last executing test programs: 2.479716379s ago: executing program 2 (id=20620): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_buf(r0, 0x29, 0xcf, 0x0, 0x4) 2.337173915s ago: executing program 2 (id=20623): r0 = socket(0x2b, 0x80801, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000940)=@raw={'raw\x00', 0x3c1, 0x3, 0x388, 0x1a8, 0x5c, 0x160, 0x0, 0x3e0, 0x2b8, 0x228, 0x25a, 0x2b8, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0xffffff00, 0xffffffff], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0x160, 0x1a8, 0x52020000, {0x0, 0x6802000000000000}, [@common=@srh1={{0x90}, {0xff, 0x84, 0x3, 0x1, 0x6, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, [0xffffff00, 0xffffff, 0x0, 0xffffff00], [0xff, 0xff, 0xffffffff, 0xffffff00], [0x0, 0xffffffff, 0xff], 0x1000, 0x4449}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@CT0={0x48}}, {{@ipv6={@local, @private2, [0x0, 0x0, 0xff000000], [0xff], 'bond_slave_0\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz0\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 2.224693221s ago: executing program 2 (id=20626): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x400) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0xc08c5335, &(0x7f00000001c0)={0x0, 0x80, 0x1, 'queue0\x00'}) 2.136278825s ago: executing program 2 (id=20629): r0 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt(r0, 0x0, 0x90, 0x0, 0x0) 2.019678451s ago: executing program 2 (id=20632): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f0000000300)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 1.901451277s ago: executing program 2 (id=20635): syz_usb_connect$cdc_ncm(0x4, 0x9b, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902890002010650000904000001020d00000524060001052400a9b30d240f01020000000300ff000506241a0c001407240a050905580c241b04000200a90c090003042402020324"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 1.8372787s ago: executing program 3 (id=20636): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000003000)=ANY=[@ANYBLOB="f410000021000101000000000000000000000001000000000000000000000000ac141400"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000050001100fc00000000000000000000000000000000000000000000000000000000000000fe80000000000000000000000000000f200100000000000000000000000000000000000000000000000000000a00100002"], 0x10f4}}, 0x0) 1.789072742s ago: executing program 3 (id=20638): syz_mount_image$ocfs2(&(0x7f0000004740), &(0x7f0000004780)='./file0\x00', 0x100000a, &(0x7f00000002c0)={[{@journal_async_commit}, {@heartbeat_none}, {@usrquota}, {@barrier={'barrier', 0x3d, 0x7}}, {@heartbeat_none}, {@inode64}]}, 0x1, 0x4703, &(0x7f0000004800)="$eJzs212IXFcBB/BzJ6vZpMl2P9ImafoxSQQXLcumT9X6ENeqjabNh7bVVFlnN9vN6uzMujujBYPUIIiCoARBxQ+qQulLLYiBvtQiFPxAWoVSUbS+iBSq4INBG+jKzNybnXtntneyk7S0/f2gnb3n3nPumf3vPXfOPZNCrHZqYaW4sFIsVYrV2ftXbil+rlquL86FwqvktT4/vbkSOcn+tXPkfR/4yD23hPCHY1/70Orq6mpoGA5dHWj7+fy/T8+2vyYKmTqNdru31vLH+iMv/fwtr3REnhMhhB0d/WrYFEL42C9C2BxCGInLRuPXLSGEbSGEKITw6G/+9ePBfrrQ5uy9Lzx37MzhfWemHn/smQvzR9c9MArhu+XdN88vvrh/023Pv+MynR4AAF7RB48fufvo5IHwZBSGzg10fl7fGb8mn4/vfNun7np4YG3/Kr3Z9CqGCgAAABlr8//h6OUu63XJylqyJPjEAyfufipa229i+/p26K4jt79/8kC8/ht17L81Lvrnezc111Cz677Z9d+RTP3u679r53n4q8/+svLWjfc/6V9y3uEQFSZS24XCxEQIx6Za27uirYVydaX2zvur9crJjZ/3jSKdf3b1fm1Bv9f8RzPV89b/d3/i8z/bMtDPOxgL2b/axnax80+ZLtL5rz+W/+RLUU/5j2Xq5eV/x9Pbz/9qcz/vIHtGLkU6/9aFuK/9gGJrAGjk/82B/Px3ZNrPy//7U+cePbGB7/80xpnhqNHXwdQI8HJcvs5XmMhI598KIjV0xr/I9a7//2XyvybTfl7+d1b/8bu/9XH/X2/8H5/qp803j3T+rSCKqSPWrv+RQv71f22m/bz8f3vqz89+sq97dWf+jf6Pu//3JJ1/fCNOD57N32Sv4//OTPt5+e8au++hhQ30+8Nb4n4ORWGs7Vun5xq3sKG19ermlKaxe2kDJ3kTSOff+q2lLp2h1kvz+h/OH/93ZdrPy/+hPV9/z+m+vv/bffyfNP73JJ3/lmbZpeT/Uib/3Zn28/L/4em//+W+yzz+N7YPyr8n6fy3duxfe/5T6Gn+d12mft7zn32jTz3y1z7m/0n/kvMmz3+S5xDjUev5D92l879q3eN6vf/vydTLu/6/9Z/nn97fz/gfDXoC0Id0/ttahV0mgL3mf32m/bz8v3DPlz/+pw3M/5qf+AaT/Nvm/5tb5UeN/z1J57+9VZj6x1APNv/fvP9Hnbn/N5P/DZn28/K/cGhi4CuX+f7f6P94l0fZdErnP7TucY38f9/D/f/GTL28/L+496cv3tzX5/8QJs31Nyyd/9XrHte8/gfz878pUy8v/+9849dPPNhH/9/eR12y+bfu9anLKf5s3uv8v5hpPy//H42fP7v/Csz/bnX/70k6/9aq+aXkn53/7820n5f/9478YHngCjz/uUP+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzIavw6HqDCR2i4UJiZCGIu3d4Wt0Uzp5PRMuTr7mZUQdsTlxTAazZerM6Xy9EKlenJuulQuV2dDuCbevyMMRivlam16sbR07cW2tkSn5krLtZm5Ui2EsDMuvz5sT9qaWagtlpaaxyZ1ropKn61Xa6WJ+srccth9sXxbUj6/XK0vXXexrasL1eWlU6XK9MmF5XdPTk5Ohj0X+zwSzT1Qm6vUWr1t7W3USeoOR21vprn7hrbzfbpaX66Uys3yG9vqlKuzpXJbnZvazldbrldmS7W56XJ1Pjlfsa1u23tr7t4b7xsPI6n3l9TNOhi/3n7o+EePHz7Qsb8YpfOu1BfnJrd3/5sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4I3rydve9e0QwkBrqxBCOJj8EMX/pZy994Xnjp05vO/M1OOPPXNh/mi3YwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4PztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYuZ+XKro4DsBnxve+FkgpbYRcBoaI6E7Cgn4RSeU1smWb1kGtEjIoCgwjWhYEQVC7qCBoFVT+BVELl62qTS1aGERQMTqTlzvCDS90zHkeGM4Mc++ZLwzcO3M+hwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALB+nN2x2JW1l3ZtXtq6+0PozM/9H0IYTZb3P+/tCD0hhK9fZk6HVdpCT1P/bybnxstXTX7v7R9/eH00WXv9xXeL63aHJB1qON6ZpOnQ0Nr736juDD6bHkxCSGMXQhQLY0/O1EIIHbELIYqfH+cvZr/v/8UuhCj6P9ztyu5/LXYhRLF196e+Wv6MR/Wcr18YbPzvb/UI3sYjOuvQ25NX3qVuauW9zN//k3zzPlgNsyeOvH8euwiimZ2bOhq7BgAA4O861yL/D1uW9+9fTkJPdzn3/9aU//c29b96/r/i3vYbYzNthRDbSmOT2fHwvnb63PhODVy9/bpmvKeq5P/VJv+vNvl/tcn/q03+X23yfzKv5P+V9PjmnsUXsYsgGvk/AABUz6HjE1P14ZHs5X/Tj85yXt+Xt/U8T39wa3rgUcO4kfzw33b42MSBg8Mj+X0vDwiurP+QLp39ns/3aG4Lk03zLlqt/9D7dGH+Wmf5E/U/nL9R1Fdc1/oPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAvdueehkEwCsPod1sRtdGqaMLCT4IPNDAiACnMaEAHEwZgIAQUMJBzlnuTZ3kBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA5/tXeV18f2mM9Foj0lR22bV/jqfZz9y3w/I+e9y4FQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZ24EAGAAAAQJi/dR7tBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4KkAAAD//8Oayzs=") quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x1, 0xc7, 0xf, 0x2, 0xc5, 0x4, 0x0, 0x9d}) 867.710288ms ago: executing program 1 (id=20649): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="14000000690001"], 0x14}], 0x1}, 0x0) 844.107839ms ago: executing program 0 (id=20650): r0 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) syz_clone3(&(0x7f0000000340)={0x200103000, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) 819.95671ms ago: executing program 3 (id=20651): r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000740), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000780)={0x3a, 'syz0', 0x3a, 'E', 0x3a, 0x1, 0x3a, 'syzkaller1\x00', 0x3a, '{{4+$&.