e0117613dd4070000ebff08000000000000000000020000000800000000faffffff00", "e7460000102000000000e4440000002000000000000000000000008bd02800", [0xe0]}}) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x3, 0x100) 56.589207596s ago: executing program 3 (id=652): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x17e5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x22, 0x2, 0x3) r3 = socket$isdn(0x22, 0x2, 0x1) close(r3) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000009060102000000f8ffffff00000000000900020073797a310000000005000100070000001c0007800c00018008000140fffffffe0c00028008000140"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) 54.421175368s ago: executing program 3 (id=657): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000e86000)='\x00', 0x1) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) prctl$PR_MCE_KILL(0x21, 0x1, 0x1) syz_clone(0x2004011, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r0) mlock(&(0x7f0000fed000/0x13000)=nil, 0x13000) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) 54.235557887s ago: executing program 34 (id=657): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000e86000)='\x00', 0x1) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) prctl$PR_MCE_KILL(0x21, 0x1, 0x1) syz_clone(0x2004011, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r0) mlock(&(0x7f0000fed000/0x13000)=nil, 0x13000) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) 40.973707932s ago: executing program 7 (id=707): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x20400, 0x43) mknodat$loop(r0, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) r1 = open(&(0x7f0000000140)='./file0\x00', 0x20800, 0x718bb647156ec3b7) chdir(&(0x7f0000000000)='./bus\x00') open$dir(&(0x7f0000000340)='./file1\x00', 0x0, 0x20) linkat(r1, &(0x7f0000000100)='./file1\x00', r1, &(0x7f0000000180)='./file0\x00', 0x1000) unlink(&(0x7f00000004c0)='./file1\x00') openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x28801, 0x12) 40.746337144s ago: executing program 7 (id=711): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0xffffffffffffff00}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c399000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) set_mempolicy(0x3, &(0x7f0000000240)=0x1020fff, 0x6) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f00000004c0), 0x208e24b) 39.378465705s ago: executing program 7 (id=713): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141b42, 0x8) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r4, 0x0, 0x1000, 0x800000000000000) splice(r2, 0x0, r6, 0x0, 0x80, 0x8) write$tun(r3, 0x0, 0x107c) 37.209143797s ago: executing program 7 (id=723): syz_mount_image$exfat(&(0x7f00000005c0), &(0x7f0000000240)='./bus\x00', 0x3010050, &(0x7f0000000600)=ANY=[], 0x41, 0x14fe, &(0x7f0000000700)="$eJzs3Au0ztXWMPA511p/NklPkvuaa/55kssiSXJJSCRJkiS5JSRJkoTEJrckJCH3JPeQ3GIn9/st9yQ5kiQJCUnWN3Q6n/e8nfftnO+c7/V9Z8/fGGvsNff/mfNZa889nv9ljL2/7Ti4av1qlesyM/xT8M9fUgEgBQD6AcA1ABABQKlspbIBDoNMGlP/uTcR/1oPTbvSKxBXkvQ/fZP+p2/S//RN+p++Sf/TN+l/+ib9T9+k/0KkZ1un575WRvod/3PP/0Ge//8/R87//0YOFxvz5fpi13f6B1Kk/+mb9D99k/6nb9L/9E36n75J///NRQCV/pvD0v/0TfovRHp2pZ8/y7iy40r//gkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESB/OhcsMAPxlfqXXJYQQQgghhBBCiH+dkPFKr0AIIYQQQgghhBD/9yEo0GAgggyQEVIgE2SGqyALXA1Z4RpIwLWQDa6D7HA95ICckAtyQx7IC/nAAoEDhhjyQwFIwg1QEG6EQlAYikBR8FAMisNNUAJuhpJwC5SCW6E03AZloCyUg/JwO1SAO6AiVILKcCdUgbugKlSDu6E63AM14F6oCfdBLbgfasMDUAcehLrwENSDh6E+PAIN4FFoCI2gMTSBpv9H+S9CV3gJukF3SIUe0BNehl7QG/pAX+gHr0B/eBUGwGswEAbBYHgdhsAbMBTehGEwHEbAWzASRsFoGANjYRyMh7dhArwDE+FdmASTYQpMhWkwHWbAezATZsFseB/mwAcwF+bBfFgAC+FDWASLIQ0+giXwMSyFZbAcVsBKWAWrYQ2shXWwHjbARtgEm2ELbIVPYBtshx2wE3bBbtgDn8Je+Az2weewH774B/PP/qf8TggIqFChQYMZMAOmYApmxsyYBbNgVsyKCUxgNsyG2TE75sAcmAtzYR7Mg/kwHxISMjLmx/yYxCQWxIJYCAthESyCHj0Wx+JYAm/GklgSS2EpLI2lsQyWxbJYHstjBayAFbEiVsbKWAWrYFWsinfj3XgP1sAaWBNrYi2shbWxNtbBOlgX62I9rIf1sT42wAbYEBtiY2yMTbEpNsNm2BybY0tsia2wFbbG1tgG22BbbIvtsB22x/bYATtgR+yInbAzdsYX8UV8CV/C7lhF9cCe2BN7YS/sg32xL76C/fFVfBVfw4E4CAfj6/g6voFD8QwOw+E4AkdgBTUKR+MYZDUOx+N4nIATcCJOxEk4GSfjVJyG03EGzsCZOAtn4fs4Bz/AD3AezsMFuBAX4iJcjGmYhkvwLC7FZbgcV+BKXIUrcQ2uxTW4HjfgetyEm3ALbsFP8BPcjttxJ+7E3bgbP8VP8TP8DAfiftyPB/AAHsSDeAgP4WE8jEfwCB7Fo3gMj+FxPI4n8CSewpN4Gk/jGTyL5/AcnsfzeAGfz/N1vd2F1w0EdYlRRmVQGVSKSlGZVWaVRWVRWVVWlVAJlU1lU9lVdpVD5VC5VC6VR+VR+VQ+RYoUq1jlV/lVUiVVQVVQFVKFVBFVRHnlVXFVXJVQJVRJVVKVUreq0uo2VUaVVS18eVVeVVAtfUVVSVVWlVUVdZeqqqqpaqq6qq5qqBqqpqqpaqlaqrZ6QNVRPbAPPqQudaa+GoQN1GBsqBqpxqqJegMfU83UUGyuWqiW6gk1HIdha9XMt1FPq7ZqNLZTz6ox+JzqoMZhR/WC6qQ6qy7qRdVVNffdMvz2EaimYi/VW/VRfdVMvEtd6lhV9ZoaqAapwep1tQDfUEPVm2qYGq5GqLfUSDVKjVZj1Fg1To1Xb6sJ6h01Ub2rJqnJaoqaqqap6WqGek/NVLPUbPW+mqM+UHPVPDVfLVAL1YdqkVqs0tRHaon6WC1Vy9RytUKtVKvUarVGrVXr1Hq1QW1Um9RmtUVtVZ+obWq72qF2ql1qt9qjPlV71Wdqn/pc7VdfqAPqT+qg+lIdUl+pw+prdUR9o46qb9Ux9Z06rr5XJ9RJdUr9oE6rH9UZdVadUz+p8+pndUH9oi6qoECjVlproyOdQWfUKTqTzqyv0ln01TqrvkYn9LU6m75OZ9fX6xw6p86lc+s8Oq/Op60m7TTrWOfXBXRS36AL6ht1IV1YF9FFtdfFdHF9ky6hb9Yl9S26lL5Vl9a36TK6rC6ny+vbdQV9h66oK+nK+k5dRd+lq+pq+m5dXd+ja+h7dU19n66l79e19QO6jn5Q19UP6Xr6YV1fP6Ib6Ed1Q91IN9ZNdFP9mG6mH9fNdQvdUj+hW+kndWv9lG6jn9Zt9TO6nX5Wt9fP6Q76ed1Rv6A76c66i/5FX9RBd9PddaruoXvql3Uv3Vv30X11P/2K7q9f1QP0a3qgHqQH69f1EP2GHqrf1MP0cD1Cv6VH6lF6tB6jx+pxerx+W0/Q7+iJ+l09SU/WU/RUPU1P131+qzT778h/52/kD/j13bforfoTvU1v1zv0Tr1L79Z79B69V+/V+/Q+vV/v1wf0AX1QH9SH9CF9WB/WR/QRfVQf1cf0MX1cH9cn9En9k/5Bn9Y/6jP6rD6rf9Ln9Xl94befARg0ymhjTGQymIwmxWQymc1VJou52mQ115iEudZkM9eZ7OZ6k8PkNLlMbpPH5DX5jDVknGETm/ymgEmaG0xBc6MpZAqbIqao8aaYKW5u+qfz/2h9TU1T08w0M81Nc9PStDStTCvT2rQ2bUwb09a0Ne1MO9PetDcdTAfT0XQ0nUwn08V0MV1NV9PNdDOpJtX0NC+bXqa36WP6mn7mFdPf9DcDzAAz0Aw0g81gM8QMMUPNUDPMDDMjzAgz0ow0o81oM9aMNePNeDPBTDATzUQzyUwyU8wUM81MMzPMDDPTzDSzzWwzx8wxc81cM9/MNwvNQrPILDJpJs0sMUvMUrPMLDMrzAqzyqwya8was86sMxvMBrPJbDJLzVaz1Wwz28wOs8PsMrvMHrPH7DV7zT6zz+w3+80Bc8AcNAfNIXPIHDaHzRFzxBw1R80xc8wcN8fNCXPCnDKnzGlz2pwxZ8w5c86cN+fNBXPBXDQXL132RSpSkYlMlCHKEKVEKVHmKHOUJcoSZY2yRokoEWWLskXZo+ujHFHOKFeUO8oT5Y1SwUYUuYijOMofFYiS0Q1RwejGqFBUOCoSFY18VCwqHt0UlYhujkpGt0Sloluj0tFtUZmobFQuKh/dHlWI7ogqRpWiytGdUZXorqhqVC26O6oe3RPViO6Nakb3RbWi+6Pa0QNRnejBqG70UFQvejiqHz0SNYgejRpGjaLGUZOo6b+0fghncj7uu9nuNtX2sD3ty7aX7W372L62n33F9rev2gH2NTvQDrKD7et2iH3DDrVv2mF2uB1h37Ij7Sg72o6xY+04O96+bSfYd+xE+66dZCfbKXaqnWan2xn2PTvTzrKz7ft2jv3AzrXz7Hy7wC60H9pFdrFNsx/ZJfZju9Qus8vtCrvSrrKr7Rq71q6z6+0Gu9FuspvtFrvVfmK32e12h91pd9nddo/91O61n9l99nO7335hD9g/2YP2S3vIfmUP26/tEfuNPWq/tcfsd/a4/d6esCftKfuDPW1/tGfsWXvO/mTP25/tBfuLvWjDpYv7S6d3MmQoA2WgFEqhzJSZslAWykpZKUEJykbZKDtlpxyUg3JRLspDeSgf5aNLmJjyU35KUpIKUkEqRIWoCBUhT56KU3EqQSWoJJWkUlSKSlNpKkNlqByVo9vpdrqD7qBKVInupDvpLrqLqlE1qk7VqQbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpATWghtSQGlNjakpNqRk1o+bUnFpSS2pFrag1taY21IbaUltqR+2oPbWnDtSBOlJH6kSdqAt1oa7UlbpRN0qlVOpJPakX9aI+1If6UT/qT/1pAA2ggTSQBtNgGkJDaCgNpWE0nEbQWzSSRtFoGkNjaRyNp/E0gSbQRJpIk2gSTaEpNI2m0QyaQTNpJs2m2TSH5tBcmkvzaT4tpIW0iBZRGqXRElpCS2kpLafltJJW0mpaTWtpLa2n9bSRNtJm2kxbaStto220g3bQLtpFe2gP7aW9tI/20X7aTwfoAB2kg3SIDtFhOkxH6AgdpaN0jI7RcTpOJ+gEnaJTdJpO0xk6Q+foHJ2nn+kC/UIXKVCKU5DZXeWyuKtdVneNS3GZ3KU4AoBLcS6X2+VxeV0+Z10Ol/OvYnLOFXKFXRFX1HlXzBV3N/0uLuPKunKuvLvdVXB3uIq/i6u7e1wNd6+r6e5z1dzdfxXXcve72u4RV8c96uq6Rq6ea+Lqu0dcA/eoa+gaucauiWvlnnSt3VOujXvatXXP/C5e5Ba7tW6dW+82uL3uM3fO/eSOum/defez6+a6u37uFdffveoGuNfcQDfod/EI95Yb6Ua50W6MG+vG/S6e4qa6aW66m+HeczPdrN/FC92Hbo5Lc3PdPDffLfg1vrSmNPeRW+I+dkvdMrfcrXAr3Sq32q3532td4Ta5zW6L2+M+ddvcdrfD7XS73O5f40v72Oc+d/vdF+6I+8YddF+6Q+6YO+y+/jW+tL9j7jt33H3vTriT7pT7wZ12P7oz7uyv+7+09x/cL+6iCw4YWbFmwxFn4Iycwpk4M1/FWfhqzsrXcIKv5Wx8HWfn6zkH5+RcnJvzcF7Ox5aJHTPHnJ8LcJJv4IJ8IxfiwlyEi7LnYlycb+ISfDOX5Fu4FN/Kpfk2LsNluRyX59u5At/BFbkSV+Y7uUoIXJWr8d1cne/hGnwv1+T7uBbfz7X5Aa7DD3Jdfojr8cNcnx/hBvwoN+RG3JibcFN+jJvx49ycW3BLfoJb8ZPcmp/iNvw0t+VnuB0/y+35Oe7Az3NHfoE7cWfuwi9yV36Ju3F3TuUe3JNf5l7cm/twX+7Hr3B/fpUH8Gs8kAfxYH6dh/AbPJTf5GE8nEfwWzySR/FoHsNjeRyP57d5Ar/DE/ldnsSTeQpP5Wk8nWfwezyTZ/Fsfp/n8Ac8l+fxfF7AC/lDXsSLOY0/4iX8MS/lZbycV/BKXsWreQ2v5XW8njfwRt7Em3kLb+VPeBtv5x28k3fxbt7Dn/Je/oz38ee8n7/gA/wnPshf8iH+ig/z13yEv+Gj/C0f4+/4OH/PJ/gkn+If+DT/yGf4LJ/jn/g8/8wX+Be+yIEhxljFOjZxFGeIM8YpcaY4c3xVnCW+Os4aXxMn4mvjbPF1cfb4+jhHnDPOFeeO88R543yxjSl2McdxnD8uECfjG+KC8Y1xobhwXCQuGvu4WFw8vikuEd8cl4xviUvFt8al49viMnHZ+JH7yse3xxXiO+KKcaW4cnxnXCW+K64aV4vvjqvH98Q14nvjmvF9ccn4/rh2/EBcJ34wrhs/FNeLH47rx4/EDeJH44Zxo7hx3CRuGj8WN4sfj5vHLeKW8RNxq/jJuHX8VNwmfjpuGz/zh8dT4x5xz/jl+OU4hHv1/OSC5MLkh8lFycXJtORHySXJj5NLk8uSy5MrkiuTq5Krk2uSa5PrkuuTG5Ibk5uSm5NbkiFUywgevfLaGx/5DD6jT/GZfGZ/lc/ir/ZZ/TU+4a/12fx1Pru/3ufwOX0un9vn8Xl9Pm89eefZxz6/L+CT/gZf0N/oC/nCvogv6r0v5ov7Jr6pb+qb+cd9c9/Ct/RP+Cf8k/5J/5R/yj/t2/pnfDv/rG/vn/Md/PP+ef+C7+Q7+y7+Rd/Vv+S7+e4+1af6nr6n7+V7+T6+j+/n+/n+vr8f4Af4gX6gH+wH+yF+iB/qh/phfpgf4Uf4kX6kH+1H+7F+rB/vx/sJfoKf6Cf6SX6Sn+Kn+Gl+mp/hZ/iZfqaf7Wf7OYXm+Ll+rp/v5/uFfqFf5Bf5NJ/ml/glfqlf6pf75X6lX+lX+9V+rV/r1/v1fqPf6Df7zX6r3+q3+W1+h9/hd/ldfo/f4/f6vX6f3+f3+/3+gD/gD/qD/pD/yh/2X/sj/ht/1H/rj/nv/HH/vT/hT/pT/gd/2v/oz/iz/pz/yZ/3P/sL/hd/0Qc/PvF2YkLincTExLuJSYnJiSmJqYlpiemJGYn3EjMTsxKzE+8n5iQ+SMxNzEvMTyxILEx8mFiUWJxIS3yUWJL4OLE0sSyxPLEisTKxKhFC3m1xyB8KhGS4IRQMN4ZCoXAoEooGH4qF4uGmUCLcHEqGW0KpcGsoHW4LZULZUC48GhqGRqFxaBKahsdCs/B4aB5ahJbhidAqPBlah6dCm/B0aBueCe3Cs6F9eC50CM+HjuGF0Cl0Dl3Ci6FreCl0C91DaugReoaXQ6/QO/QJfUO/8EroH14NA8JrYWAYFAaH18OQ8EYYGt4Mw8LwMCK8FUaGUWF0GBPGhnFhfHg7TAjvhInh3TApTA5TwtQwLUwPM8J7YWaYFWaH98Oc8EGYG+aF+WFBWBg+DIvC4pAWPgpLwsdhaVgWlocVYWVYFVaHNWFtWBfWhw1hY9gUNoctYWv4JGwL28OOsDPsCrvDnvBp2Bs+C/vC52F/+CIcCH8KB8OX4VD4KhwOX4cj4ZtwNHwbjoXvwvHwfTgRToZT4YdwOvwYzoSz4Vz4KZwPP4cL4ZdwUf5mTQghhBDi76L/4HiPv/G9DACgfpv3BICrt+c+/J9rbszx53lvladVAgCe7t7xob+MKlVSU1N/e+1SDVGBeQCQ+Ov6f4mXQUt4EtpACyjxN9fXW3U+z39QP3krQOb/kJMCl+PL9W/+L+o/9sSIRaXjc9n+m/rzAAoVuJyTCS7Hl+uX/C/q52z2B+vP9OV4gOb/IScLXI4v1y8Oj8Mz0OavXimEEEIIIYQQQvxZb1Wu/R/dP1+6P89jLudkhMvxH92fCyGEEEIIIYQQ4sp7rnOXpx5r06ZF+79vgr89F/jHsmQiE5n8fza50p9MQgghhBBCiH+1yxf9V3olQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFE+vU/8e/ErvQehRBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiCvtfwUAAP//luw5aQ==") mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x80, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0/../file0\x00', 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') mount(0x0, 0x0, 0x0, 0x2200020, 0x0) read$FUSE(r1, &(0x7f0000002380)={0x2020}, 0x2020) 36.702820033s ago: executing program 7 (id=726): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007baaf8ff00000000b7080000341200007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000000000000000000f7ff0000850000006100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r3, 0x2f, 0x28, 0x0, &(0x7f0000000640)="c1dfb080cd21d308098e002f81007e2288a8", 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 35.108990556s ago: executing program 7 (id=731): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) rename(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r3 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000240)=@keyring={'key_or_keyring:', r3, 0x30}) 35.053319259s ago: executing program 35 (id=731): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) rename(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r3 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000240)=@keyring={'key_or_keyring:', r3, 0x30}) 15.199753835s ago: executing program 8 (id=808): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0200000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000100), &(0x7f0000000140)='%+9llu \x00'}, 0x20) r3 = fsmount(r0, 0x1, 0x0) fchdir(r3) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r2}, 0x18) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r4, &(0x7f0000002240)=""/131, 0x83, 0xe5d7) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000540)='./file0\x00', 0x800000, &(0x7f0000000100)={[{@check_strict}, {}, {@mode={'mode', 0x3d, 0x6}}, {@dmode={'dmode', 0x3d, 0x2}}]}, 0x1, 0x52f, &(0x7f0000000ac0)="$eJzs3V1v08gawPHHpRVVOELonCOEqgJDOUcqUglOAkERV15nkg44dmQ7qL1CFW1RRQorykrb3qy4YXel3Q/B7X6I/Qh7vV8C7QdYabvyS0rf0hT6kqr7/0ViJvZ45rGJ/Gia2BYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACCWW7ftkiWe8Ttzqj+3HgatA9b3+ruzo9jl97VP44pY1pUda6/991P9avLPlExm7yZlPCnGZePS1SuP/jM6km8vBwR0KtbWN14udLtLb4YdyJA0tW+iwLScplYmClStWrXvzTYi1TCejua/+023lBtqJw5CNe3eUaVaraJ0cT7o+M264+newod3y7ZdVY+Lbe2EUeDfe1yM3FnjecZvpm2S1Umbh8kH8YmJVaydllLLK92lyqAgk0alwzQqD2pUtsvlUqlcLlUf1B48tO3RPQvsXWRPi+F/aDFcx3r+Bo5iJM//4okRXzoyJ2rflyt1CSWQVp/1uV7+//89feC4Wf4WS8bHt7L8tU+rJyTN/zeydzf65f8+sZzea03WZUNeyoJ0pStL8mboEZ3uqylafDESSSBGWuKkS1S+RElNqlIVW57JrDQkEiUNMeKJlkjmJZJYdPqJciUULY7EEkgoSqbFlTuipCQ1qUlFlGgpyrwE0hFfmlIXJ+1lWVbS4145IMatRqXDNCof0Ij8jz1G81PWoTc43hM4cASbvfwPAAAAAADOLSv963sy/x+T62mtYTxtDzssAAAAAABwjNJv/ieTYiypXReL+T8AAAAAAOeNlV5jZ4lIQW5mtd6VUPwRAAAAAACAcyL9/v9GUhSS2k2xmP8DAAAAAHDe/DDwHvtR+6L16x8ShmPWu/bc/6xVJ2nnrF7Itruwu8e4MXHpz83UaNpXdTTv0tWT1r+yRls3wfyYF8uD4rA+JwDrcr71zgDkJ7mVtbm1mJWLvTXZKIWG8XTRDbxHJXGcyyOxnou/ebXyraS7/6PfumzJ8kp3qfj8dXcxjeVd0su71fwGinvuo3hALG/T+y2k11zsu8dj6YUY+biFbFx7+/6PZJuPfMaY72UqazNVyMrCzv0fT8YsFfvtfR5F6Yh7/l5uZ21uT9/Oin2iKA+Korw9ii86FoeIojIoisoRowCAYVnun4X+ypL45u68+wVnudPJ7u9lOmszPZGeWEcn9jmj24PO6PYRs9sve56B1C/HJuP+vCurfkg2+NB33MgrW8khvPB29Wu5ura+cXdldeHF0oulV+VypWrft+0HZRlLdyMvyD0AgH3s94ydXs7N5v8Dn8Jj3R8wq/731k8KivJcXktXFmUmvdog/cXBvr0Wtv0MYWbArLWw7QkvMwNmdYVtD3o5fNvKCf8vAABwuqYG5OHD5P+ZAfPunbn84Nnx9lwOAABOhg4/WoX4eysMTftZqVYrOfGsVmHgPlGhqTe1Mn6sQ3fW8ZtatcMgDtzASypPTV1HKuq020EYq0YQqnYQmbn0ye8qmo9i3VKRbjl+bNyo7Wkn0soN/NhxY1U3kavana88E83qMN04amvXNIzrxCbwVRR0QlcXlYq03tbQ1LUfm4ZJqr5qh6blhPPqaeB1WlrVdeSGph0HWYe9sYzfCMJW2m1x2AcbAIAzYm194+VCt3sxf9tdepMvOcbKkHcRAADsQpYGAAAAAAAAAAAAAAAAAAAAAODsO/6r/f7plc2zEcZJVMbkTIRB5TQqwz4zAThpfwcAAP//qxdf4A==") 12.653025406s ago: executing program 8 (id=812): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x29, 0x33, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e"], 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x170, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xa}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "52087def75c736f85cc7d27338360e8cb966058f66908611a2da3e15d87ea4bbea3d646bddcbf88d74a8f9e560e73cc92e50a1e1eb696bc28149a6f97bca767db6d5a2e4a0ce4e1f337f52af8d065ab3903bf929f30662e91d6466b050411964902e6bfd3d89271fd28b48677d5cf2caefd8a40abbe65daabf39f028156294855a66954d2349461e5b3fdf380433eb7182203d89bd1637c99109d611ac6ddd1f8bd70df15be1196d73cf82360c81beb73bd89d4e22511b72fa9373f5ff75156b83de4ba43f4325cb81ad4e1ebabd12279a1c2cb16d9b64ac46472168b729780d5697663cde109a2ea16079fdfb016066bd7f663500"}, @TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x6, 0x37, 0xf, 0x7, 0xb, 0x6, 0xffffffff, 0x2, 0x0, 0x14, 0x9, 0x8, 0x6, 0x8bc, 0x6}}]}}]}, 0x170}, 0x1, 0x0, 0x0, 0x240000c2}, 0x0) 7.582481859s ago: executing program 8 (id=828): ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541c, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x64, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x38, r0, 0x1, 0x0, 0x4003, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x8, 0x63}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]]}, 0x38}}, 0x0) 7.269820545s ago: executing program 8 (id=831): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000200), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = fcntl$dupfd(r2, 0x406, r0) read$alg(r3, &(0x7f0000000940)=""/245, 0xf5) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x3, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050) sendmsg$IPCTNL_MSG_CT_GET_DYING(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 6.56913981s ago: executing program 2 (id=832): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) pipe2(&(0x7f0000000940), 0x84000) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = socket(0x1, 0x80802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00', 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$packet(0x11, 0x2, 0x300) bind$packet(r3, &(0x7f00000000c0)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000), 0x8) 6.516644844s ago: executing program 5 (id=833): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r0, 0x10820, 0x400}}, 0x20}}, 0x4084) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000540), 0x1, 0x4a3, &(0x7f0000000580)="$eJzs3c1rXOUaAPBnZpo0SXNvP+7l0vbCbaEXej9oJh9IE3XjSl0UxIIbhRqTaayZZEJmUpvQRaq7LlyIoiAu3PsXuLEriyCudS8upKI1ggrCyDkzk+Zr4qBpBnJ+Pzid95z3dJ73zfC8nHnPOXMCyKyzyT+5iMGI+DwijjZWN+9wtvGydv/mVLLkol6//F0u3S9Zb+3a+n9HImI1Ivoi4tknI17KbY9bXV6ZnSyXS4vN9WJtbqFYXV65cG1ucqY0U5ofGb84MTE+PDY6sWd9vf3GK7cvffR074c/vX7v7puffJw0a7BZt7Efe6nR9Z44vmHboYh4/GEE64JCsz/93W4If0jy+f0tIs6l+X80CumnCWRBvV6v/1o/3K56tQ4cWPn0GDiXH4qIRjmfHxpqHMP/PQby5Uq19v+rlaX56cax8rHoyV+9Vi4NN78rHIueXLI+kpYfrI9uWR+LSI+B3yr0p+tDU5Xy9P4OdcAWR7bk/4+FRv4DGeErP2SX/Ifskv+QXfIfskv+Q3bJf8gu+Q/ZJf8hu+Q/ZJf8h+yS/5BJz1y6lCz11v3v09eXl2Yr1y9Ml6qzQ3NLU0NTlcWFoZlKZSa9Z2fu996vXKksjDwSSzeKtVK1Vqwur1yZqyzN166k9/VfKfXsS6+AThw/c+fLXESsPtqfLoneZp1chYOtXs9Ft+9BBrqj0O0BCOgaU3+QXb7jAzv8RO8mfe0qFva+LcD+yHe7AUDXnD/l/B9klfl/yC7z/5BdjvEB8/+QPeb/IbsG2zz/6y8bnt01HBF/jYgvCj2HW8/6Ag6C/De55vH/+aP/Htxa25v7OT1F0BsRr753+Z0bk7Xa4kiy/fv17bV3m9tHu9F+oFOtPG3lMQCQXWv3b061lv2M++0TjYsQtsc/1Jyb7EvPUQ6s5TZdq5Dbo2sXVm9FxMmd4ueazztvnPkYWCtsi3+i+ZprvEXa3kPpc9P3J/6pDfH/tSH+6T/9V4FsuJOMP8M75V8+zelYz7/N48/gHl070X78y6+Pf4U249+ZDmO8/P5rX7eNfyvi9I7xW/H60lhb4ydtO99h/HsvPPePdnX1Dxrvs1P8lqRUrM0tFKvLKxfS35GbKc2PjF+cmBgfHhudKKZz1MXWTPV2j5387O5u/R9oE3+3/ifb/tth/3/556fPn90l/n/O7fz5n9glfn9E/K/D+D+MfvViu7ok/nSb/ud3iZ9sG+swfvXtpw53uCsAsA+qyyuzk+VyaVFBQUFhvdDtkQl42B4kfbdbAgAAAAAAAAAAAHRqPy4n7nYfAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgt8CAAD//1kn1ls=") r1 = add_key$keyring(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setgroups(0x40000000000002e6, &(0x7f0000000140)=[0x0]) keyctl$chown(0x4, r1, 