$\xb7&^\'*!)', 0x3a, './file0'}, 0x41) 701.097036ms ago: executing program 1 (id=20652): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x0, 0x9}, &(0x7f0000000000)=0x90) 633.696329ms ago: executing program 1 (id=20653): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x3, &(0x7f0000000140)=[{0x20, '\x00', @data=0x2103, 0x802}, {0x1b, '\x00', @buffer={"010d1de90c6171360aafc21653890000da925d10853700573a1c8305a6552c00", 0x20}, 0x7a7ce1c2}, {0x18, '\x00', @st={0x4, [{0x3, @svalue=0x9ff}, {0x1, @uvalue=0x7fffffff}, {0x2, @svalue=0x2}, {0x2, @svalue=0x4}]}, 0x7ff}]}) 567.810902ms ago: executing program 0 (id=20654): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(r0, 0xc040564a, &(0x7f0000000140)={0x0, 0x1, @value=0x100f}) 483.386207ms ago: executing program 0 (id=20655): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x80000000000005, &(0x7f0000000280)='u', 0x1) 441.940608ms ago: executing program 1 (id=20656): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @remote, 0x0, 0x0, 'rr\x00', 0x37, 0xfffffffe, 0x7f}, 0x2c) 381.914522ms ago: executing program 0 (id=20657): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x48100) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c643c, &(0x7f0000000000)) 305.841575ms ago: executing program 1 (id=20658): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_buf(r0, 0x6, 0x21, 0x0, &(0x7f0000000100)) 298.175496ms ago: executing program 3 (id=20659): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'tunl0\x00', &(0x7f00000005c0)={'syztnl0\x00', 0x0, 0x40, 0x0, 0xfffffffe, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0x2b}, @multicast2}}}}) 263.586728ms ago: executing program 0 (id=20660): syz_mount_image$hfs(&(0x7f00000007c0), &(0x7f0000000000)='./file1\x00', 0x30008c0, &(0x7f0000000980)=ANY=[@ANYBLOB="66696c655f756d61736b3d30303030303030303030303030303030303030373737372c6469725f756d61736b3d30303030303030303030303030303030303030303030302c696f636861727365743d69736f383835392d362c636f6465706167653d63703835352c63726561746f723d4ddd71752c00eeabc72a9832436950c6116498dda8be60a94746ea68766f63d1d63944fbda2a9337439b37b6f2a694ba98f40070d09c3890bd28a2018f1adfe1e0a630020a9cac1a43800a70a9328ddb2a2f2e207da7cd3caf243b39eaff4966b7aa97cb6cc7d2cfc59e7a976de0a00d23c7ffaaa056cc4f8bc7b4c0f9a21db642b3e832e30a90ba1b9e7933b77c60f6a1b9ca9128f0a2d0e23373c9d15c79865bae97ddd82b98001b6aa9c5390e4deaf5f0ee492c6842b1c08486e479a889491459a257e9d4083634dac6cd58520f72e6c2f11bbd5b03655bb1863b16f3", @ANYBLOB="11f4579be01e435c584a33c63f8173f96bc4546035804d47be19163bd9e589bfdd0a9e6804495a4e4d83804e78ac5a72446295afd79de3fd6a02932a26ab4045133c371e56b0d48544db3c7db23a432f837b93f89b6f223cd1f6731d407ffdb1dd9467f5cd2d6c4e8b9d4f50d338ac91501a4bb780c4723929e22f55254546facc4f0284e644e6", @ANYRES8, @ANYRESHEX=0x0], 0x11, 0x314, &(0x7f0000000b80)="$eJzs3U1rE08cB/Dv7KZN+m/pf7UVwYNINWAvovUiXiIlL8KTqE0KxSWitviAYBVPIvbu3aNXX4N4UQTP9eRJPHiqBxmZh2SfN6lmd1P9fsCy2dmZ/e3OzlPALIjon7Xa3n11/ov6JwAXLvDsIuAAaAA1AEdwtLHV29zY9LudvIJcHK+bXAImp0gcs9brpmVtwOawPPWphrnwPiqGlPLS56qDoMrp1i/d6M4Tuieo29apExsVxZfl8f6zfJsBsF1EMBMlv6bEHvZwD/OlhUNERBNJmPHdseP8nJ2/Ow7QtIOJSpu48f937VUdQOFkbmpo/NerLClUvf+vk4L1nl7CqXSnv0pMK+t17PNU7PM0zNMTmV2KYatKHYszs77hd8+s3fQ7Dp6gZYUOW9R/O/bxtCLR1hNFL6WsTXMMSpvJPESkzyhn9TVMqWtYMfHfBRCJfyH3jAUQ78QHcUV4eInOYP5Xk0JVk64pL1ZTJv6z2SXqq/TUUbDdRqvVciKHHNInOWbPYA25ygbcrDNO2zIjXxB4w+LUuQ7HcpmrOzck10JqrhW9vQwnI9diJJe6mvUN/232qUohXojLYglf8Qbt0PzfUfE1kWyZoYc+aDWiaYYCfcdV64zWbEitaXsiPXJsfdp9aPYnm8vgLiYbrPUjv0+jfXiO67iA+Tv3H9xwfb97W21c89XjqjcGe27N2Q2/O/UUCCdNyga2gz11SC1xcH9QKjOw5bEWqPqPlCTVsHrf+3tUKxtW4KM/jUf1A4XeutkRrmJ/G/2uazwFtt+P50HqTxsiST+llCU2oh17Z+JJ1XRLVK6g0kc7PmWqQwebqlJh1n/BeqVmJnvqj5c6Tx/xiwBbolRz7MEKLsgrzYwcwH85K7i0YjNXcMk1V2LNqNdcJ08Dp0Y/o2fj/EuINj7iKr//JyIiIiIiIiIiIiIiIiIiIiIiIiI6aMr4zzBVXyMRERERERERERERERERERERERERERER0UG32oD53Wv03/+L0d7/G38Vi2t+Enws7//d6YHv/yUq3q8AAAD///B/c8c=") openat(0xffffffffffffff9c, &(0x7f0000000280)='./bus\x00', 0x4040, 0x0) 191.069041ms ago: executing program 3 (id=20661): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x8, &(0x7f0000000880), 0x4) 109.224315ms ago: executing program 1 (id=20662): capset(&(0x7f0000000300)={0x20071026}, &(0x7f0000000340)) prctl$PR_GET_IO_FLUSHER(0x3a) 100.803065ms ago: executing program 3 (id=20663): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000001680)=@raw={'raw\x00', 0x41, 0x3, 0xa18, 0x0, 0x19, 0x0, 0x0, 0x0, 0x980, 0x1f0, 0x1f0, 0x980, 0x1f0, 0x3, 0x0, {[{{@ip={@private, @dev, 0xffffffff, 0x0, 'wlan1\x00', 'wg1\x00'}, 0x0, 0x888, 0x8a8, 0x0, {0x0, 0xffffffffa0028000}, [@common=@unspec=@quota={{0x38}, {0x1}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x3ff}, {0x3, 0x3}, {0x3, 0x1}, {0x995, 0x2}, {0x5, 0x1}, {0x8896}, {0x6, 0x3}, {0x8, 0x1}, {0x101, 0x2}, {0x6}, {0x5, 0x1}], [{0xff, 0x5}, {0x4, 0x881d}, {0x0, 0xb}, {0x3, 0x7f}, {0x7ff, 0x8}, {0x6, 0x6}, {0x9, 0x7}, {0x9, 0x4}, {0x5, 0x2}, {0x1d1e, 0x9}, {0x0, 0x7}], 0x5, 0x1}, {[{0x1}, {0x7fffffff, 0x2}, {0x4, 0x3}, {}, {0x383, 0x1}, {0xebea, 0x2}, {0x3}, {0x800, 0x2}, {0x7, 0x2}, {0x3, 0x3}, {0xfffffff7}], [{0x5, 0x9}, {0x1, 0x9}, {0x7, 0x4}, {0x3, 0x5}, {0x3, 0x8}, {0x6, 0x1000}, {0x9, 0x6f528900}, {0x6, 0x3}, {0x10, 0x3}, {0xfffffff8, 0x3}, {0x400, 0x80}], 0x1, 0x5}, {[{0x7, 0x2}, {0x9}, {0x5}, {0xffffffff, 0x1}, {0xd, 0x3}, {0x313, 0x1}, {0xfed}, {0x5, 0x3}, {0x80, 0x2}, {0x7fff, 0x2}, {0x1, 0x3}], [{0x3, 0x6a}, {0x400, 0xfff}, {0x100, 0x5d68}, {0x8dc, 0x5}, {0x800, 0x1}, {0x6, 0x5}, {0xa2, 0x200}, {0x9, 0x2}, {0x3, 0x6}, {0x2, 0x4}, {0x60, 0x78395991}], 0x0, 0x2}, {[{0x7, 0x3}, {0xffff, 0x2}, {0x4, 0x2}, {0x2, 0x2}, {0xffffff81, 0x2}, {0xfff}, {0x1, 0x2}, {0xddc4, 0x3}, {0x7fffffff}, {0x6, 0x1}, {0x6, 0x2}], [{0xd6f, 0x9}, {0x2, 0x5}, {0x100, 0xd12}, {0x0, 0x2}, {0x800, 0x1}, {0xfffffffe, 0x3}, {0xffffff9d, 0x10001}, {0x3ff, 0x9}, {0x6, 0xf2}, {0x8, 0x8}, {0xfff}], 0xb, 0xb}, {[{0x7, 0x3}, {0x1, 0x3}, {0xc756, 0x1}, {0x2, 0x1294a4f2d4f6b7e4}, {0x0, 0x1}, {0xb}, {0x537, 0x3}, {0x3, 0x1}, {0x6, 0x1}, {0x6}, {0x4, 0x2}], [{0xffffffff, 0x9}, {0x4, 0x2}, {0x8, 0x9}, {0x1, 0x10001}, {0x2, 0x6}, {0x9}, {0x3}, {0x9, 0x1}, {0x6}, {0x5, 0x9}, {0x6, 0x1}], 0x5, 0x7}, {[{0x8, 0x7}, {0x400}, {0x5, 0x2}, {0x6}, {0x8, 0x3}, {0x7, 0x3}, {0x3ff}, {0x4, 0x1}, {0x9, 0x3}, {0x86c, 0x1}, {0x1, 0x1}], [{0xa, 0x17}, {0x9, 0x3}, {0xbc72, 0x5}, {0xe, 0x6}, {0x3ff, 0x401}, {0x10001, 0x10}, {0x0, 0x5}, {0x4, 0x6}, {0x7, 0x40}, {0x2}, {0x7, 0x8001}], 0xb, 0xa}, {[{0x8, 0x7}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x1, 0x3}, {0x651, 0x3}, {0x3}, {0xbac, 0x1}, {0xffffffff, 0x3}], [{0xfffffff9, 0xdb}, {0x9b, 0x5}, {0x600000, 0x2}, {0x267, 0xffffffff}, {0x6, 0xffffff0c}, {0x9, 0x6}, {0x3, 0x9}, {0x9, 0x8}, {0x8, 0x40}, {0x4, 0x6}, {0x4, 0x7}], 0x2, 0x1}, {[{0x2, 0x3}, {0x2, 0x2}, {0x6, 0x3}, {0x7f, 0x3}, {0x2, 0x2}, {0x1, 0x3}, {0x7, 0x3}, {0x3ff}, {0x763, 0x1}, {0xe1e5, 0x1}, {0xba, 0x3}], [{0xc, 0x8}, {0x0, 0x6}, {0x7fffffff, 0x8}, {0x8001, 0x7}, {0x39bd, 0x3}, {0xfffffffe, 0x5}, {0x7d53, 0x5}, {0x6, 0x3}, {0x1, 0x695e}, {0x4, 0x3}, {0xd1}], 0xa, 0x9}, {[{}, {0xac2}, {0x8001, 0x3}, {0x3, 0x2}, {0xe, 0x1}, {0x0, 0x3}, {0x0, 0x2}, {0x7b}, {0x9, 0x1}, {0x1, 0x1}, {0x245, 0x3}], [{0x9, 0x7f}, {0x0, 0x6}, {0x2, 0x68}, {0x30000000, 0x2}, {0x1c0, 0xe5}, {0x9, 0x1}, {0x3, 0xfffffff7}, {0x0, 0x400}, {0x86f, 0x3b}, {0x80, 0x5}, {0x7, 0x40}], 0x4, 0x1}, {[{0x7ff}, {0x2, 0x3}, {0x9, 0x3}, {0x1, 0x2}, {0x2, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x3, 0x2}, {0xe9, 0x3}, {0x0, 0x3}, {0x3}], [{0x40, 0x1}, {0x3, 0x9}, {0x5ee504, 0x9}, {0x100, 0x8001}, {0x3}, {0xffff, 0x3}, {0x5, 0x3}, {0x68b, 0x3ff}, {0x8, 0x7fff}, {0x6, 0x8001}, {0xffffff7f, 0x9}], 0x2, 0x5}, {[{0x7, 0x1}, {0x3, 0x1}, {0x10, 0x1}, {0x3, 0x1}, {0x8, 0x3}, {0x1, 0x3}, {0x2006, 0x2}, {0x2, 0x3}, {0xfffffffd, 0x2}, {0x4, 0x1}, {0xd8e, 0x3}], [{0x40000000, 0x7}, {0x5, 0x5e48670}, {0x7, 0x7f}, {0x6, 0x8}, {0xfffffff8, 0x3}, {0x0, 0x8}, {0x7e7a, 0xd09}, {0x7727, 0x8}, {0x3, 0xa}, {0x1, 0x8}, {0x6, 0x5}], 0x9}], 0x1}}]}, @unspec=@TRACE={0x20}}, {{@ip={@empty, @empty, 0x0, 0x0, 'team0\x00', 'netpci0\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x21, 0xffffffff, 0x3, '\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0xa78) 0s ago: executing program 0 (id=20664): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000000)="6bb7", 0x2}, {0x0}], 0x2) kernel console output (not intermixed with test programs): xPacketSize 0 [ 1482.762942][T15345] FAT-fs (loop3): Directory bread(block 64) failed [ 1482.773260][T13665] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 1482.785897][T15345] FAT-fs (loop3): Directory bread(block 65) failed [ 1482.795197][T13665] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1482.805352][T15345] FAT-fs (loop3): Directory bread(block 66) failed [ 1482.814507][T13665] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 1482.824528][T15345] FAT-fs (loop3): Directory bread(block 67) failed [ 1482.832644][T15345] FAT-fs (loop3): Directory bread(block 68) failed [ 1482.841847][T15345] FAT-fs (loop3): Directory bread(block 69) failed [ 1482.841949][T13665] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1482.858870][T15345] FAT-fs (loop3): Directory bread(block 70) failed [ 1482.866526][T15345] FAT-fs (loop3): Directory bread(block 71) failed [ 1482.873128][T13665] usb 2-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 1482.884849][T15345] FAT-fs (loop3): Directory bread(block 72) failed [ 1482.891758][T13665] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1482.904789][T15345] FAT-fs (loop3): Directory bread(block 73) failed [ 1482.918830][T13665] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 1483.153584][T13665] scsi host1: usb-storage 2-1:1.0 [ 1483.279000][T15358] netlink: 20 bytes leftover after parsing attributes in process `syz.0.19107'. [ 1483.356834][T10898] usb 2-1: USB disconnect, device number 20 [ 1483.390326][T15364] loop0: detected capacity change from 0 to 512 [ 1483.417722][T15364] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1483.451642][T15364] ext4 filesystem being mounted at /4719/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1483.655025][ T5764] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1483.824479][T15375] loop3: detected capacity change from 0 to 32768 [ 1483.837693][T13665] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1483.859267][T15375] ocfs2: Slot 0 on device (7,3) was already allocated to this node! [ 1483.874015][T15375] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 1483.906389][T15375] (syz.3.19114,15375,1):ocfs2_read_blocks:239 ERROR: status = -12 [ 