0xee01, r2) keyctl$setperm(0x5, r1, 0x30925) keyctl$KEYCTL_MOVE(0x3, r1, 0x0, 0x0, 0x0) 6.439294407s ago: executing program 2 (id=835): syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@out_dx={0x6a, 0x28, {0x6769, 0x4, 0x2000000}}], 0x28}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@code={0x1, 0x87, {"0f22e5c744240060420000c744240233d8cecbc7442406000000000f011c24660f38816810c4027958b20000000064449966baf80cb83284af80ef66bafc0c66ed66baf80cb8cc07ff8aef66bafc0cb8d4000000ef48b8f8000000000000000f23c00f21f835030009000f23f8450f2244c4417c50cc"}}], 0x87}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x36900, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0xaaa, &(0x7f0000000240), 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x60200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x9, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x68ff, 0x4, 0x0, 0x3, 0x401], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.416231958s ago: executing program 6 (id=836): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x6, 0x1f, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0xdb, 0x8, 0xb}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000240)={0x2, 0x5, 0x40003}) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) close_range(r0, 0xffffffffffffffff, 0x0) 6.097193275s ago: executing program 2 (id=838): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc8) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_STATX(r2, &(0x7f0000000280)={0x130, 0x0, 0x0, {0xfffffffffffffff7, 0x5, 0x0, '\x00', {0x400, 0x6e, 0x324e, 0x2, 0x0, 0x0, 0xa000, '\x00', 0x7, 0x0, 0xdf, 0x80000001, {0x6, 0x4}, {0xf}, {0x8b6, 0xc3c2e36}, {0x200, 0x8}, 0x1, 0x2, 0x7, 0x98}}}, 0x130) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) chdir(&(0x7f0000000180)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0) 6.071688037s ago: executing program 8 (id=839): socket$kcm(0x21, 0x2, 0x2) syz_open_dev$radio(0x0, 0x0, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/fscaps', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x80000008) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={0x38, r2, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x44}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x25}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) 5.944355633s ago: executing program 6 (id=840): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(0x0, 0x0) socket(0x11, 0x0, 0x10001) syz_open_dev$usbfs(0x0, 0x7, 0x201100) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) recvfrom$l2tp(r1, 0x0, 0x0, 0x0, 0x0, 0x0) shutdown(r1, 0x0) 5.388558192s ago: executing program 5 (id=841): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) 5.338651115s ago: executing program 8 (id=842): syz_usb_connect$cdc_ecm(0x2, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x108, 0x9) writev(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0xc031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socketpair$nbd(0x1, 0x1, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100000000001, 0x0) read$watch_queue(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x17) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x9, 0x4, 0x0, &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_sock=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 5.153155264s ago: executing program 6 (id=844): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000540)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/57, 0xd000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000180)={0x1, 0x0, [{0x0, 0x6f, &(0x7f00000005c0)=""/111}]}) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffa}, 0x94) 5.140472954s ago: executing program 2 (id=845): io_setup(0x8, &(0x7f0000000600)=0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) io_submit(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000000140)={0x0, 0x4, 0x0, 0x1, 0x0, r1, &(0x7f00000000c0)="01", 0x400000}]) 4.949143315s ago: executing program 4 (id=847): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x1000d, 0x0, 0x0, 0x41100}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) ioctl(r0, 0x8b1a, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, 0x0, 0x24044884) r4 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 4.493034818s ago: executing program 4 (id=848): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_emit_ethernet(0x77, &(0x7f00000005c0)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4a300", 0x41, 0x3a, 0x1, @remote, @mcast2, {[], @param_prob={0x4, 0x2, 0x0, 0x6, {0xc, 0x6, "fdcd53", 0x200, 0x2c, 0xff, @dev={0xfe, 0x80, '\x00', 0x35}, @local, [@hopopts={0x2b}], "81d7a040d5c56b1e34"}}}}}}}, 0x0) setsockopt$bt_BT_VOICE(r0, 0x112, 0x13, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x5c, 0x0, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x175d7e02a3aac1c6}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40010}, 0x2004c800) r2 = dup(r0) ioctl$TCSBRK(r2, 0x5409, 0xa5) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000380)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x64, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x3, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{0x5c0, 0x4, 0x4}, [@TCA_EM_META_LVALUE={0x8, 0x2, [@TCF_META_TYPE_VAR, @TCF_META_TYPE_INT=0x6, @TCF_META_TYPE_VAR]}, @TCA_EM_META_HDR={0xc, 0x1, {{0x0, 0x8, 0x1}, {0x5, 0x2, 0x2}}}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000040)=@filter={'filter\x00', 0xe, 0x4, 0x2b8, 0xffffffff, 0x0, 0x188, 0x188, 0xffffffff, 0xffffffff, 0x220, 0x220, 0x220, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@uncond, 0x0, 0xb0, 0xf0, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x7, 0x2, 0x3, 0x2, 0x1, 0x1], 0x6, 0x5}}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x6, 0x46, {0x7}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x6, 0x4}, {0xffffffffffffffff, 0x3, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) 4.477514959s ago: executing program 6 (id=849): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)={[&(0x7f0000000300)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m', 0x0]}) 3.576858385s ago: executing program 5 (id=850): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0200000001"], 0x48) r3 = fsmount(r0, 0x1, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000100), &(0x7f0000000140)='%pK \x00'}, 0x20) fchdir(r3) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r2}, 0x18) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000007f00)={0x2020}, 0x4b) read$FUSE(r4, &(0x7f0000009f40)={0x2020}, 0x2020) 3.444807212s ago: executing program 4 (id=851): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xe}, {0x3}, {0xfff3}}}, 0x24}}, 0x0) 2.251726164s ago: executing program 6 (id=855): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) 1.111467723s ago: executing program 4 (id=856): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) 1.067357805s ago: executing program 2 (id=857): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) r1 = socket$packet(0x11, 0x2, 0x300) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newlink={0xec, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_AF_SPEC={0xcc, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0x2, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x4, 0x1, 0x0, 0x1, [{0x3}, {0x8}, {0x4}, {0x8}, {0x8}]}}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x11}, {0x8}]}}, @AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x0, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x0, 0x7, @dev}]}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET6={0x0, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x0, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_ADDR_GEN_MODE, @IFLA_INET6_ADDR_GEN_MODE, @IFLA_INET6_TOKEN={0x0, 0x7, @dev}, @IFLA_INET6_TOKEN={0x0, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x0, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_TOKEN={0x0, 0x7, @private1}, @IFLA_INET6_ADDR_GEN_MODE, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_MPLS={0x4}]}]}, 0xec}}, 0x0) 1.051632326s ago: executing program 5 (id=858): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x1}, 0x1c) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xaf4, 0x0) shutdown(r1, 0x0) 989.639079ms ago: executing program 6 (id=859): fsmount(0xffffffffffffffff, 0x1, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3f}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x4000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x800000}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 419.915708ms ago: executing program 5 (id=860): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0x0) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200)) io_uring_setup(0x7d3, 0x0) 0s ago: executing program 4 (id=861): r0 = inotify_init() mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x300f401, 0x0, 0x2, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3) getdents(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002240)='blkio.bfq.io_serviced\x00', 0x275a, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r2, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000390000/0x1000)=nil) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): T4227] Bluetooth: hci4: command 0x040f tx timeout [ 58.770089][ T4227] Bluetooth: hci3: command 0x040f tx timeout [ 58.770284][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.792569][ T4261] loop2: detected capacity change from 0 to 256 [ 58.792801][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.810473][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.822028][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.833584][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.845013][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.859307][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.881916][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 58.893540][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 58.899139][ T4261] ======================================================= [ 58.899139][ T4261] WARNING: The mand mount option has been deprecated and [ 58.899139][ T4261] and is ignored by this kernel. Remove the mand [ 58.899139][ T4261] option from the mount to silence this warning. [ 58.899139][ T4261] ======================================================= [ 58.912256][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 58.975604][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.054026][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.073992][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.085317][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.101124][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.115026][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.133710][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 59.150141][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.175708][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.192438][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.204685][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.221935][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.236181][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.254449][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.273373][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.294944][ T4261] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 59.320739][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 59.343508][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 59.371938][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 59.394677][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 59.417022][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 59.434744][ T4192] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.460480][ T4192] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.471886][ T4192] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.492942][ T4192] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.524077][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.541370][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.583324][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.594740][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.618572][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.637675][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.670587][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.683190][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.695964][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 59.716466][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 59.739597][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 59.790311][ T4275] netlink: 1363 bytes leftover after parsing attributes in process `syz.2.9'. [ 59.822009][ T4193] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.842002][ T4193] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.855088][ T4193] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.866488][ T4193] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.918170][ T150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.933385][ T150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.974455][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.087730][ T150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.102811][ T150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.103688][ T4283] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 60.134637][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.209920][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.234532][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.249531][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.254671][ T4292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15'. [ 60.269703][ T4292] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15'. [ 60.287777][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.303132][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.314433][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.410737][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.424816][ T4241] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.428691][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.467954][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.479495][ T4241] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.526449][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 61.254639][ T13] Bluetooth: hci0: command 0x0419 tx timeout [ 61.262058][ T13] Bluetooth: hci1: command 0x0419 tx timeout [ 61.269711][ T13] Bluetooth: hci2: command 0x0419 tx timeout [ 61.276059][ T4223] Bluetooth: hci3: command 0x0419 tx timeout [ 61.319800][ T4223] Bluetooth: hci4: command 0x0419 tx timeout [ 61.568616][ T4303] IPv6: Can't replace route, no match found [ 61.667083][ T4224] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 62.757267][ C1] sched: RT throttling activated [ 62.859265][ T4334] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 63.051247][ T4306] tipc: Started in network mode [ 63.090517][ T4306] tipc: Node identity ac1414aa, cluster identity 4711 [ 63.122235][ T4306] tipc: Enabled bearer , priority 10 [ 63.207453][ T4224] usb 1-1: unable to get BOS descriptor or descriptor too short [ 63.328023][ T4224] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 63.356672][ T4224] usb 1-1: can't read configurations, error -71 [ 63.425037][ T4355] tipc: Failed to remove unknown binding: 66,1,1/0:1132722632/1132722634 [ 63.445189][ T4355] tipc: Failed to remove unknown binding: 66,1,1/0:1132722632/1132722634 [ 63.460949][ T4355] tipc: Failed to remove unknown binding: 66,1,1/0:1132722632/1132722634 [ 63.541745][ T4223] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 63.868190][ T4367] 9pnet: p9_errstr2errno: server reported unknown error 184467440737 [ 63.957641][ T4223] usb 3-1: unable to get BOS descriptor or descriptor too short [ 64.017507][ T4223] usb 3-1: not running at top speed; connect to a high speed hub [ 64.092851][ T4371] 9pnet: p9_errstr2errno: server reported unknown error @c0x0000000000000007 [ 64.117699][ T4223] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 128, changing to 4 [ 64.142330][ T4223] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 64.166662][ T4223] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 255, changing to 4 [ 64.244155][ T4227] tipc: Node number set to 2886997162 [ 64.349117][ T4223] usb 3-1: New USB device found, idVendor=1235, idProduct=8214, bcdDevice= 0.40 [ 64.376051][ T4223] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.412664][ T4223] usb 3-1: Product: syz [ 64.433361][ T4223] usb 3-1: Manufacturer: syz [ 64.451156][ T4223] usb 3-1: SerialNumber: syz [ 64.713129][ T4373] loop0: detected capacity change from 0 to 40427 [ 64.720115][ T4379] netlink: 24 bytes leftover after parsing attributes in process `syz.4.42'. [ 64.818750][ T4373] F2FS-fs (loop0): invalid crc value [ 64.843678][ T4349] netlink: 4 bytes leftover after parsing attributes in process `syz.2.29'. [ 64.894742][ T4373] F2FS-fs (loop0): Found nat_bits in checkpoint [ 65.046430][ T4373] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 65.258616][ T4223] usb 3-1: 2:1 : no UAC_FORMAT_TYPE desc [ 65.365149][ T4223] usb 3-1: USB disconnect, device number 2 [ 65.427071][ T4398] attempt to access beyond end of device [ 65.427071][ T4398] loop0: rw=2049, want=79632, limit=40427 [ 65.449874][ T26] audit: type=1326 audit(1777003469.136:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4399 comm="syz.3.47" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb5c4aeddd9 code=0x0 [ 65.631047][ T4188] F2FS-fs (loop0): Inconsistent error blkaddr:5633, sit bitmap:0 [ 65.640242][ T4188] CPU: 0 PID: 4188 Comm: syz-executor Not tainted syzkaller #0 [ 65.648420][ T4188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 65.659010][ T4188] Call Trace: [ 65.662378][ T4188] [ 65.665518][ T4188] dump_stack_lvl+0x188/0x250 [ 65.670646][ T4188] ? show_regs_print_info+0x20/0x20 [ 65.676009][ T4188] ? f2fs_get_next_page_offset+0x6a0/0x6a0 [ 65.681995][ T4188] f2fs_is_valid_blkaddr+0xc3b/0x1250 [ 65.687536][ T4188] f2fs_map_blocks+0xbcd/0x3300 [ 65.692577][ T4188] ? f2fs_force_buffered_io+0x680/0x680 [ 65.698316][ T4188] ? xa_load+0x276/0x2a0 [ 65.702641][ T4188] f2fs_mpage_readpages+0xc95/0x2260 [ 65.708383][ T4188] ? dquot_release_reservation_block+0xa0/0xa0 [ 65.714836][ T4188] ? f2fs_is_compress_backend_ready+0x99/0x120 [ 65.721536][ T4188] ? f2fs_readahead+0x163/0x2f0 [ 65.727371][ T4188] ? f2fs_set_data_page_dirty+0xad0/0xad0 [ 65.734554][ T4188] read_pages+0x175/0x930 [ 65.739408][ T4188] ? page_cache_ra_unbounded+0x940/0x940 [ 65.745518][ T4188] ? add_to_page_cache_lru+0x2a8/0x4a0 [ 65.751268][ T4188] page_cache_ra_unbounded+0x838/0x940 [ 65.757138][ T4188] ? read_cache_pages_invalidate_pages+0x1c0/0x1c0 [ 65.764440][ T4188] f2fs_readdir+0x496/0xda0 [ 65.769244][ T4188] ? f2fs_fill_dentries+0xd10/0xd10 [ 65.774721][ T4188] ? end_current_label_crit_section+0x14b/0x170 [ 65.781459][ T4188] ? iterate_dir+0x10d/0x560 [ 65.786686][ T4188] ? down_read_killable+0x1ce/0x340 [ 65.792654][ T4188] ? fsnotify_perm+0x254/0x560 [ 65.798031][ T4188] iterate_dir+0x218/0x560 [ 65.802614][ T4188] ? f2fs_fill_dentries+0xd10/0xd10 [ 65.808093][ T4188] __se_sys_getdents64+0xf2/0x270 [ 65.813569][ T4188] ? __x64_sys_getdents64+0x80/0x80 [ 65.819145][ T4188] ? filldir+0x720/0x720 [ 65.823673][ T4188] ? vtime_user_exit+0x2c8/0x3e0 [ 65.828793][ T4188] ? lockdep_hardirqs_on+0x94/0x140 [ 65.834116][ T4188] do_syscall_64+0x4c/0xa0 [ 65.838839][ T4188] ? clear_bhb_loop+0x30/0x80 [ 65.843726][ T4188] ? clear_bhb_loop+0x30/0x80 [ 65.848917][ T4188] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 65.855370][ T4188] RIP: 0033:0x7f3b55d79773 [ 65.860200][ T4188] Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 [ 65.881613][ T4188] RSP: 002b:00007ffecfa6a5f8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 65.890358][ T4188] RAX: ffffffffffffffda RBX: 0000555573d8ba30 RCX: 00007f3b55d79773 [ 65.898594][ T4188] RDX: 0000000000008000 RSI: 0000555573d8ba60 RDI: 0000000000000005 [ 65.907204][ T4188] RBP: 0000555573d8ba60 R08: 00000000000285e1 R09: 0000000000000001 [ 65.916370][ T4188] R10: 00007f3b55fa1e20 R11: 0000000000000293 R12: 0000555573d8ba34 [ 65.925004][ T4188] R13: ffffffffffffffe8 R14: 0000000000000010 R15: 00007ffecfa6c8a0 [ 65.933790][ T4188] [ 65.953456][ T4188] F2FS-fs (loop0): Inconsistent error blkaddr:5633, sit bitmap:0 [ 65.963217][ T4188] CPU: 1 PID: 4188 Comm: syz-executor Not tainted syzkaller #0 [ 65.972186][ T4188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 65.982963][ T4188] Call Trace: [ 65.986473][ T4188] [ 65.989586][ T4188] dump_stack_lvl+0x188/0x250 [ 65.994550][ T4188] ? show_regs_print_info+0x20/0x20 [ 66.000448][ T4188] ? f2fs_get_next_page_offset+0x6a0/0x6a0 [ 66.006498][ T4188] ? unlock_page+0x17c/0x1f0 [ 66.011514][ T4188] f2fs_is_valid_blkaddr+0xc3b/0x1250 [ 66.016984][ T4188] f2fs_get_read_data_page+0x2c4/0x580 [ 66.022901][ T4188] ? f2fs_get_block+0x2a0/0x2a0 [ 66.028648][ T4188] ? read_cache_pages_invalidate_pages+0x1c0/0x1c0 [ 66.037412][ T4188] f2fs_find_data_page+0x1c2/0x5d0 [ 66.042639][ T4188] f2fs_readdir+0x4b3/0xda0 [ 66.047531][ T4188] ? f2fs_fill_dentries+0xd10/0xd10 [ 66.053174][ T4188] ? end_current_label_crit_section+0x14b/0x170 [ 66.059810][ T4188] ? iterate_dir+0x10d/0x560 [ 66.064888][ T4188] ? down_read_killable+0x1ce/0x340 [ 66.070786][ T4188] ? fsnotify_perm+0x254/0x560 [ 66.075815][ T4188] iterate_dir+0x218/0x560 [ 66.080403][ T4188] ? f2fs_fill_dentries+0xd10/0xd10 [ 66.086480][ T4188] __se_sys_getdents64+0xf2/0x270 [ 66.092114][ T4188] ? __x64_sys_getdents64+0x80/0x80 [ 66.098265][ T4188] ? filldir+0x720/0x720 [ 66.103038][ T4188] ? vtime_user_exit+0x2c8/0x3e0 [ 66.108404][ T4188] ? lockdep_hardirqs_on+0x94/0x140 [ 66.113624][ T4188] do_syscall_64+0x4c/0xa0 [ 66.118211][ T4188] ? clear_bhb_loop+0x30/0x80 [ 66.124116][ T4188] ? clear_bhb_loop+0x30/0x80 [ 66.129189][ T4188] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 66.135546][ T4188] RIP: 0033:0x7f3b55d79773 [ 66.140132][ T4188] Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 [ 66.161312][ T4188] RSP: 002b:00007ffecfa6a5f8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 66.170377][ T4188] RAX: ffffffffffffffda RBX: 0000555573d8ba30 RCX: 00007f3b55d79773 [ 66.179097][ T4188] RDX: 0000000000008000 RSI: 0000555573d8ba60 RDI: 0000000000000005 [ 66.187957][ T4188] RBP: 0000555573d8ba60 R08: 00000000000285e1 R09: 0000000000000001 [ 66.196630][ T4188] R10: 00007f3b55fa1e20 R11: 0000000000000293 R12: 0000555573d8ba34 [ 66.204687][ T4188] R13: ffffffffffffffe8 R14: 0000000000000010 R15: 00007ffecfa6c8a0 [ 66.213024][ T4188] [ 66.369044][ T26] audit: type=1326 audit(1777003470.056:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.440400][ T26] audit: type=1326 audit(1777003470.086:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.479777][ T26] audit: type=1326 audit(1777003470.086:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.508941][ T26] audit: type=1326 audit(1777003470.096:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.588080][ T26] audit: type=1326 audit(1777003470.096:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.651153][ T26] audit: type=1326 audit(1777003470.096:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.683564][ T26] audit: type=1326 audit(1777003470.096:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x7ffc0000 [ 66.718346][ T4397] attempt to access beyond end of device [ 66.718346][ T4397] loop0: rw=2049, want=45112, limit=40427 [ 66.718714][ T26] audit: type=1326 audit(1777003470.096:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc310620a6b code=0x7ffc0000 [ 66.797752][ T26] audit: type=1326 audit(1777003470.096:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4403 comm="syz.2.51" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc310620a6b code=0x7ffc0000 [ 66.825378][ T4241] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.854877][ T4426] loop3: detected capacity change from 0 to 512 [ 66.881838][ T4429] netlink: 24 bytes leftover after parsing attributes in process `syz.2.65'. [ 67.019648][ T4241] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.108458][ T4434] loop1: detected capacity change from 0 to 4096 [ 67.110292][ T4426] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 67.155527][ T4241] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.166426][ T4426] ext4 filesystem being mounted at /13/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 67.277821][ T4426] mmap: syz.3.55 (4426) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 67.278481][ T4241] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.895884][ T4241] tipc: Disabling bearer [ 67.930061][ T4241] tipc: Left network mode [ 69.832338][ T4497] loop1: detected capacity change from 0 to 512 [ 69.926386][ T4497] EXT4-fs (loop1): Ignoring removed nobh option [ 70.140314][ T4497] EXT4-fs error (device loop1): ext4_iget_extra_inode:4573: inode #15: comm syz.1.76: corrupted in-inode xattr [ 70.605300][ T4497] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.76: couldn't read orphan inode 15 (err -117) [ 70.707600][ T4497] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobh,nombcache,resuid=0x0000000000000000,usrjquota=,barrier,acl,init_itable=0x0000000000008d55,,errors=continue. Quota mode: none. [ 70.860004][ T4497] tipc: Started in network mode [ 70.875512][ T4497] tipc: Node identity ac14142f, cluster identity 4711 [ 70.886349][ T4497] tipc: New replicast peer: 0.0.0.0 [ 70.894717][ T4497] tipc: Enabled bearer , priority 10 [ 70.912406][ T4497] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0000 [ 70.956245][ T4491] chnl_net:caif_netlink_parms(): no params data found [ 71.027544][ C1] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 71.237448][ T7] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 71.395392][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.404721][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.476876][ T4491] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.490195][ T4491] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.518387][ T4491] device bridge_slave_0 entered promiscuous mode [ 71.558274][ T7] usb 5-1: Using ep0 maxpacket: 8 [ 71.591350][ T4241] device hsr_slave_0 left promiscuous mode [ 71.608011][ T4241] device hsr_slave_1 left promiscuous mode [ 71.629429][ T4241] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 71.665383][ T4241] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 71.701963][ T4241] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 71.717590][ T7] usb 5-1: unable to get BOS descriptor or descriptor too short [ 71.725561][ T7] usb 5-1: too many configurations: 141, using maximum allowed: 8 [ 71.767358][ T4241] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.786404][ T4241] device bridge_slave_1 left promiscuous mode [ 71.813182][ T4241] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.848597][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 71.866427][ T4241] device bridge_slave_0 left promiscuous mode [ 71.891593][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 71.897475][ T4241] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.947682][ T4227] Bluetooth: hci1: command 0x0409 tx timeout [ 72.020183][ T4241] device veth1_macvtap left promiscuous mode [ 72.026876][ T4241] device veth0_macvtap left promiscuous mode [ 72.043328][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.067676][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 72.068726][ T4241] device veth1_vlan left promiscuous mode [ 72.130065][ T4241] device veth0_vlan left promiscuous mode [ 72.221478][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.261698][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 72.962927][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.974243][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 73.087620][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 73.104727][ T4551] loop1: detected capacity change from 0 to 40427 [ 73.143097][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 73.171894][ T4561] loop2: detected capacity change from 0 to 256 [ 73.200010][ T4551] F2FS-fs (loop1): build fault injection attr: rate: 14, type: 0x1ffff [ 73.225542][ T4551] F2FS-fs (loop1): build fault injection attr: rate: 0, type: 0xe4 [ 73.257718][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 73.281850][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 73.327312][ T4551] F2FS-fs (loop1): invalid crc value [ 73.381243][ T4551] F2FS-fs (loop1): Found nat_bits in checkpoint [ 73.399009][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 73.435381][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 73.476840][ T4551] F2FS-fs (loop1) : inject page alloc in f2fs_grab_cache_page of f2fs_ra_meta_pages+0x43c/0xaa0 [ 73.533068][ T4551] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 73.587571][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 73.607566][ T7] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 73.626182][ T4241] team0 (unregistering): Port device team_slave_1 removed [ 73.682721][ T4551] F2FS-fs (loop1) : inject no more block in inc_valid_node_count of f2fs_new_node_page+0x185/0x8f0 [ 73.696544][ T4241] team0 (unregistering): Port device team_slave_0 removed [ 73.735106][ T4241] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 73.781225][ T4241] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 73.816558][ T4551] F2FS-fs (loop1) : inject page alloc in f2fs_grab_cache_page of f2fs_get_read_data_page+0xf7/0x580 [ 73.869644][ T7] usb 5-1: New USB device found, idVendor=15ca, idProduct=0101, bcdDevice= 0.40 [ 73.901745][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.930451][ T4574] F2FS-fs (loop1) : inject alloc nid in f2fs_alloc_nid of f2fs_get_dnode_of_data+0x6a4/0x1dc0 [ 73.931588][ T7] usb 5-1: Product: syz [ 73.967377][ T7] usb 5-1: Manufacturer: syz [ 74.030824][ T4223] Bluetooth: hci1: command 0x041b tx timeout [ 74.038013][ T7] usb 5-1: can't set config #1, error -71 [ 74.070920][ T4241] bond0 (unregistering): Released all slaves [ 74.079786][ T4192] attempt to access beyond end of device [ 74.079786][ T4192] loop1: rw=2049, want=45112, limit=40427 [ 74.097566][ T7] usb 5-1: USB disconnect, device number 2 [ 74.163043][ T4491] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.174699][ T4491] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.194308][ T4491] device bridge_slave_1 entered promiscuous mode [ 74.242790][ T1324] tipc: Node number set to 2886997039 [ 74.328957][ T4569] 8021q: adding VLAN 0 to HW filter on device bond1 [ 74.350363][ T4570] device bond_slave_0 entered promiscuous mode [ 74.357494][ T4570] device bond_slave_1 entered promiscuous mode [ 74.480283][ T4570] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 74.490353][ T4570] bond1: (slave macvlan2): making interface the new active one [ 74.500584][ T4570] bond1: (slave macvlan2): Enslaving as an active interface with an up link [ 74.526914][ T4491] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.674250][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 74.849679][ T4491] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.203470][ T4570] syz.3.93 (4570) used greatest stack depth: 20016 bytes left [ 75.341705][ T4491] team0: Port device team_slave_0 added [ 75.376423][ T4491] team0: Port device team_slave_1 added [ 75.515079][ T4592] Zero length message leads to an empty skb [ 75.538609][ T4491] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.602650][ T4491] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.723247][ T4491] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.752482][ T4611] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 75.796920][ T4491] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.807612][ T4491] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.856520][ T4491] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.968703][ T4491] device hsr_slave_0 entered promiscuous mode [ 75.987450][ T4223] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 76.005136][ T4491] device hsr_slave_1 entered promiscuous mode [ 76.021836][ T4491] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 76.072994][ T4491] Cannot create hsr debugfs directory [ 76.107807][ T4227] Bluetooth: hci1: command 0x040f tx timeout [ 76.237394][ T4223] usb 5-1: Using ep0 maxpacket: 16 [ 76.337149][ T4629] netlink: 52 bytes leftover after parsing attributes in process `syz.1.109'. [ 76.357458][ T4223] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 76.387151][ T4629] netlink: 52 bytes leftover after parsing attributes in process `syz.1.109'. [ 76.389393][ T4223] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 76.510196][ T1106] cfg80211: failed to load regulatory.db [ 76.557520][ T4223] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 76.596721][ T4223] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.618612][ T4491] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 76.627502][ T4223] usb 5-1: Product: syz [ 76.652216][ T4223] usb 5-1: Manufacturer: syz [ 76.673926][ T4223] usb 5-1: SerialNumber: syz [ 76.703196][ T4491] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 76.760877][ T4491] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 76.831368][ T4491] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 76.915738][ T4639] netlink: 'syz.1.112': attribute type 8 has an invalid length. [ 77.017507][ T4223] usb 5-1: 0:2 : does not exist [ 77.068291][ T4223] usb 5-1: USB disconnect, device number 3 [ 77.320354][ T4173] udevd[4173]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 77.369063][ T4491] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.480112][ T4491] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.487842][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 77.538922][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.595610][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.657925][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.661524][ T4666] process 'syz.2.118' launched './file0' with NULL argv: empty string added [ 77.713428][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.722166][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.806593][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.853825][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.895488][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.903405][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.943001][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.998517][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.068738][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.123753][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 78.179382][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.187688][ T4223] Bluetooth: hci1: command 0x0419 tx timeout [ 78.236746][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.278397][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 78.320026][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.363511][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 78.393371][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.418100][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 78.458143][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 78.501857][ T4665] loop4: detected capacity change from 0 to 32768 [ 78.784353][ T4665] read_mapping_page failed! [ 78.815343][ T4665] ERROR: (device loop4): txCommit: [ 78.815343][ T4665] [ 79.011598][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 79.031682][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 79.113657][ T4491] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.388475][ T144] read_mapping_page failed! [ 79.393597][ T144] ERROR: (device loop4): txCommit: [ 79.393597][ T144] [ 79.475377][ T144] jfs_write_inode: jfs_commit_inode failed! [ 79.930512][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 79.987525][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 80.080437][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 80.120159][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 80.188051][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 80.209399][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 80.285990][ T4491] device veth0_vlan entered promiscuous mode [ 80.400643][ T4491] device veth1_vlan entered promiscuous mode [ 81.034839][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 81.072564][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 81.257756][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 81.278557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 81.303291][ T4491] device veth0_macvtap entered promiscuous mode [ 81.341103][ T4491] device veth1_macvtap entered promiscuous mode [ 81.435472][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.471686][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.506459][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.542461][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.577283][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.600762][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.627853][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.659781][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.682596][ T4491] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.773278][ T4736] team0: Port device team_slave_0 removed [ 81.827178][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 81.852551][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 81.891391][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 81.921266][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 81.933826][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.951739][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.968863][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.985987][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.012496][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.052748][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.080896][ T4491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.092340][ T4491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.114608][ T4491] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.698018][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 82.710058][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 82.771715][ T4491] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.805119][ T4491] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.817787][ T4491] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.830740][ T4491] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.033040][ T4309] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.089818][ T4309] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.126390][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 83.212749][ T4241] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.243927][ T4241] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.267276][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 83.440064][ T4778] xt_NFQUEUE: number of queues (8) out of range (got 65537) [ 83.549401][ T1106] 0: reclassify loop, rule prio 0, protocol 800 [ 83.578208][ T4783] tipc: Started in network mode [ 83.602480][ T4783] tipc: Node identity 8639ad369036, cluster identity 4711 [ 83.645343][ T4783] tipc: Enabled bearer , priority 0 [ 83.753806][ T4789] device syzkaller0 entered promiscuous mode [ 83.757448][ T4794] syz.1.142 uses obsolete (PF_INET,SOCK_PACKET) [ 83.847529][ T1324] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 83.905406][ T4782] tipc: Resetting bearer [ 83.991559][ T4782] tipc: Disabling bearer [ 84.117512][ T1324] usb 5-1: Using ep0 maxpacket: 8 [ 84.156030][ T4801] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 84.188458][ T13] 0: reclassify loop, rule prio 0, protocol 800 [ 84.211239][ T4801] netlink: 12 bytes leftover after parsing attributes in process `syz.1.143'. [ 84.278869][ T1324] usb 5-1: config 0 has no interfaces? [ 84.337723][ T26] kauditd_printk_skb: 49 callbacks suppressed [ 84.337739][ T26] audit: type=1804 audit(1777003488.016:61): pid=4808 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.145" name="bus" dev="ramfs" ino=35150 res=1 errno=0 [ 84.455406][ T26] audit: type=1804 audit(1777003488.066:62): pid=4808 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.145" name="bus" dev="ramfs" ino=35150 res=1 errno=0 [ 84.532604][ T1324] usb 5-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 84.554806][ T1324] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.585289][ T1324] usb 5-1: Product: syz [ 84.601993][ T1324] usb 5-1: Manufacturer: syz [ 84.621259][ T1324] usb 5-1: SerialNumber: syz [ 84.691116][ T1324] usb 5-1: config 0 descriptor?? [ 84.829949][ T4817] loop2: detected capacity change from 0 to 2048 [ 85.430769][ T23] usb 5-1: USB disconnect, device number 4 [ 85.465284][ T4817] UDF-fs: iocharset iso8¿_2 not found [ 85.694244][ T4829] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 85.917137][ T4838] netlink: 12 bytes leftover after parsing attributes in process `syz.3.152'. [ 85.990298][ T4838] 8021q: adding VLAN 0 to HW filter on device bond2 [ 86.927288][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 87.082542][ T4853] netlink: 16 bytes leftover after parsing attributes in process `syz.3.154'. [ 88.668230][ C0] 0: reclassify loop, rule prio 0, protocol 800 [ 89.313359][ T4300] 0: reclassify loop, rule prio 0, protocol 800 [ 89.952847][ T7] 0: reclassify loop, rule prio 0, protocol 800 [ 90.738684][ T4870] tipc: Started in network mode [ 90.743725][ T4870] tipc: Node identity bbbbbb01, cluster identity 4711 [ 90.953858][ T4870] tipc: Enabled bearer , priority 10 [ 90.999388][ T4878] netlink: 8 bytes leftover after parsing attributes in process `syz.1.163'. [ 92.169314][ T1324] tipc: Node number set to 3149642497 [ 92.281463][ T4902] dccp_invalid_packet: invalid packet type [ 92.342511][ T4223] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 92.368164][ T4906] netlink: 'syz.5.169': attribute type 1 has an invalid length. [ 92.428711][ T4906] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 92.468660][ T4906] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 92.491934][ T4909] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 92.511878][ T4227] 0: reclassify loop, rule prio 0, protocol 800 [ 92.525821][ T4906] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 92.552436][ T4906] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 92.600158][ T4906] team0: Device geneve2 is of different type [ 92.653174][ T4906] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 92.699776][ T4906] netdevsim netdevsim5 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 92.715650][ T4906] netdevsim netdevsim5 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 92.729994][ T4223] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 92.745512][ T4906] netdevsim netdevsim5 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 92.766860][ T4223] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 92.787772][ T4223] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.810380][ T4223] usb 2-1: config 0 descriptor?? [ 92.849454][ T4223] pwc: Askey VC010 type 2 USB webcam detected. [ 93.054262][ T4892] netlink: 8 bytes leftover after parsing attributes in process `syz.1.167'. [ 93.163453][ T4931] netlink: 24 bytes leftover after parsing attributes in process `syz.5.176'. [ 93.167623][ T4223] pwc: send_video_command error -71 [ 93.196249][ T4223] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 93.207079][ T4931] netlink: 4 bytes leftover after parsing attributes in process `syz.5.176'. [ 93.214225][ T4223] Philips webcam: probe of 2-1:0.0 failed with error -71 [ 93.255910][ T4223] usb 2-1: USB disconnect, device number 2 [ 93.635822][ T4944] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 93.762781][ T4948] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem [ 93.842173][ T4953] loop2: detected capacity change from 0 to 8 [ 93.976056][ T4953] SQUASHFS error: zlib decompression failed, data probably corrupt [ 94.037992][ T4953] SQUASHFS error: Failed to read block 0x9b: -5 [ 94.045813][ T4953] SQUASHFS error: Unable to read metadata cache entry [99] [ 94.080750][ T4953] SQUASHFS error: Unable to read inode 0x127 [ 95.067850][ T155] 0: reclassify loop, rule prio 0, protocol 800 [ 95.134161][ T4970] loop1: detected capacity change from 0 to 4096 [ 95.154225][ T4967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 95.233522][ T4967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 95.287442][ T4977] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 95.315880][ T4972] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 96.330785][ T4989] netlink: 104 bytes leftover after parsing attributes in process `syz.5.194'. [ 96.401741][ T4993] loop2: detected capacity change from 0 to 512 [ 96.416782][ T4996] sock: sock_set_timeout: `syz.5.197' (pid 4996) tries to set negative timeout [ 96.433612][ T4992] 8021q: adding VLAN 0 to HW filter on device bond1 [ 96.533500][ T5002] 0: reclassify loop, rule prio 0, protocol 800 [ 96.559039][ T4993] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,usrquota,minixdf,nombcache,. Quota mode: writeback. [ 96.573751][ T26] audit: type=1326 audit(1777003500.246:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa4fad18dd9 code=0x0 [ 96.653545][ T4993] ext4 filesystem being mounted at /44/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 96.664996][ T26] audit: type=1326 audit(1777003500.316:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.694542][ T26] audit: type=1326 audit(1777003500.316:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.745942][ T26] audit: type=1326 audit(1777003500.316:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.811514][ T26] audit: type=1326 audit(1777003500.316:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.870617][ T26] audit: type=1326 audit(1777003500.316:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.895921][ T26] audit: type=1326 audit(1777003500.316:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.921260][ T26] audit: type=1326 audit(1777003500.316:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 96.953621][ T5019] tipc: Can't bind to reserved service type 1 [ 97.013729][ T5021] netlink: 'syz.2.205': attribute type 1 has an invalid length. [ 97.022256][ T26] audit: type=1326 audit(1777003500.316:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 97.048476][ T26] audit: type=1326 audit(1777003500.316:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5007 comm="syz.1.202" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4fad18dd9 code=0x7ffc0000 [ 97.089862][ T5021] device bond1 entered promiscuous mode [ 97.107071][ T5021] 8021q: adding VLAN 0 to HW filter on device bond1 [ 97.121455][ T5023] bond1: (slave ipvlan1): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 97.138164][ T5023] bond1: (slave ipvlan1): The slave device specified does not support setting the MAC address [ 97.150227][ T5023] bond1: (slave ipvlan1): Setting fail_over_mac to active for active-backup mode [ 97.183409][ T5021] bond1: (slave ipvlan1): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 97.198177][ T5021] bond1: (slave ipvlan1): The slave device specified does not support setting the MAC address [ 97.539689][ T5033] loop3: detected capacity change from 0 to 8 [ 97.774479][ T5047] 0: reclassify loop, rule prio 0, protocol 800 [ 97.829986][ T5037] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 97.853061][ T5037] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 98.107679][ T5062] netlink: 4 bytes leftover after parsing attributes in process `syz.3.215'. [ 98.788391][ T5082] loop2: detected capacity change from 0 to 2048 [ 98.852421][ T5081] netlink: 4 bytes leftover after parsing attributes in process `syz.5.224'. [ 98.882181][ T5082] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 99.062189][ T5092] 9pnet: Insufficient options for proto=fd [ 99.337324][ T5108] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 99.399939][ T5110] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.409055][ T5110] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.522038][ T5113] device bridge_slave_1 left promiscuous mode [ 99.538332][ T5113] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.556301][ T5113] device bridge_slave_0 left promiscuous mode [ 99.568931][ T5113] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.737380][ T5119] 0: reclassify loop, rule prio 0, protocol 800 [ 100.002361][ T5129] device syzkaller0 entered promiscuous mode [ 100.190322][ T4241] 0: reclassify loop, rule prio 0, protocol 800 [ 100.256336][ T5136] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 100.277577][ T5140] loop3: detected capacity change from 0 to 256 [ 100.281633][ T5136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 100.303286][ T5136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 100.382042][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.410413][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.457738][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.507313][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.524318][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.540745][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.557144][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 100.594805][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 100.692480][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 100.951379][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 101.234245][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 101.301489][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 101.327130][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 101.339342][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 101.397491][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 101.428610][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 101.573682][ T5154] device wg1 entered promiscuous mode [ 101.677394][ T5156] Illegal XDP return value 4294967274, expect packet loss! [ 102.230892][ T5176] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 102.307020][ T5176] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 102.408778][ T5176] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 102.590472][ T4223] 0: reclassify loop, rule prio 0, protocol 800 [ 102.599508][ T5183] netlink: 4 bytes leftover after parsing attributes in process `syz.4.255'. [ 102.805972][ T5203] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.834745][ T5203] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.398134][ T1106] 0: reclassify loop, rule prio 0, protocol 800 [ 103.935169][ T5233] 0: reclassify loop, rule prio 0, protocol 800 [ 104.784124][ T5260] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 104.852532][ T5260] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 105.003292][ T5275] binder: 5273:5275 ioctl c0306201 200000000680 returned -14 [ 105.309424][ T4222] 0: reclassify loop, rule prio 0, protocol 800 [ 105.332403][ T5272] loop4: detected capacity change from 0 to 128 [ 105.791027][ T5009] ODEBUG: Out of memory. ODEBUG disabled [ 105.947797][ T4222] 0: reclassify loop, rule prio 0, protocol 800 [ 106.315138][ T5320] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 107.607131][ T5352] chnl_net:caif_netlink_parms(): no params data found [ 107.836377][ T5389] netlink: 4 bytes leftover after parsing attributes in process `syz.2.315'. [ 107.903186][ T5389] device team1 entered promiscuous mode [ 107.927960][ T5389] 8021q: adding VLAN 0 to HW filter on device team1 [ 107.948018][ T5352] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.969157][ T5352] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.998367][ T5352] device bridge_slave_0 entered promiscuous mode [ 108.024217][ T5392] netlink: 4 bytes leftover after parsing attributes in process `syz.2.315'. [ 108.058585][ T5392] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 108.125860][ T5392] device team2 entered promiscuous mode [ 108.133850][ T5392] 8021q: adding VLAN 0 to HW filter on device team2 [ 108.256454][ T5352] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.278834][ T5352] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.310964][ T5352] device bridge_slave_1 entered promiscuous mode [ 108.448097][ T5352] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.551033][ T5352] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.654675][ T5352] team0: Port device team_slave_0 added [ 108.703728][ T5352] team0: Port device team_slave_1 added [ 108.784588][ T5352] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.817443][ T5352] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 108.935625][ T5352] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.989707][ T5352] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.006456][ T5352] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.067288][ T5352] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.186928][ T5352] device hsr_slave_0 entered promiscuous mode [ 109.216904][ T5352] device hsr_slave_1 entered promiscuous mode [ 109.237955][ T21] Bluetooth: hci3: command 0x0409 tx timeout [ 109.248004][ T5352] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 109.276637][ T5352] Cannot create hsr debugfs directory [ 109.686851][ T5352] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 109.718267][ T5481] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 109.759465][ T5481] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 109.790709][ T5481] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 109.821072][ T5481] device bridge_slave_0 left promiscuous mode [ 109.839689][ T5481] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.880650][ T5481] device bridge_slave_1 left promiscuous mode [ 109.908184][ T5481] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.941942][ T5481] bond0: (slave bond_slave_0): Releasing backup interface [ 109.977630][ T5481] bond0: (slave bond_slave_1): Releasing backup interface [ 110.020531][ T5495] 0: reclassify loop, rule prio 0, protocol 800 [ 110.085994][ T5481] team0: Port device team_slave_0 removed [ 110.123817][ T5481] team0: Port device team_slave_1 removed [ 110.138070][ T5481] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 110.155777][ T5481] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 110.173975][ T5479] loop3: detected capacity change from 0 to 32768 [ 110.175823][ T5481] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 110.219622][ T5481] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 110.225306][ T5479] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.336 (5479) [ 110.272227][ T5479] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 110.275688][ T5352] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 110.283241][ T5479] BTRFS error (device loop3): unrecognized mount option 'fsmagic=0x0000000000000040' [ 110.313521][ T5479] BTRFS error (device loop3): open_ctree failed: -22 [ 110.342705][ T5486] team0: Mode changed to "broadcast" [ 110.370430][ T4173] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by udevd (4173) [ 111.307384][ T5495] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.315976][ T5495] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.317401][ T21] Bluetooth: hci3: command 0x041b tx timeout [ 112.361231][ T5495] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.443389][ T5495] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.757372][ T7] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 113.002956][ T7] usb 3-1: Using ep0 maxpacket: 8 [ 113.072344][ T5495] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.087726][ T5495] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.097137][ T5495] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.107658][ T5495] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.134221][ T7] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 113.155497][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 113.174528][ T7] usb 3-1: config 0 has no interface number 0 [ 113.293433][ T5352] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 113.337134][ T5352] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 113.344618][ T7] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 113.357907][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.366843][ T7] usb 3-1: Product: syz [ 113.377532][ T7] usb 3-1: Manufacturer: syz [ 113.383818][ T7] usb 3-1: SerialNumber: syz [ 113.396077][ T7] usb 3-1: config 0 descriptor?? [ 113.451232][ T7] usb 3-1: Found UVC 0.04 device syz (046d:08c3) [ 113.467354][ T21] Bluetooth: hci3: command 0x040f tx timeout [ 113.469397][ T7] usb 3-1: No valid video chain found. [ 113.585225][ T5352] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.644207][ T5352] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.667424][ T4506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.700111][ T4506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.746176][ T1324] usb 3-1: USB disconnect, device number 3 [ 113.790786][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.832434][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.854875][ T4300] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.862412][ T4300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.897645][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.913033][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.942957][ T4300] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.950486][ T4300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.984793][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 114.002104][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 114.014612][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 114.034976][ T5565] netlink: 'syz.3.353': attribute type 1 has an invalid length. [ 114.075590][ T7] Process accounting resumed [ 114.086627][ T5352] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 114.118312][ T5352] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.154374][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.159912][ T5551] loop5: detected capacity change from 0 to 32768 [ 114.173421][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.183602][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.195340][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.205245][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.215251][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.226292][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.238833][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.268354][ T5551] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop5 scanned by syz.5.349 (5551) [ 114.316162][ T5568] bond3: (slave gretap1): making interface the new active one [ 114.333520][ T26] kauditd_printk_skb: 236 callbacks suppressed [ 114.333535][ T26] audit: type=1326 audit(1777003518.016:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5573 comm="syz.2.356" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc310620dd9 code=0x0 [ 114.392233][ T5568] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 114.404068][ T5551] BTRFS info (device loop5): using blake2b (blake2b-256-generic) checksum algorithm [ 114.455633][ T5565] bond3: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 114.472789][ T5551] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 114.496669][ T5551] BTRFS info (device loop5): use zstd compression, level 3 [ 114.511975][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.519088][ T5551] BTRFS info (device loop5): using free space tree [ 114.531356][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.531523][ T5551] BTRFS info (device loop5): has skinny extents [ 114.824932][ T5551] BTRFS info (device loop5): enabling ssd optimizations [ 114.834084][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 114.878592][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 114.889885][ T5352] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.002201][ T26] audit: type=1800 audit(1777003518.686:310): pid=5551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.349" name="file1" dev="loop5" ino=260 res=0 errno=0 [ 115.442859][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 117.308927][ T21] Bluetooth: hci3: command 0x0419 tx timeout [ 117.318919][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 117.439802][ T5647] loop3: detected capacity change from 0 to 1024 [ 117.482068][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 117.508161][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 117.518190][ T5352] device veth0_vlan entered promiscuous mode [ 117.545609][ T4506] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 117.561133][ T5647] EXT4-fs (loop3): Ignoring removed oldalloc option [ 117.586532][ T4506] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 117.603817][ T5647] EXT4-fs (loop3): inline encryption not supported [ 117.612463][ T5352] device veth1_vlan entered promiscuous mode [ 117.632498][ T5647] EXT4-fs (loop3): Ignoring removed bh option [ 117.680491][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 117.697100][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 117.707681][ T5647] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,barrier,commit=0x0000000000000005,journal_ioprio=0x0000000000000000,data_err=ignore,init_itable,oldalloc,inlinecrypt,bh,inode_readahead_blks=0x0000000001000000,,errors=continue. Quota mode: none. [ 117.746268][ T5352] device veth0_macvtap entered promiscuous mode [ 117.758625][ T5352] device veth1_macvtap entered promiscuous mode [ 117.778176][ T5352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.790215][ T5352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.807306][ T5352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.819292][ T5352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.831419][ T5352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.831439][ T5352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.832849][ T5352] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.874108][ T5352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.915983][ T5352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.931712][ T5352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.950399][ T5352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.961846][ T5352] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.979516][ T5352] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.991828][ T5352] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.002652][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 118.012374][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 118.030158][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 118.064497][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 118.073832][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 118.083454][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 118.104338][ T5352] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.129721][ T5352] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.153480][ T5352] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.164931][ T5352] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.054019][ T4300] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.065764][ T4300] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.087735][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 119.120075][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.130718][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.143329][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 119.150138][ T5682] x_tables: duplicate entry at hook 1 [ 119.268593][ T5688] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 119.284451][ T5688] netlink: 4 bytes leftover after parsing attributes in process `syz.4.378'. [ 119.349841][ T5693] netlink: 'syz.5.380': attribute type 29 has an invalid length. [ 119.378898][ T5691] netlink: 24 bytes leftover after parsing attributes in process `syz.6.379'. [ 119.391364][ T5693] netlink: 'syz.5.380': attribute type 29 has an invalid length. [ 119.395041][ T5695] kAFS: unable to lookup cell '' [ 119.456399][ T5693] netlink: 'syz.5.380': attribute type 29 has an invalid length. [ 119.826441][ T5706] loop5: detected capacity change from 0 to 4096 [ 119.980673][ T5706] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 120.103719][ T4300] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 120.131373][ T4491] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 120.149393][ T4491] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 120.177442][ T4491] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 120.198609][ T4506] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 120.201139][ T5708] netlink: 132 bytes leftover after parsing attributes in process `syz.4.386'. [ 120.216198][ T4491] ntfs3: loop5: ntfs_evict_inode r=3 failed, -22. [ 121.495246][ T5725] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 121.535833][ T5725] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 121.554344][ T5725] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 121.586027][ T5728] loop5: detected capacity change from 0 to 128 [ 121.719668][ T5728] EXT4-fs (loop5): inline encryption not supported [ 122.075650][ T5728] EXT4-fs (loop5): Test dummy encryption mode enabled [ 122.142567][ T5753] ptrace attach of "./syz-executor exec"[4193] was attempted by "./syz-executor exec"[5753] [ 122.390868][ T5728] EXT4-fs (loop5): mounted filesystem without journal. Opts: nojournal_checksum,nolazytime,inlinecrypt,jqfmt=vfsv0,nombcache,grpjquota=,test_dummy_encryption,,errors=continue. Quota mode: none. [ 122.437492][ T5752] netlink: 16 bytes leftover after parsing attributes in process `syz.2.399'. [ 122.619632][ T5728] ext4 filesystem being mounted at /48/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 123.095548][ T1324] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 124.274825][ T1324] usb 4-1: Using ep0 maxpacket: 8 [ 124.626913][ T1324] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 124.663209][ T1324] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.751111][ T1324] usb 4-1: Product: syz [ 124.796944][ T1324] usb 4-1: Manufacturer: syz [ 124.843124][ T1324] usb 4-1: SerialNumber: syz [ 124.982394][ T1324] usb 4-1: config 0 descriptor?? [ 125.394733][ T1324] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 125.974835][ T5778] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 126.679699][ T5789] netlink: 24 bytes leftover after parsing attributes in process `syz.4.409'. [ 126.729373][ T5701] Set syz1 is full, maxelem 65536 reached [ 126.782853][ T5791] netlink: 4 bytes leftover after parsing attributes in process `syz.6.410'. [ 126.792633][ T5791] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.857190][ T5791] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 127.153115][ T5803] kvm: emulating exchange as write [ 127.247394][ T5805] Set syz1 is full, maxelem 65536 reached [ 127.598579][ T1324] dvb_usb_rtl28xxu: probe of 4-1:0.0 failed with error -71 [ 127.620593][ T1324] usb 4-1: USB disconnect, device number 2 [ 127.829904][ T5825] loop3: detected capacity change from 0 to 128 [ 128.081362][ T5830] ptrace attach of "./syz-executor exec"[5831] was attempted by "./syz-executor exec"[5830] [ 130.708680][ T5844] device bridge_slave_0 left promiscuous mode [ 130.715166][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.732952][ T5844] device bridge_slave_1 left promiscuous mode [ 130.808541][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.877671][ T5844] bond0: (slave bond_slave_0): Releasing backup interface [ 130.914793][ T5844] bond0: (slave bond_slave_1): Releasing backup interface [ 131.006975][ T5844] team0: Failed to send options change via netlink (err -105) [ 131.022786][ T5844] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 131.040915][ T5844] team0: Port device team_slave_0 removed [ 131.080463][ T5844] team0: Failed to send options change via netlink (err -105) [ 131.090313][ T5844] team0: Failed to send port change of device team_slave_1 via netlink (err -105) [ 131.107772][ T5844] team0: Port device team_slave_1 removed [ 131.118263][ T5844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 131.129181][ T5844] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 131.142281][ T5844] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 131.153881][ T5844] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 131.198821][ T5845] team0: Failed to send options change via netlink (err -105) [ 131.212652][ T5845] team0: Mode changed to "loadbalance" [ 131.222063][ T5848] netlink: 12 bytes leftover after parsing attributes in process `syz.3.427'. [ 133.110834][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.117406][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.499764][ T5876] netlink: 12 bytes leftover after parsing attributes in process `syz.6.438'. [ 133.527261][ T5878] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 133.679141][ T5882] loop6: detected capacity change from 0 to 164 [ 133.775596][ T5865] loop3: detected capacity change from 0 to 32768 [ 133.785171][ T5882] iso9660: Corrupted directory entry in block 4 of inode 1792 [ 133.886495][ T5865] XFS (loop3): Mounting V5 Filesystem [ 133.937842][ T5890] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 133.945560][ T5890] IPv6: NLM_F_CREATE should be set when creating new route [ 133.973157][ T5865] XFS (loop3): Ending clean mount [ 134.062275][ T5865] XFS (loop3): Quotacheck needed: Please wait. [ 134.237981][ T5865] XFS (loop3): Quotacheck: Done. [ 134.410244][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.417921][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.458068][ T5819] Set syz1 is full, maxelem 65536 reached [ 134.496414][ T4190] XFS (loop3): Unmounting Filesystem [ 136.096177][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 136.854311][ T5890] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.865196][ T5890] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.874816][ T5890] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.884363][ T5890] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.482136][ T5936] loop5: detected capacity change from 0 to 32768 [ 137.548224][ T5936] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 137.853646][ T5936] BTRFS info (device loop5): force clearing of disk cache [ 138.294197][ T5936] BTRFS info (device loop5): force zlib compression, level 3 [ 138.303020][ T5936] BTRFS info (device loop5): enabling auto defrag [ 138.367236][ T5936] BTRFS info (device loop5): max_inline at 0 [ 138.373405][ T5936] BTRFS info (device loop5): enabling disk space caching [ 138.402881][ T5936] BTRFS info (device loop5): disk space caching is enabled [ 138.419584][ T5957] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3897524436 (7795048872 ns) > initial count (2759807172 ns). Using initial count to start timer. [ 138.454703][ T5936] BTRFS info (device loop5): has skinny extents [ 138.494559][ T5969] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3996681224 (15986724896 ns) > initial count (3709615788 ns). Using initial count to start timer. [ 138.818548][ T5936] BTRFS info (device loop5): enabling ssd optimizations [ 138.846062][ T5992] netlink: 24 bytes leftover after parsing attributes in process `syz.3.468'. [ 138.873478][ T5936] BTRFS info (device loop5): clearing free space tree [ 138.917280][ T5936] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 138.968149][ T5936] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 138.968427][ T5995] loop6: detected capacity change from 0 to 16 [ 139.124443][ T5995] erofs: (device loop6): erofs_read_superblock: blkszbits 9 isn't supported on this platform [ 139.561015][ T5953] ptrace attach of "./syz-executor exec"[4183] was attempted by "./syz-executor exec"[5953] [ 140.017171][ T5671] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 140.904231][ T5671] usb 7-1: Using ep0 maxpacket: 8 [ 141.024505][ T5671] usb 7-1: config 0 has no interfaces? [ 141.030135][ T5671] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 141.035132][ T6021] netlink: 20 bytes leftover after parsing attributes in process `syz.3.478'. [ 141.064295][ T5671] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.083227][ T5671] usb 7-1: config 0 descriptor?? [ 141.481098][ T21] usb 7-1: USB disconnect, device number 2 [ 141.596009][ T6040] tmpfs: Bad value for 'mpol' [ 141.661940][ T6042] netlink: 4 bytes leftover after parsing attributes in process `syz.2.485'. [ 141.759079][ T6046] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 141.795175][ T6046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 141.818241][ T6046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 141.839583][ T6046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 141.851715][ T6046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 142.007710][ T6049] loop3: detected capacity change from 0 to 512 [ 142.027800][ T6052] netlink: 1319 bytes leftover after parsing attributes in process `syz.2.489'. [ 142.155524][ T6049] EXT4-fs error (device loop3): ext4_orphan_get:1406: inode #15: comm syz.3.487: inode has both inline data and extents flags [ 142.184958][ T6049] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.487: couldn't read orphan inode 15 (err -117) [ 142.268008][ T6049] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 142.443369][ T6067] device syzkaller0 entered promiscuous mode [ 142.625030][ T6077] ptrace attach of "./syz-executor exec"[5352] was attempted by "./syz-executor exec"[6077] [ 143.485991][ T6082] xt_hashlimit: overflow, try lower: 3/0 [ 144.351769][ T6090] kvm: pic: level sensitive irq not supported [ 145.346703][ T6105] loop3: detected capacity change from 0 to 512 [ 145.468477][ T6105] EXT4-fs (loop3): Ignoring removed oldalloc option [ 145.516824][ T6105] EXT4-fs (loop3): Ignoring removed nobh option [ 145.575761][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #11: comm syz.3.503: iget: bad extra_isize 90 (inode size 256) [ 145.659625][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.697509][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.503: error while reading EA inode 11 err=-117 [ 145.749547][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.767560][ T6105] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2807: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 145.798813][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #11: comm syz.3.503: iget: bad extra_isize 90 (inode size 256) [ 145.831523][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.849093][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.503: error while reading EA inode 11 err=-117 [ 145.872761][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.890419][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #18: comm syz.3.503: iget: bad extra_isize 90 (inode size 256) [ 145.904477][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.911524][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.503: error while reading EA inode 18 err=-117 [ 145.938163][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.951082][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #18: comm syz.3.503: iget: bad extra_isize 90 (inode size 256) [ 145.966158][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.973725][ T6105] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.503: error while reading EA inode 18 err=-117 [ 145.987585][ T6105] EXT4-fs (loop3): Remounting filesystem read-only [ 145.995108][ T6105] EXT4-fs (loop3): 1 orphan inode deleted [ 146.001306][ T6105] EXT4-fs (loop3): mounted filesystem without journal. Opts: data_err=ignore,oldalloc,debug_want_extra_isize=0x000000000000005a,nobh,errors=remount-ro,nodiscard,grpid,. Quota mode: none. [ 146.597957][ T6103] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.607845][ T6103] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.617899][ T6103] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.627652][ T6103] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.719993][ T6113] tipc: Started in network mode [ 146.728606][ T6113] tipc: Node identity 4, cluster identity 4711 [ 146.742259][ T6113] tipc: Node number set to 4 [ 147.135102][ T6134] netlink: 'syz.6.513': attribute type 4 has an invalid length. [ 148.279097][ T6148] overlayfs: failed to clone upperpath [ 148.520585][ T6157] netlink: 'syz.6.523': attribute type 4 has an invalid length. [ 148.562736][ T6159] netlink: 12 bytes leftover after parsing attributes in process `syz.4.524'. [ 148.664434][ T1106] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 149.326406][ T1106] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 149.588472][ T1106] usb 3-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice=7d.08 [ 149.603262][ T1106] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.624053][ T1106] usb 3-1: Product: syz [ 149.628362][ T1106] usb 3-1: Manufacturer: syz [ 149.633865][ T1106] usb 3-1: SerialNumber: syz [ 149.690562][ T1106] usb 3-1: config 0 descriptor?? [ 149.764454][ T1106] gm12u320 3-1:0.0: [drm:gm12u320_set_ecomode] *ERROR* Misc. req. error -8 [ 149.776703][ T4508] Bluetooth: hci5: Frame reassembly failed (-84) [ 149.832854][ T1106] gm12u320: probe of 3-1:0.0 failed with error -5 [ 149.859928][ T1106] usb-storage 3-1:0.0: USB Mass Storage device detected [ 149.903307][ T1106] usb-storage 3-1:0.0: device ignored [ 149.941919][ T6183] tipc: Failed to remove unknown binding: 66,0,0/0:4059293506/4059293508 [ 149.974214][ T6183] tipc: Failed to remove unknown binding: 66,0,0/0:4059293506/4059293507 [ 149.990246][ T6152] udc-core: couldn't find an available UDC or it's busy [ 150.017529][ T6184] tipc: Failed to remove unknown binding: 66,0,0/0:4059293506/4059293508 [ 150.030246][ T6152] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 150.051777][ T6184] tipc: Failed to remove unknown binding: 66,0,0/0:4059293506/4059293507 [ 150.115776][ T6152] misc userio: The device must be registered before sending interrupts [ 150.140119][ T5671] usb 3-1: USB disconnect, device number 4 [ 150.222008][ T6177] loop5: detected capacity change from 0 to 32768 [ 150.343781][ T6177] gfs2: path_lookup on c::: returned error -2 [ 150.715032][ C1] vcan0: j1939_tp_rxtimer: 0xffff888024c90400: rx timeout, send abort [ 150.760189][ T6200] sch_tbf: burst 240 is lower than device lo mtu (65550) ! [ 151.267278][ C1] vcan0: j1939_tp_rxtimer: 0xffff888024c90400: abort rx timeout. Force session deactivation [ 151.433026][ C1] vcan0: j1939_tp_rxtimer: 0xffff888024c92800: rx timeout, send abort [ 151.564203][ T6203] device syzkaller0 entered promiscuous mode [ 151.948401][ T23] Bluetooth: hci5: command 0xfc11 tx timeout [ 151.954840][ T4187] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 151.983463][ C1] vcan0: j1939_tp_rxtimer: 0xffff888024c92800: abort rx timeout. Force session deactivation [ 152.027586][ T6224] bond1: (slave batadv_slave_1): Enslaving as a backup interface with a down link [ 152.086056][ T6214] loop3: detected capacity change from 0 to 40427 [ 152.124596][ T6214] F2FS-fs (loop3): Invalid Fs Meta Ino: node(1) meta(2) root(0) [ 152.172890][ T6214] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 152.197079][ T6214] F2FS-fs (loop3): invalid crc value [ 152.226592][ T6214] F2FS-fs (loop3): Found nat_bits in checkpoint [ 152.301159][ T23] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 152.305993][ T6214] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 152.323596][ T6214] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 152.433818][ T4190] attempt to access beyond end of device [ 152.433818][ T4190] loop3: rw=2049, want=45128, limit=40427 [ 152.589797][ T23] usb 3-1: Using ep0 maxpacket: 32 [ 152.608541][ T6234] loop5: detected capacity change from 0 to 32768 [ 152.742178][ T6234] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.552 (6234) [ 152.761199][ T23] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 152.770686][ T23] usb 3-1: config 0 has no interface number 0 [ 152.831735][ T23] usb 3-1: config 0 interface 184 has no altsetting 0 [ 152.848991][ T6234] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 152.869087][ T6234] BTRFS info (device loop5): setting nodatasum [ 152.877490][ T6234] BTRFS info (device loop5): force zlib compression, level 3 [ 153.113749][ T6234] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_LZO (0x8) [ 153.531260][ T6234] BTRFS info (device loop5): use lzo compression, level 0 [ 153.560382][ T6234] BTRFS info (device loop5): turning on flush-on-commit [ 153.637641][ T6245] loop3: detected capacity change from 0 to 32768 [ 153.683593][ T6234] BTRFS info (device loop5): enabling auto defrag [ 153.690442][ T6234] BTRFS info (device loop5): max_inline at 4096 [ 153.715083][ T6234] BTRFS info (device loop5): using free space tree [ 153.725042][ T6234] BTRFS info (device loop5): has skinny extents [ 153.748927][ T23] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 153.761708][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.782767][ T6245] ocfs2: Slot 0 on device (7,3) was already allocated to this node! [ 153.783850][ T23] usb 3-1: Product: syz [ 153.796652][ T23] usb 3-1: Manufacturer: syz [ 153.798269][ T6245] JBD2: Ignoring recovery information on journal [ 153.801884][ T23] usb 3-1: SerialNumber: syz [ 153.822694][ T23] usb 3-1: config 0 descriptor?? [ 153.839046][ T6245] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 153.878667][ T23] smsc75xx v1.0.0 [ 153.940669][ T26] audit: type=1800 audit(1777003812.748:311): pid=6245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.555" name="file1" dev="loop3" ino=17058 res=0 errno=0 [ 154.774563][ T6234] BTRFS info (device loop5): enabling ssd optimizations [ 154.810227][ T23] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 154.851159][ T23] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 154.923547][ T6245] syz.3.555 (6245) used greatest stack depth: 19096 bytes left [ 154.941155][ T23] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 154.987408][ T23] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 155.053879][ T23] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 155.092964][ T4190] ocfs2: Unmounting device (7,3) on (node local) [ 155.110996][ T23] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 155.141654][ T23] smsc75xx: probe of 3-1:0.184 failed with error -32 [ 155.333151][ T6004] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 155.611501][ T6004] usb 7-1: Using ep0 maxpacket: 32 [ 155.661444][ T6301] netlink: 56 bytes leftover after parsing attributes in process `syz.4.567'. [ 155.741760][ T6004] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 155.762999][ T6004] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 155.791997][ T6004] usb 7-1: New USB device found, idVendor=0458, idProduct=706e, bcdDevice=35.64 [ 155.823079][ T6004] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.252413][ T4270] usb 3-1: USB disconnect, device number 5 [ 157.280457][ T6004] usb 7-1: config 0 descriptor?? [ 157.703788][ T5923] usb 7-1: USB disconnect, device number 3 [ 157.885432][ T6338] netlink: 8 bytes leftover after parsing attributes in process `syz.3.576'. [ 158.305275][ T6357] loop3: detected capacity change from 0 to 16 [ 158.320329][ T6357] erofs: (device loop3): mounted with root inode @ nid 36. [ 158.339669][ T6357] netlink: 3 bytes leftover after parsing attributes in process `syz.3.584'. [ 158.356150][ T6357] 0ªX¹¦À: renamed from caif0 [ 158.392348][ T6357] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 158.573875][ T6372] capability: warning: `syz.4.590' uses deprecated v2 capabilities in a way that may be insecure [ 158.641566][ T6372] fuse: Bad value for 'fd' [ 158.646451][ T6004] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 158.665212][ T6374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.589'. [ 158.827516][ T6382] tipc: Failed to remove unknown binding: 66,0,0/4:1057125736/1057125738 [ 158.837727][ T6382] tipc: Failed to remove unknown binding: 66,0,0/4:1057125736/1057125737 [ 158.860438][ T6382] tipc: Failed to remove unknown binding: 66,0,0/4:1057125736/1057125738 [ 158.896892][ T6382] tipc: Failed to remove unknown binding: 66,0,0/4:1057125736/1057125737 [ 159.038361][ T6004] usb 7-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 159.062629][ T6004] usb 7-1: config 0 interface 0 has no altsetting 0 [ 159.242271][ T6004] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 159.253379][ T6004] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 159.299725][ T6004] usb 7-1: Product: syz [ 159.304041][ T6004] usb 7-1: Manufacturer: syz [ 159.332543][ T6004] usb 7-1: SerialNumber: syz [ 159.339208][ T6004] usb 7-1: config 0 descriptor?? [ 159.383403][ T6360] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 159.407912][ T6004] usb 7-1: selecting invalid altsetting 0 [ 160.173661][ T6360] udc-core: couldn't find an available UDC or it's busy [ 160.201925][ T6360] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 160.238716][ T21] usb 7-1: USB disconnect, device number 4 [ 160.253912][ T6360] usb 7-1: 0:0: usb_set_interface failed (-19) [ 160.320982][ T6360] usb 7-1: 0:0: usb_set_interface failed (-19) [ 160.365278][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 160.402991][ T6407] binder_alloc: 6404: binder_alloc_buf, no vma [ 161.014001][ T6428] loop5: detected capacity change from 0 to 256 [ 161.528928][ T5669] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 162.467628][ T5669] usb 3-1: Using ep0 maxpacket: 8 [ 162.602061][ T5669] usb 3-1: config 0 has no interfaces? [ 162.631129][ T5669] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 162.667174][ T5669] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.678246][ T6461] loop5: detected capacity change from 0 to 1024 [ 162.704528][ T5669] usb 3-1: config 0 descriptor?? [ 162.953434][ T6461] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 162.994569][ T23] usb 3-1: USB disconnect, device number 6 [ 164.391898][ T6509] netlink: 24 bytes leftover after parsing attributes in process `syz.6.635'. [ 164.513966][ T6516] kernel profiling enabled (shift: 9) [ 164.925160][ T6523] loop5: detected capacity change from 0 to 16 [ 164.940407][ T6522] 8021q: adding VLAN 0 to HW filter on device team0 [ 164.978834][ T6523] erofs: (device loop5): erofs_read_superblock: blkszbits 9 isn't supported on this platform [ 165.006389][ T6519] netlink: 182 bytes leftover after parsing attributes in process `syz.2.641'. [ 165.520143][ T5664] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 165.585350][ T6004] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 166.373375][ T23] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 166.439134][ T5664] usb 6-1: Using ep0 maxpacket: 8 [ 166.568670][ T6004] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 166.579462][ T5664] usb 6-1: config 0 has no interfaces? [ 166.585690][ T5664] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 