1483.917371][T15375] (syz.3.19114,15375,0):ocfs2_xattr_block_find:2831 ERROR: status = -12 [ 1484.018603][ T5768] ocfs2: Unmounting device (7,3) on (node local) [ 1484.054862][T13665] usb 3-1: Using ep0 maxpacket: 32 [ 1484.087925][T13665] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 1484.098434][T13665] usb 3-1: config 0 has no interface number 0 [ 1484.104573][T13665] usb 3-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1484.134035][T13665] usb 3-1: config 0 interface 2 has no altsetting 0 [ 1484.145810][T13665] usb 3-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 1484.155766][T13665] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1484.170684][T13665] usb 3-1: Product: syz [ 1484.174875][T13665] usb 3-1: Manufacturer: syz [ 1484.190481][T13665] usb 3-1: SerialNumber: syz [ 1484.197408][T13665] usb 3-1: config 0 descriptor?? [ 1484.302226][T15389] loop1: detected capacity change from 0 to 164 [ 1484.352426][T15389] iso9660: Corrupted directory entry in block 4 of inode 1792 [ 1484.453737][T13665] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 1484.539866][T15397] PKCS8: Unsupported PKCS#8 version [ 1484.686175][T15403] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19127'. [ 1484.737066][T13665] usb 3-1: USB disconnect, device number 28 [ 1484.859948][ T5974] udevd[5974]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1484.887765][T15409] openvswitch: netlink: EtherType 0 is less than min 600 [ 1484.982475][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1485.229151][T15426] loop1: detected capacity change from 0 to 1024 [ 1485.434082][T15431] loop0: detected capacity change from 0 to 2048 [ 1485.517104][T15431] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1485.603820][T15431] EXT4-fs error (device loop0): ext4_map_blocks:608: inode #12: block 2: comm syz.0.19141: lblock 0 mapped to illegal pblock 2 (length 1) [ 1485.666272][ T1128] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1485.704802][ T5764] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1486.252283][T15473] netlink: 'syz.0.19160': attribute type 2 has an invalid length. [ 1486.263724][T15474] IPVS: set_ctl: invalid protocol: 233 172.30.1.4:20001 [ 1486.352389][ T1128] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1486.416574][T15480] loop0: detected capacity change from 0 to 512 [ 1486.459463][T15480] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1486.493668][T15480] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 1486.522464][T15480] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 1486.545034][T15480] System zones: 0-1, 15-15, 18-18, 34-34 [ 1486.551047][T15480] EXT4-fs (loop0): orphan cleanup on readonly fs [ 1486.566072][T15480] Quota error (device loop0): v2_read_header: Failed header read: expected=8 got=0 [ 1486.577532][T15488] loop1: detected capacity change from 0 to 2048 [ 1486.591435][T15480] EXT4-fs warning (device loop0): ext4_enable_quotas:7184: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 1486.607942][T15480] EXT4-fs (loop0): Cannot turn on quotas: error -22 [ 1486.621665][T15480] EXT4-fs (loop0): 1 truncate cleaned up [ 1486.630444][T15488] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1486.632228][T15480] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1486.703047][T15488] UDF-fs: error (device loop1): udf_verify_fi: directory (ino 1408) has entry at pos 0 with incorrect tag 10a [ 1486.735026][T15488] UDF-fs: error (device loop1): udf_rename: failed to find renamed entry again in directory (ino 1408) [ 1486.752867][T15480] fscrypt (loop0, inode 16): Error -61 getting encryption context [ 1486.785452][ T5764] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1487.383781][T15522] loop1: detected capacity change from 0 to 1024 [ 1487.402829][T15522] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1487.429073][T15522] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 1487.479336][T15522] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 1487.493541][T15522] System zones: 0-1, 3-36 [ 1487.505930][T15528] xt_limit: Overflow, try lower: 0/0 [ 1487.514296][T15522] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1487.720587][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1487.950826][ T28] audit: type=1326 audit(2000000153.181:630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.006992][ T28] audit: type=1326 audit(2000000153.199:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.036754][T15554] netlink: 'syz.1.19199': attribute type 1 has an invalid length. [ 1488.050151][ T28] audit: type=1326 audit(2000000153.209:632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.085683][ T28] audit: type=1326 audit(2000000153.218:633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.132410][ T28] audit: type=1326 audit(2000000153.218:634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=279 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.181057][T15556] netlink: 32 bytes leftover after parsing attributes in process `syz.3.19200'. [ 1488.196063][ T28] audit: type=1326 audit(2000000153.218:635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.269918][ T28] audit: type=1326 audit(2000000153.218:636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.294790][ T28] audit: type=1326 audit(2000000153.218:637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.375836][ T28] audit: type=1326 audit(2000000153.218:638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15550 comm="syz.3.19198" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fe04a59c799 code=0x7ffc0000 [ 1488.409252][ T59] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1488.916168][ T789] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1489.001518][T22863] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1489.037216][T15602] loop3: detected capacity change from 0 to 512 [ 1489.102302][T15602] [EXT4 FS bs=4096, gc=1, bpg=95, ipg=32, mo=e040e01c, mo2=0000] [ 1489.113555][T15602] System zones: 0-2, 18-18, 34-34 [ 1489.125804][T15602] EXT4-fs error (device loop3): ext4_do_update_inode:5248: inode #3: comm syz.3.19222: corrupted inode contents [ 1489.138241][ T789] usb 2-1: Using ep0 maxpacket: 32 [ 1489.141881][T15608] netlink: 'syz.0.19224': attribute type 3 has an invalid length. [ 1489.147058][ T789] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1489.161078][T15602] EXT4-fs error (device loop3): ext4_dirty_inode:6124: inode #3: comm syz.3.19222: mark_inode_dirty error [ 1489.172724][ T789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1489.190361][ T789] usb 2-1: config 0 descriptor?? [ 1489.202993][T15602] EXT4-fs error (device loop3): ext4_do_update_inode:5248: inode #3: comm syz.3.19222: corrupted inode contents [ 1489.215986][ T789] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1489.221160][T22863] usb 3-1: Using ep0 maxpacket: 8 [ 1489.243548][T15602] EXT4-fs error (device loop3): __ext4_ext_dirty:202: inode #3: comm syz.3.19222: mark_inode_dirty error [ 1489.245317][T15610] loop0: detected capacity change from 0 to 128 [ 1489.255792][T22863] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1489.276514][T15602] EXT4-fs error (device loop3): ext4_acquire_dquot:6949: comm syz.3.19222: Failed to acquire dquot type 0 [ 1489.297746][T15602] EXT4-fs (loop3): 1 orphan inode deleted [ 1489.304436][ T49] EXT4-fs error (device loop3): ext4_release_dquot:6985: comm kworker/u4:3: Failed to release dquot type 1 [ 1489.305734][T15602] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1489.328394][T22863] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1489.328420][T22863] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1489.328438][T22863] usb 3-1: Product: syz [ 1489.328451][T22863] usb 3-1: Manufacturer: syz [ 1489.328465][T22863] usb 3-1: SerialNumber: syz [ 1489.379420][T15602] ext4 filesystem being mounted at /4694/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1489.552521][ T5768] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1489.625673][T22863] usb 3-1: Invalid connection information received from device [ 1489.669820][ T789] gspca_vc032x: reg_w err -71 [ 1489.674561][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.707991][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.713336][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.737608][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.745101][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.752398][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.757822][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.768615][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.777756][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.793555][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.798880][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.814761][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.820088][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.836033][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.841360][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.847106][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.852412][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.857995][ T789] gspca_vc032x: I2c Bus Busy Wait 00 [ 1489.863288][ T789] gspca_vc032x: Unknown sensor... [ 1489.868619][ T789] vc032x: probe of 2-1:0.0 failed with error -22 [ 1489.890367][ T789] usb 2-1: USB disconnect, device number 21 [ 1489.933968][T10898] usb 3-1: USB disconnect, device number 29 [ 1490.038008][T15626] loop0: detected capacity change from 0 to 64 [ 1490.080557][T15626] Trying to free block not in datazone [ 1490.253706][T15637] netlink: 'syz.0.19238': attribute type 3 has an invalid length. [ 1490.461227][ T59] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1490.535635][T15648] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1490.991673][T15669] netlink: 'syz.2.19254': attribute type 1 has an invalid length. [ 1491.003731][T15671] loop3: detected capacity change from 0 to 256 [ 1491.141950][ T59] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1491.153094][T15671] FAT-fs (loop3): Directory bread(block 64) failed [ 1491.159663][T15671] FAT-fs (loop3): Directory bread(block 65) failed [ 1491.177289][T15671] FAT-fs (loop3): Directory bread(block 66) failed [ 1491.188052][T15653] loop0: detected capacity change from 0 to 32768 [ 1491.195490][T15671] FAT-fs (loop3): Directory bread(block 67) failed [ 1491.202372][T15671] FAT-fs (loop3): Directory bread(block 68) failed [ 1491.219173][T15671] FAT-fs (loop3): Directory bread(block 69) failed [ 1491.232617][T15653] (syz.0.19247,15653,0):ocfs2_find_slot:468 ERROR: no free slots available! [ 1491.241756][T15671] FAT-fs (loop3): Directory bread(block 70) failed [ 1491.268802][T15681] libceph: resolve 'c' (ret=-3): failed [ 1491.271190][T15653] (syz.0.19247,15653,0):ocfs2_mount_volume:1807 ERROR: status = -22 [ 1491.282874][T15671] FAT-fs (loop3): Directory bread(block 71) failed [ 1491.299548][T15671] FAT-fs (loop3): Directory bread(block 72) failed [ 1491.322509][T15653] (syz.0.19247,15653,0):ocfs2_fill_super:1178 ERROR: status = -22 [ 1491.340072][T15671] FAT-fs (loop3): Directory bread(block 73) failed [ 1491.429548][T15653] NILFS (loop0): couldn't find nilfs on the device [ 1491.742446][ T77] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1491.937963][T15703] bridge9: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1492.520476][T15733] bond4: entered allmulticast mode [ 1492.679694][T15748] netlink: 'syz.1.19292': attribute type 5 has an invalid length. [ 1492.969725][T15764] loop0: detected capacity change from 0 to 512 [ 1493.016003][T15764] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1493.039805][T15764] ext4 filesystem being mounted at /4771/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 1493.077622][T15764] EXT4-fs error (device loop0): ext4_empty_dir:3145: inode #12: block 32: comm syz.0.19300: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 1493.078359][T15768] loop1: detected capacity change from 0 to 256 [ 1493.117334][T15764] EXT4-fs (loop0): Remounting filesystem read-only [ 1493.122491][T15770] loop3: detected capacity change from 0 to 128 [ 1493.123877][T15764] EXT4-fs warning (device loop0): ext4_empty_dir:3147: inode #12: comm syz.0.19300: directory missing '.' [ 1493.172980][T15770] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1493.185682][T15773] netlink: 'syz.2.19303': attribute type 10 has an invalid length. [ 1493.200835][T15773] team0: Device vxcan1 is of different type [ 1493.217808][T15768] FAT-fs (loop1): Directory bread(block 64) failed [ 1493.226610][T15768] FAT-fs (loop1): Directory bread(block 65) failed [ 1493.233245][T15768] FAT-fs (loop1): Directory bread(block 66) failed [ 1493.249677][T15768] FAT-fs (loop1): Directory bread(block 67) failed [ 1493.258358][T15768] FAT-fs (loop1): Directory bread(block 68) failed [ 1493.265667][T15768] FAT-fs (loop1): Directory bread(block 69) failed [ 1493.267632][T15770] ext4 filesystem being mounted at /4719/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 1493.304214][ C0] vkms_vblank_simulate: vblank timer overrun [ 1493.320494][T15768] FAT-fs (loop1): Directory bread(block 70) failed [ 1493.336386][ T5764] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1493.340660][T15768] FAT-fs (loop1): Directory bread(block 71) failed [ 1493.376758][T15768] FAT-fs (loop1): Directory bread(block 72) failed [ 1493.383454][T15768] FAT-fs (loop1): Directory bread(block 73) failed [ 1493.412073][T15770] EXT4-fs error (device loop3): __ext4_new_inode:1075: comm syz.3.19302: reserved inode found cleared - inode=2 [ 1493.579958][ T5768] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1494.118930][T15803] netlink: 28 bytes leftover after parsing attributes in process `syz.3.19318'. [ 1494.147336][T15803] netlink: 28 bytes leftover after parsing attributes in process `syz.3.19318'. [ 1494.161144][T15803] netlink: 44 bytes leftover after parsing attributes in process `syz.3.19318'. [ 1494.562489][ T59] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1494.592563][ T789] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1494.650091][T15835] xt_hashlimit: Unknown mode mask E2, kernel too old? [ 1494.788752][ T789] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1494.798604][ T789] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.820226][ T789] usb 4-1: Product: syz [ 1494.824459][ T789] usb 4-1: Manufacturer: syz [ 1494.842543][ T789] usb 4-1: SerialNumber: syz [ 1494.864741][ T789] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1494.902236][T15847] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1494.904273][ T6399] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1494.967931][T15851] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1495.116539][T15859] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19345'. [ 1495.126045][T15859] netlink: del zone limit has 8 unknown bytes [ 1495.279337][T15865] loop1: detected capacity change from 0 to 512 [ 1495.323031][T15865] EXT4-fs (loop1): orphan cleanup on readonly fs [ 1495.354783][T15865] EXT4-fs error (device loop1): ext4_xattr_inode_update_ref:1037: inode #11: comm syz.1.19347: EA inode 11 ref wraparound: ref_count=0 ref_change=-1 [ 1495.410567][T15865] EXT4-fs warning (device loop1): ext4_xattr_inode_dec_ref_all:1231: inode #11: comm syz.1.19347: ea_inode dec ref err=-117 [ 1495.424202][T15865] EXT4-fs (loop1): 1 orphan inode deleted [ 1495.439900][T15865] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1495.475049][ T27] usb 4-1: USB disconnect, device number 36 [ 1495.520709][T15870] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1495.540325][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1495.861835][T15887] dlm: plock device version mismatch: kernel (1.2.0), user (1.8192.0) [ 1496.015272][ T6399] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1496.046514][ T6399] ath9k_htc: Failed to initialize the device [ 1496.068845][ T27] usb 4-1: ath9k_htc: USB layer deinitialized [ 1496.613572][ T59] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1496.640603][T15915] loop0: detected capacity change from 0 to 4096 [ 1496.660322][T15923] __vm_enough_memory: pid: 15923, comm: syz.2.19375, not enough memory for the allocation [ 1496.674376][T15915] ntfs3: loop0: Different NTFS sector size (4096) and media sector size (512). [ 1496.860878][T15915] ntfs3: loop0: Failed to initialize $Extend/$Reparse. [ 1496.922013][T15915] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 1497.042047][ T5764] ntfs3: loop0: ino=1a, ntfs_sync_fs failed, -22. [ 1497.189196][T15941] ip6gre2: entered promiscuous mode [ 1497.301705][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1497.313529][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 1497.401184][T15955] loop1: detected capacity change from 0 to 136 [ 1497.454706][T15955] Symlink component flag not implemented [ 1497.487629][T15957] loop0: detected capacity change from 0 to 1024 [ 1497.500106][T15957] hfsplus: invalid length 32517 has been corrected to 255 [ 1497.533022][ T6399] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1497.562356][ T42] hfsplus: b-tree write err: -5, ino 4 [ 1497.595362][ T42] hfsplus: b-tree write err: -5, ino 2 [ 1497.760990][T15963] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19396'. [ 1497.761177][ T6399] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 1497.778484][T15963] netlink: 20 bytes leftover after parsing attributes in process `syz.0.19396'. [ 1497.783611][ T6399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1497.797216][ T6399] usb 4-1: Product: syz [ 1497.801592][ T6399] usb 4-1: Manufacturer: syz [ 1497.806232][ T6399] usb 4-1: SerialNumber: syz [ 1497.812820][ T6399] r8152-cfgselector 4-1: config 0 descriptor?? [ 1497.874768][ T5597] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1498.096327][ T5597] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 1498.115287][ T5597] usb 2-1: config 0 has no interface number 0 [ 1498.142866][ T5597] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1498.188272][ T5597] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1498.215071][T15982] netlink: 'syz.0.19405': attribute type 3 has an invalid length. [ 1498.217769][ T5597] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.224092][T15982] netlink: 201372 bytes leftover after parsing attributes in process `syz.0.19405'. [ 1498.260361][ T5597] usb 2-1: Product: syz [ 1498.271893][ T6399] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1498.275881][ T5597] usb 2-1: Manufacturer: syz [ 1498.289177][ T6399] r8152-cfgselector 4-1: USB disconnect, device number 37 [ 1498.294143][ T5597] usb 2-1: SerialNumber: syz [ 1498.330767][ T5597] usb 2-1: config 0 descriptor?? [ 1498.344123][T15984] loop0: detected capacity change from 0 to 512 [ 1498.380891][T15984] EXT4-fs (loop0): orphan cleanup on readonly fs [ 1498.384623][ T5597] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 1498.395766][T15984] EXT4-fs error (device loop0): ext4_xattr_inode_update_ref:1037: inode #11: comm syz.0.19406: EA inode 11 ref wraparound: ref_count=0 ref_change=-1 [ 1498.446824][T15984] EXT4-fs warning (device loop0): ext4_xattr_inode_dec_ref_all:1231: inode #11: comm syz.0.19406: ea_inode dec ref err=-117 [ 1498.538708][T15984] EXT4-fs (loop0): 1 orphan inode deleted [ 1498.550149][T15984] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1498.664091][ T5764] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1498.682617][ C0] yurex 2-1:0.50: yurex_interrupt - overflow with length 8, actual length is 8 [ 1498.907517][T13665] usb 2-1: USB disconnect, device number 22 [ 1498.929386][T13665] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 1499.273702][T16005] loop3: detected capacity change from 0 to 2048 [ 1499.276828][T16007] SET target dimension over the limit! [ 1499.305783][T16008] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1499.355187][ T1128] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1499.579225][T16017] xt_connbytes: Forcing CT accounting to be enabled [ 1499.875683][T16036] loop1: detected capacity change from 0 to 256 [ 1499.892665][T16036] exfat: Deprecated parameter 'namecase' [ 1499.923378][T16036] exfat: Deprecated parameter 'utf8' [ 1499.930689][T16038] netlink: 'syz.3.19431': attribute type 28 has an invalid length. [ 1499.941830][T16038] netlink: 'syz.3.19431': attribute type 29 has an invalid length. [ 1499.950853][T16038] netlink: 132 bytes leftover after parsing attributes in process `syz.3.19431'. [ 1500.016021][T16036] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xbe5fd08b, utbl_chksum : 0xe619d30d) [ 1500.078351][T16036] fuse: Bad value for 'fd' [ 1500.087294][T16042] loop3: detected capacity change from 0 to 1024 [ 1500.087834][ T6399] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1500.316231][ T6399] usb 3-1: Using ep0 maxpacket: 16 [ 1500.327984][T16053] netlink: 'syz.1.19438': attribute type 21 has an invalid length. [ 1500.334519][ T6399] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1500.346260][T16053] netlink: 'syz.1.19438': attribute type 15 has an invalid length. [ 1500.346411][ T6399] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1500.354170][T16053] netlink: 156 bytes leftover after parsing attributes in process `syz.1.19438'. [ 1500.354193][T16053] IPv6: NLM_F_CREATE should be specified when creating new route [ 1500.383843][ T6399] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1500.404140][ T6399] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1500.414358][T16053] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1500.418232][ T6399] usb 3-1: Product: syz [ 1500.421651][T16053] IPv6: NLM_F_CREATE should be set when creating new route [ 1500.421713][T16053] IPv6: NLM_F_CREATE should be set when creating new route [ 1500.421737][T16053] IPv6: NLM_F_CREATE should be set when creating new route [ 1500.451693][ T6399] usb 3-1: Manufacturer: syz [ 1500.456421][ T6399] usb 3-1: SerialNumber: syz [ 1500.480371][ T6399] r8152-cfgselector 3-1: config 0 descriptor?? [ 1500.718686][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1500.738384][ T6399] usbip-host 3-1: 3-1 is not in match_busid table... skip! [ 1500.929627][T16077] netlink: 'syz.0.19448': attribute type 7 has an invalid length. [ 1500.941114][T16077] netlink: 'syz.0.19448': attribute type 8 has an invalid length. [ 1500.961454][T16077] netlink: 'syz.0.19448': attribute type 15 has an invalid length. [ 1500.987803][T16080] ieee802154 phy1 wpan1: encryption failed: -90 [ 1501.014445][ T6399] usb 3-1: USB disconnect, device number 30 [ 1501.229633][T16090] loop3: detected capacity change from 0 to 136 [ 