166.629705][ T5664] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.663155][ T23] usb 3-1: Using ep0 maxpacket: 32 [ 167.154330][ T23] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 167.328945][ T5664] usb 6-1: config 0 descriptor?? [ 167.393481][ T23] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 167.403097][ T6004] usb 7-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice=7d.08 [ 167.412588][ T23] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 167.428155][ T23] usb 3-1: Product: syz [ 167.429750][ T6004] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.436064][ T23] usb 3-1: Manufacturer: syz [ 167.449454][ T23] usb 3-1: SerialNumber: syz [ 167.452544][ T6004] usb 7-1: Product: syz [ 167.473575][ T6004] usb 7-1: Manufacturer: syz [ 167.475134][ T23] usb 3-1: config 0 descriptor?? [ 167.485303][ T6004] usb 7-1: SerialNumber: syz [ 167.508366][ T6004] usb 7-1: config 0 descriptor?? [ 167.533269][ T6541] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 167.574850][ T6004] gm12u320 7-1:0.0: [drm:gm12u320_set_ecomode] *ERROR* Misc. req. error -8 [ 167.626484][ T6004] gm12u320: probe of 7-1:0.0 failed with error -5 [ 167.662359][ T6004] usb-storage 7-1:0.0: USB Mass Storage device detected [ 167.718476][ T6004] usb-storage 7-1:0.0: device ignored [ 167.750660][ T23] usb 6-1: USB disconnect, device number 2 [ 167.751128][ T4222] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.001811][ T6537] udc-core: couldn't find an available UDC or it's busy [ 168.020756][ T6537] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 168.021905][ T6004] usb 3-1: USB disconnect, device number 7 [ 168.539030][ T6562] misc userio: The device must be registered before sending interrupts [ 168.611807][ T4222] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.658037][ T5664] usb 7-1: USB disconnect, device number 5 [ 168.791583][ T4222] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.014053][ T4222] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.535861][ T6603] loop6: detected capacity change from 0 to 164 [ 170.663614][ T6603] Unable to read rock-ridge attributes [ 170.742437][ T4222] bond3: (slave gretap1): Releasing active interface [ 170.803410][ T6613] loop5: detected capacity change from 0 to 1024 [ 170.982590][ T6589] chnl_net:caif_netlink_parms(): no params data found [ 171.181637][ T6613] EXT4-fs error (device loop5): ext4_orphan_get:1432: comm syz.5.670: bad orphan inode 134217728 [ 171.239875][ T6613] EXT4-fs (loop5): mounted filesystem without journal. Opts: quota,lazytime,resgid=0x000000000000ee00,,errors=continue. Quota mode: writeback. [ 172.153951][ T21] Bluetooth: hci2: command 0x0409 tx timeout [ 172.312368][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #292!!! [ 172.312538][ T6646] netlink: 798 bytes leftover after parsing attributes in process `syz.6.674'. [ 172.570748][ T6589] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.586981][ T6589] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.655994][ T6589] device bridge_slave_0 entered promiscuous mode [ 172.682453][ T6589] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.789507][ T6589] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.798451][ T6589] device bridge_slave_1 entered promiscuous mode [ 172.838806][ T6657] 9pnet: p9_errstr2errno: server reported unknown error aaaaaaaaa [ 172.906647][ T4222] device hsr_slave_0 left promiscuous mode [ 172.991127][ T4222] device hsr_slave_1 left promiscuous mode [ 173.061125][ T4222] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 173.078343][ T4222] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 173.190971][ T4222] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 173.202563][ T4222] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 173.240356][ T4222] device bond_slave_0 left promiscuous mode [ 173.247005][ T4222] device bond_slave_1 left promiscuous mode [ 173.284240][ T4222] device veth1_macvtap left promiscuous mode [ 173.299713][ T4222] device veth0_macvtap left promiscuous mode [ 173.318668][ T4222] device veth1_vlan left promiscuous mode [ 173.346242][ T4222] device veth0_vlan left promiscuous mode [ 174.213338][ T4222] bond3 (unregistering): Released all slaves [ 174.221057][ T6667] loop6: detected capacity change from 0 to 32768 [ 174.246917][ T6667] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz.6.681 (6667) [ 174.293767][ T4222] bond2 (unregistering): Released all slaves [ 174.349653][ T6667] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm [ 174.359402][ T4222] bond1 (unregistering): (slave macvlan2): Releasing active interface [ 174.376087][ T4222] bond1 (unregistering): Released all slaves [ 174.387647][ T6667] BTRFS info (device loop6): setting nodatasum [ 174.404408][ T21] Bluetooth: hci2: command 0x041b tx timeout [ 174.418020][ T6667] BTRFS info (device loop6): force zlib compression, level 3 [ 174.451664][ T6667] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_LZO (0x8) [ 174.476093][ T6667] BTRFS info (device loop6): use lzo compression, level 0 [ 174.504500][ T6667] BTRFS info (device loop6): turning on flush-on-commit [ 174.511934][ T6667] BTRFS info (device loop6): enabling auto defrag [ 174.540847][ T6667] BTRFS info (device loop6): max_inline at 4096 [ 174.551205][ T6667] BTRFS info (device loop6): using free space tree [ 174.577614][ T6667] BTRFS info (device loop6): has skinny extents [ 174.584741][ T4222] team0 (unregistering): Port device team_slave_1 removed [ 174.618787][ T4222] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 174.638919][ T4222] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 174.747148][ T6667] BTRFS info (device loop6): enabling ssd optimizations [ 174.760710][ T4222] bond0 (unregistering): Released all slaves [ 174.840397][ T6589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.900404][ T6589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.972506][ T6589] team0: Port device team_slave_0 added [ 174.991098][ T6589] team0: Port device team_slave_1 added [ 175.017818][ T6589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 175.049223][ T6589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.084805][ T6589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 175.105182][ T6589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 175.112494][ T6589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.147217][ T6589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.405128][ T6589] device hsr_slave_0 entered promiscuous mode [ 175.442889][ T6589] device hsr_slave_1 entered promiscuous mode [ 175.571798][ T6589] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 175.592023][ T6589] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 175.606391][ T6589] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 175.637522][ T6589] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 175.729247][ T6589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 175.752373][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 175.765175][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 175.776672][ T6589] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.830460][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 175.851995][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 175.862809][ T4300] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.870380][ T4300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.904529][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 175.920118][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 175.931627][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 175.943647][ T4300] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.950903][ T4300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.959563][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 175.969813][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 175.989456][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 176.005263][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 176.023882][ T6589] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 176.035048][ T6589] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 176.050874][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 176.061548][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 176.071237][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 176.080694][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 176.276659][ T6589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 176.295483][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 176.303980][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 176.558389][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 176.572686][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 176.629376][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 176.638343][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 176.646918][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 176.655867][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 176.669928][ T6706] Bluetooth: hci2: command 0x040f tx timeout [ 176.698355][ T6589] device veth0_vlan entered promiscuous mode [ 176.721108][ T6589] device veth1_vlan entered promiscuous mode [ 176.755704][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 176.771508][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 176.782387][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 176.795572][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 176.809657][ T6589] device veth0_macvtap entered promiscuous mode [ 176.829691][ T6589] device veth1_macvtap entered promiscuous mode [ 176.850441][ T6589] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 176.875087][ T6589] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 176.897912][ T6589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 176.921690][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 176.943997][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 176.965399][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 176.987196][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 177.014016][ T6589] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.043139][ T6589] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.060760][ T6589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.076999][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 177.094913][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 177.112258][ T6589] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.122167][ T6589] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.131126][ T6589] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.141433][ T6589] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.257612][ T4300] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.279934][ T4300] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.299549][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 177.331079][ T4309] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.339911][ T4309] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.350359][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 177.441566][ T6764] netlink: 24 bytes leftover after parsing attributes in process `syz.4.698'. [ 177.797678][ T6706] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 178.240753][ T6706] usb 3-1: config 0 has too many interfaces: 229, using maximum allowed: 32 [ 178.254274][ T6784] loop7: detected capacity change from 0 to 16 [ 178.261725][ T6706] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 229 [ 178.399178][ T6706] usb 3-1: New USB device found, idVendor=0458, idProduct=500f, bcdDevice= 0.00 [ 178.663598][ T6784] erofs: (device loop7): erofs_read_superblock: blkszbits 9 isn't supported on this platform [ 178.908184][ T6706] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=31 [ 178.967429][ T6706] usb 3-1: SerialNumber: syz [ 179.491015][ T4270] Bluetooth: hci0: command 0x0406 tx timeout [ 179.499028][ T6706] usb 3-1: config 0 descriptor?? [ 179.504404][ T4270] Bluetooth: hci4: command 0x0406 tx timeout [ 179.510915][ T4270] Bluetooth: hci2: command 0x0419 tx timeout [ 179.801379][ T5669] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 179.829404][ T6766] netlink: 44 bytes leftover after parsing attributes in process `syz.2.697'. [ 179.872226][ T7] usb 3-1: USB disconnect, device number 8 [ 180.227410][ T6820] No such timeout policy "syz1" [ 180.770772][ T5669] usb 8-1: Using ep0 maxpacket: 8 [ 180.776060][ T4224] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 181.633854][ T4224] usb 7-1: Using ep0 maxpacket: 8 [ 181.768096][ T6841] netlink: 'syz.4.704': attribute type 1 has an invalid length. [ 181.812802][ T4224] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 181.886741][ T4224] usb 7-1: config 0 has no interfaces? [ 181.902252][ T6843] bond1: (slave gretap2): making interface the new active one [ 181.910548][ T4224] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 181.918880][ T6843] bond1: (slave gretap2): Enslaving as an active interface with an up link [ 181.961941][ T4224] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.014837][ T4224] usb 7-1: config 0 descriptor?? [ 182.185758][ T5669] usb 8-1: unable to read config index 0 descriptor/all [ 182.193701][ T5669] usb 8-1: can't read configurations, error -71 [ 182.399931][ T5665] usb 7-1: USB disconnect, device number 6 [ 184.741845][ T6889] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 185.919019][ T5669] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 185.970241][ T6925] loop7: detected capacity change from 0 to 256 [ 186.072283][ T6925] exFAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 186.108955][ T6925] exFAT-fs (loop7): Medium has reported failures. Some data may be lost. [ 186.151458][ T6925] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 186.195665][ T5669] usb 3-1: Using ep0 maxpacket: 8 [ 186.325914][ T5669] usb 3-1: config 0 has no interfaces? [ 186.333135][ T5669] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 186.995939][ T5669] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.012810][ T5669] usb 3-1: config 0 descriptor?? [ 187.244398][ T26] audit: type=1804 audit(1777003843.483:312): pid=6943 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.728" name="file0" dev="hugetlbfs" ino=42918 res=1 errno=0 [ 187.276921][ T26] audit: type=1804 audit(1777003843.511:313): pid=6943 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.728" name="file0" dev="hugetlbfs" ino=42918 res=1 errno=0 [ 187.284668][ T5669] usb 3-1: USB disconnect, device number 9 [ 187.969789][ T4820] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.043122][ T4820] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.202770][ T4820] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.381121][ T4820] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.739546][ T4270] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 189.905724][ T6966] chnl_net:caif_netlink_parms(): no params data found [ 190.342197][ T6966] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.349714][ T6966] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.360337][ T6966] device bridge_slave_0 entered promiscuous mode [ 190.402183][ T6966] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.424670][ T6966] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.444865][ T6966] device bridge_slave_1 entered promiscuous mode [ 190.569422][ T6966] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.660059][ T6966] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.817952][ T6966] team0: Port device team_slave_0 added [ 190.904304][ T6966] team0: Port device team_slave_1 added [ 191.009922][ T6966] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 191.030918][ T6966] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 191.070489][ T6966] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 191.091995][ T6966] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 191.105632][ T6966] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 191.139059][ T5669] Bluetooth: hci2: command 0x0409 tx timeout [ 191.197717][ T6966] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 191.289814][ T6994] infiniband syz1: set down [ 191.961294][ T6994] infiniband syz1: added syz_tun [ 192.058862][ T4270] usb 6-1: unable to get BOS descriptor or descriptor too short [ 192.180789][ T6994] RDS/IB: syz1: added [ 192.186148][ T6994] smc: adding ib device syz1 with port count 1 [ 192.200673][ T6994] smc: ib device syz1 port 1 has pnetid [ 192.264874][ T4270] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 192.295154][ T4270] usb 6-1: can't read configurations, error -71 [ 192.336537][ T6966] device hsr_slave_0 entered promiscuous mode [ 192.357941][ T6966] device hsr_slave_1 entered promiscuous mode [ 192.389953][ T6966] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 192.627649][ T6966] Cannot create hsr debugfs directory [ 193.392026][ T5669] Bluetooth: hci2: command 0x041b tx timeout [ 193.470977][ T6966] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 193.503099][ T6966] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 193.524334][ T6966] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 193.538519][ T6966] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 193.680683][ T6966] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.709232][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 193.721263][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 193.732481][ T6966] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.753088][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 193.776104][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 193.790522][ T150] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.797953][ T150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.811268][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.839379][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 193.853032][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 193.874609][ T150] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.881924][ T150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.920659][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 193.930628][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 193.976021][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 193.996195][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 194.016300][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 194.040223][ T6966] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 194.070182][ T6966] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 194.097493][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 194.115264][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 194.132603][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 194.145637][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 194.157700][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 194.166931][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 194.176480][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 194.457767][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 194.469659][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 194.495072][ T6966] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 194.793669][ T4820] device hsr_slave_0 left promiscuous mode [ 194.801028][ T4820] device hsr_slave_1 left promiscuous mode [ 194.808601][ T4820] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 194.816445][ T4820] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 194.825332][ T4820] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 194.832776][ T4820] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 194.840933][ T4820] device bridge_slave_1 left promiscuous mode [ 194.847934][ T4820] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.858431][ T4820] device bridge_slave_0 left promiscuous mode [ 194.864848][ T4820] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.879251][ T4820] device veth1_macvtap left promiscuous mode [ 194.885553][ T4820] device veth0_macvtap left promiscuous mode [ 194.891994][ T4820] device veth1_vlan left promiscuous mode [ 194.898789][ T4820] device veth0_vlan left promiscuous mode [ 195.041137][ T4820] team0 (unregistering): Port device team_slave_1 removed [ 195.058178][ T4820] team0 (unregistering): Port device team_slave_0 removed [ 195.073817][ T4820] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 195.087260][ T4820] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 195.145370][ T4820] bond0 (unregistering): Released all slaves [ 195.202460][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 195.212938][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 195.245684][ T6966] device veth0_vlan entered promiscuous mode [ 195.257535][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 195.267976][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 195.281370][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 195.299943][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 195.314213][ T6966] device veth1_vlan entered promiscuous mode [ 195.345082][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 195.360245][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 195.370289][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 195.385531][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 195.401169][ T6966] device veth0_macvtap entered promiscuous mode [ 195.436154][ T6966] device veth1_macvtap entered promiscuous mode [ 195.484267][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 195.493150][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 195.514387][ T6966] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 195.532876][ T6966] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 195.544510][ T6966] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 195.552776][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 195.562733][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 195.578500][ T6966] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 195.596673][ T6966] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 195.633608][ T6966] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 195.649040][ T6966] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.661292][ T5665] Bluetooth: hci2: command 0x040f tx timeout [ 195.668480][ T6966] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.677740][ T6966] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.686934][ T6966] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.697563][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 195.706485][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 195.776898][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 195.785055][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 195.818488][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 195.864692][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 195.873172][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 195.920007][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 196.042787][ T7124] netlink: 24 bytes leftover after parsing attributes in process `syz.2.760'. [ 196.163278][ T7134] loop8: detected capacity change from 0 to 16 [ 196.257045][ T7134] erofs: (device loop8): erofs_read_superblock: blkszbits 9 isn't supported on this platform [ 196.307373][ T4224] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 196.567663][ T4224] usb 7-1: Using ep0 maxpacket: 32 [ 196.871013][ T4224] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 196.995150][ T4224] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 197.421570][ T4270] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 197.456363][ T4224] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 197.465749][ T4224] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.642824][ T4224] usb 7-1: Product: syz [ 197.647744][ T4224] usb 7-1: Manufacturer: syz [ 197.652955][ T4224] usb 7-1: SerialNumber: syz [ 197.660764][ T4224] usb 7-1: config 0 descriptor?? [ 198.155308][ T4224] Bluetooth: hci2: command 0x0419 tx timeout [ 198.424375][ T4270] usb 9-1: Using ep0 maxpacket: 8 [ 198.600747][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 198.955847][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.255232][ T4270] usb 9-1: config 0 has no interfaces? [ 199.261139][ T4270] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 199.281710][ T4270] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.311809][ T4270] usb 9-1: config 0 descriptor?? [ 200.233573][ T5670] usb 7-1: USB disconnect, device number 7 [ 200.999683][ T1324] usb 9-1: USB disconnect, device number 2 [ 201.159319][ T7224] netlink: 4 bytes leftover after parsing attributes in process `syz.6.772'. [ 202.532876][ T26] audit: type=1804 audit(1777003857.591:314): pid=7240 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.776" name="file0" dev="hugetlbfs" ino=44619 res=1 errno=0 [ 202.662839][ T26] audit: type=1804 audit(1777003857.619:315): pid=7240 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.776" name="file0" dev="hugetlbfs" ino=44619 res=1 errno=0 [ 204.674745][ T7288] fuse: Unknown parameter 'user_id./file0' [ 205.316975][ T7309] rdma_rxe: ignoring netdev event = 23 for syz_tun [ 205.397689][ T7309] rdma_rxe: syz_tun changed mtu to 257 [ 207.846140][ T7350] netlink: 8 bytes leftover after parsing attributes in process `syz.5.805'. [ 209.286114][ T7363] loop6: detected capacity change from 0 to 1024 [ 209.675449][ T7372] netlink: 63 bytes leftover after parsing attributes in process `syz.5.811'. [ 211.461884][ T6004] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 211.505123][ T7393] netlink: 12 bytes leftover after parsing attributes in process `syz.6.815'. [ 212.024602][ T1324] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 212.521315][ T1324] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 212.553048][ T1324] usb 7-1: config 0 has no interfaces? [ 212.563923][ T6004] usb 9-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 212.580385][ T6004] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 212.596593][ T1324] usb 7-1: New USB device found, idVendor=110a, idProduct=1130, bcdDevice= e.76 [ 212.672427][ T1324] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.694344][ T6004] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 212.704009][ T6004] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.740449][ T1324] usb 7-1: config 0 descriptor?? [ 212.742353][ T6004] usb 9-1: config 0 descriptor?? [ 212.826210][ T6004] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 213.096867][ T7419] No such timeout policy "syz1" [ 213.662426][ T1324] usb 7-1: USB disconnect, device number 8 [ 214.199078][ T7429] netlink: set zone limit has 8 unknown bytes [ 215.175676][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 215.396726][ T4270] usb 9-1: USB disconnect, device number 3 [ 215.760099][ T7448] loop6: detected capacity change from 0 to 64 [ 216.143813][ T7448] BFS-fs: bfs_fill_super(): loop6 is unclean, continuing [ 216.690881][ T7460] loop5: detected capacity change from 0 to 512 [ 217.142454][ T7460] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 217.372108][ T7460] ext4 filesystem being mounted at /133/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 218.170632][ T7505] netlink: 'syz.4.847': attribute type 10 has an invalid length. [ 218.393407][ T7505] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 221.050151][ T7534] xt_hashlimit: size too large, truncated to 1048576 [ 221.152750][ T7534] xt_hashlimit: invalid rate [ 221.191803][ T7547] netlink: 4 bytes leftover after parsing attributes in process `syz.4.854'. [ 222.697894][ T7559] ------------[ cut here ]------------ [ 222.721576][ T7561] netlink: 40 bytes leftover after parsing attributes in process `syz.2.857'. [ 223.100631][ T7559] WARNING: CPU: 0 PID: 7559 at fs/udf/udfdecl.h:127 udf_new_block+0x1858/0x1a90 [ 223.312971][ T7561] netlink: 40 bytes leftover after parsing attributes in process `syz.2.857'. [ 223.366242][ T7572] overlayfs: failed to clone upperpath [ 223.385362][ T7559] Modules linked in: [ 223.410094][ T7559] CPU: 0 PID: 7559 Comm: syz.2.857 Not tainted syzkaller #0 [ 223.491820][ T7561] netlink: 40 bytes leftover after parsing attributes in process `syz.2.857'. [ 223.510269][ T7559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 223.520958][ T7559] RIP: 0010:udf_new_block+0x1858/0x1a90 [ 223.526996][ T7559] Code: 24 48 e8 8b 34 fe 06 45 31 ed 49 be 00 00 00 00 00 fc ff df e9 ac fd ff ff e8 34 25 b2 fe 0f 0b e9 1f fc ff ff e8 28 25 b2 fe <0f> 0b e9 40 ff ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c dc e8 ff [ 223.547102][ T7559] RSP: 0018:ffffc90002f5f8c0 EFLAGS: 00010287 [ 223.552257][ T7561] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 223.577152][ T7559] RAX: ffffffff82c70f68 RBX: 00000000f8de3e3a RCX: 0000000000080000 [ 223.594172][ T7559] RDX: ffffc90004ed9000 RSI: 0000000000003983 RDI: 0000000000003984 [ 223.605514][ T7559] RBP: ffffc90002f5faf0 R08: ffffffff8d89f06f R09: 1ffffffff1b13e0d [ 223.621153][ T7559] R10: dffffc0000000000 R11: fffffbfff1b13e0e R12: ffff88807f448000 [ 223.635316][ T7559] R13: 0000000000000086 R14: ffff888071c4e01f R15: dffffc0000000000 [ 223.647183][ T7559] FS: 00007fc30e87a6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 [ 223.660566][ T7559] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 223.681906][ T7559] CR2: 00005605bfe91950 CR3: 0000000065c0c000 CR4: 00000000003506f0 [ 223.713516][ T7559] Call Trace: [ 223.733040][ T7559] [ 223.750926][ T7559] ? udf_prealloc_blocks+0xf10/0xf10 [ 223.776372][ T7559] udf_new_inode+0x399/0xf00 [ 223.799639][ T7559] ? udf_free_inode+0x2d0/0x2d0 [ 223.821418][ T7559] udf_mkdir+0xcd/0x4a0 [ 223.839317][ T7559] ? udf_symlink+0x1350/0x1350 [ 223.862501][ T7559] ? end_current_label_crit_section+0x14b/0x170 [ 223.893101][ T7559] ? from_kgid+0x169/0x690 [ 223.914787][ T7559] ? make_kgid+0x660/0x660 [ 223.935264][ T7559] ? apparmor_path_mkdir+0x1ac/0x230 [ 223.961587][ T7559] ? generic_permission+0x230/0x510 [ 223.989328][ T7559] ? inode_permission+0xef/0x480 [ 224.012520][ T7559] ? bpf_lsm_inode_mkdir+0x5/0x10 [ 224.033716][ T7559] ? security_inode_mkdir+0xb3/0x100 [ 224.059266][ T7559] vfs_mkdir+0x387/0x570 [ 224.078778][ T7559] do_mkdirat+0x1df/0x5b0 [ 224.098641][ T7559] ? vfs_mkdir+0x570/0x570 [ 224.121798][ T7559] ? getname_flags+0x1fe/0x500 [ 224.147639][ T7559] __x64_sys_mkdirat+0x85/0x90 [ 224.168251][ T7559] do_syscall_64+0x4c/0xa0 [ 224.192820][ T7559] ? clear_bhb_loop+0x30/0x80 [ 224.214937][ T7559] ? clear_bhb_loop+0x30/0x80 [ 224.237586][ T7559] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 224.266991][ T7559] RIP: 0033:0x7fc310620dd9 [ 224.287188][ T7559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 224.379997][ T7559] RSP: 002b:00007fc30e87a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 224.419712][ T7559] RAX: ffffffffffffffda RBX: 00007fc310899fa0 RCX: 00007fc310620dd9 [ 224.456756][ T7559] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 224.492635][ T7559] RBP: 00007fc3106b6d69 R08: 0000000000000000 R09: 0000000000000000 [ 224.521279][ T7559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 224.537498][ T7559] R13: 00007fc31089a038 R14: 00007fc310899fa0 R15: 00007ffece5afb68 [ 224.552898][ T7559] [ 224.555978][ T7559] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 224.563359][ T7559] CPU: 1 PID: 7559 Comm: syz.2.857 Not tainted syzkaller #0 [ 224.570896][ T7559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 224.580996][ T7559] Call Trace: [ 224.584291][ T7559] [ 224.587496][ T7559] dump_stack_lvl+0x188/0x250 [ 224.592366][ T7559] ? show_regs_print_info+0x20/0x20 [ 224.597885][ T7559] ? load_image+0x400/0x400 [ 224.602419][ T7559] panic+0x2e5/0x810 [ 224.606432][ T7559] ? bpf_jit_dump+0xd0/0xd0 [ 224.611336][ T7559] ? udf_new_block+0x1858/0x1a90 [ 224.616383][ T7559] __warn+0x248/0x2b0 [ 224.620397][ T7559] ? udf_new_block+0x1858/0x1a90 [ 224.625612][ T7559] report_bug+0x1b7/0x2e0 [ 224.630147][ T7559] handle_bug+0x3a/0x70 [ 224.634321][ T7559] exc_invalid_op+0x16/0x40 [ 224.638938][ T7559] asm_exc_invalid_op+0x16/0x20 [ 224.643932][ T7559] RIP: 0010:udf_new_block+0x1858/0x1a90 [ 224.649761][ T7559] Code: 24 48 e8 8b 34 fe 06 45 31 ed 49 be 00 00 00 00 00 fc ff df e9 ac fd ff ff e8 34 25 b2 fe 0f 0b e9 1f fc ff ff e8 28 25 b2 fe <0f> 0b e9 40 ff ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c dc e8 ff [ 224.669999][ T7559] RSP: 0018:ffffc90002f5f8c0 EFLAGS: 00010287 [ 224.676096][ T7559] RAX: ffffffff82c70f68 RBX: 00000000f8de3e3a RCX: 0000000000080000 [ 224.684082][ T7559] RDX: ffffc90004ed9000 RSI: 0000000000003983 RDI: 0000000000003984 [ 224.692164][ T7559] RBP: ffffc90002f5faf0 R08: ffffffff8d89f06f R09: 1ffffffff1b13e0d [ 224.700240][ T7559] R10: dffffc0000000000 R11: fffffbfff1b13e0e R12: ffff88807f448000 [ 224.708317][ T7559] R13: 0000000000000086 R14: ffff888071c4e01f R15: dffffc0000000000 [ 224.716483][ T7559] ? udf_new_block+0x1858/0x1a90 [ 224.721607][ T7559] ? udf_prealloc_blocks+0xf10/0xf10 [ 224.727127][ T7559] udf_new_inode+0x399/0xf00 [ 224.731828][ T7559] ? udf_free_inode+0x2d0/0x2d0 [ 224.736711][ T7559] udf_mkdir+0xcd/0x4a0 [ 224.741112][ T7559] ? udf_symlink+0x1350/0x1350 [ 224.746003][ T7559] ? end_current_label_crit_section+0x14b/0x170 [ 224.752434][ T7559] ? from_kgid+0x169/0x690 [ 224.756876][ T7559] ? make_kgid+0x660/0x660 [ 224.761316][ T7559] ? apparmor_path_mkdir+0x1ac/0x230 [ 224.766707][ T7559] ? generic_permission+0x230/0x510 [ 224.772375][ T7559] ? inode_permission+0xef/0x480 [ 224.777510][ T7559] ? bpf_lsm_inode_mkdir+0x5/0x10 [ 224.782852][ T7559] ? security_inode_mkdir+0xb3/0x100 [ 224.788256][ T7559] vfs_mkdir+0x387/0x570 [ 224.792904][ T7559] do_mkdirat+0x1df/0x5b0 [ 224.797609][ T7559] ? vfs_mkdir+0x570/0x570 [ 224.802811][ T7559] ? getname_flags+0x1fe/0x500 [ 224.807817][ T7559] __x64_sys_mkdirat+0x85/0x90 [ 224.812900][ T7559] do_syscall_64+0x4c/0xa0 [ 224.817508][ T7559] ? clear_bhb_loop+0x30/0x80 [ 224.822208][ T7559] ? clear_bhb_loop+0x30/0x80 [ 224.827169][ T7559] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 224.833183][ T7559] RIP: 0033:0x7fc310620dd9 [ 224.837711][ T7559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 224.858229][ T7559] RSP: 002b:00007fc30e87a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 224.866942][ T7559] RAX: ffffffffffffffda RBX: 00007fc310899fa0 RCX: 00007fc310620dd9 [ 224.875193][ T7559] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 224.883617][ T7559] RBP: 00007fc3106b6d69 R08: 0000000000000000 R09: 0000000000000000 [ 224.891874][ T7559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 224.899948][ T7559] R13: 00007fc31089a038 R14: 00007fc310899fa0 R15: 00007ffece5afb68 [ 224.908470][ T7559] [ 224.911601][ T7559] Kernel Offset: disabled [ 224.916420][ T7559] Rebooting in 86400 seconds..