1501.261577][T16090] Symlink component flag not implemented [ 1501.379377][T16096] loop1: detected capacity change from 0 to 1024 [ 1501.416577][T16096] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 1501.449760][T16096] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 1501.487906][T16096] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1501.588504][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1501.701880][T16110] x_tables: unsorted underflow at hook 1 [ 1501.973858][T16123] loop0: detected capacity change from 0 to 4096 [ 1502.140146][T16123] ntfs: volume version 3.1. [ 1502.430800][T16147] netlink: 209820 bytes leftover after parsing attributes in process `syz.1.19482'. [ 1502.497230][T16152] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1502.536844][T16151] libceph: resolve '400' (ret=-3): failed [ 1502.671841][T16161] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 1502.771844][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1502.803422][T16165] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19490'. [ 1503.455802][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1503.681710][T16172] loop0: detected capacity change from 0 to 32768 [ 1503.875590][T16193] loop1: detected capacity change from 0 to 8 [ 1503.885352][T16193] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 1503.927305][T16193] cramfs: Error -5 while decompressing! [ 1503.932902][T16193] cramfs: ffffffff973f6368(26)->ffff88805799a000(4096) [ 1503.940558][ T5971] udevd[5971]: incorrect cramfs checksum on /dev/loop1 [ 1503.990646][T16193] cramfs: Error -3 while decompressing! [ 1503.996247][T16193] cramfs: ffffffff973f6382(26)->ffff88806d377000(4096) [ 1504.042424][T16193] cramfs: Error -3 while decompressing! [ 1504.057211][ T5971] udevd[5971]: incorrect cramfs checksum on /dev/loop1 [ 1504.076669][T16193] cramfs: ffffffff973f639c(16)->ffff88806d443000(4096) [ 1504.113470][T16193] cramfs: Error -5 while decompressing! [ 1504.143133][T16193] cramfs: ffffffff973f6368(26)->ffff88805799a000(4096) [ 1504.157202][T16203] netlink: 'syz.0.19508': attribute type 4 has an invalid length. [ 1504.171624][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 1504.171636][ T28] audit: type=1800 audit(2000000168.353:639): pid=16193 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.19503" name="file2" dev="loop1" ino=348 res=0 errno=0 [ 1504.214048][T16203] netlink: 132 bytes leftover after parsing attributes in process `syz.0.19508'. [ 1504.292609][T16207] netlink: 'syz.2.19510': attribute type 64 has an invalid length. [ 1504.310991][T16207] netlink: 9 bytes leftover after parsing attributes in process `syz.2.19510'. [ 1504.527200][T16218] netlink: 'syz.1.19516': attribute type 8 has an invalid length. [ 1504.823819][ T49] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1505.519333][T16276] cgroup: none used incorrectly [ 1505.742831][ T6399] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 1505.893302][T16261] loop1: detected capacity change from 0 to 40427 [ 1505.907654][T16261] F2FS-fs (loop1): build fault injection attr: rate: 690, type: 0x7ffff [ 1505.919638][T16261] F2FS-fs (loop1): Image doesn't support compression [ 1505.927141][T16261] F2FS-fs (loop1): Image doesn't support compression [ 1505.946993][T16261] F2FS-fs (loop1): invalid crc value [ 1505.959736][T16261] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1505.982288][ T6399] usb 1-1: config 0 has an invalid interface number: 117 but max is 0 [ 1506.001581][ T6399] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1506.027209][ T6399] usb 1-1: config 0 has no interface number 0 [ 1506.036538][ T6399] usb 1-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1506.066860][T16261] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 1506.070786][ T6399] usb 1-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1506.134768][ T6399] usb 1-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1506.145279][ T6399] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1506.153851][ T6399] usb 1-1: Product: syz [ 1506.158104][ T6399] usb 1-1: Manufacturer: syz [ 1506.163081][ T6399] usb 1-1: SerialNumber: syz [ 1506.182024][ T6399] usb 1-1: config 0 descriptor?? [ 1506.373929][T22863] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1506.537420][T16314] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19561'. [ 1506.546608][T16314] netlink: 16 bytes leftover after parsing attributes in process `syz.3.19561'. [ 1506.577649][T22863] usb 3-1: Using ep0 maxpacket: 8 [ 1506.594297][T22863] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1506.615655][T22863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1506.621868][T16318] overlayfs: missing 'lowerdir' [ 1506.642479][T22863] usb 3-1: Product: syz [ 1506.646976][T22863] usb 3-1: Manufacturer: syz [ 1506.657053][ T6399] usb 1-1: USB disconnect, device number 36 [ 1506.660148][T22863] usb 3-1: SerialNumber: syz [ 1506.693563][T22863] usb 3-1: config 0 descriptor?? [ 1506.709226][T22863] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1506.887807][ T1128] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1507.169942][T22863] gspca_sonixj: reg_r err -71 [ 1507.178699][T22863] sonixj: probe of 3-1:0.0 failed with error -71 [ 1507.198276][T22863] usb 3-1: USB disconnect, device number 31 [ 1507.291218][T16322] loop1: detected capacity change from 0 to 40427 [ 1507.331508][T16322] F2FS-fs (loop1): build fault injection attr: rate: 771, type: 0x7ffff [ 1507.345197][T16322] F2FS-fs (loop1): invalid crc value [ 1507.366939][T16322] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1507.477390][T16322] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 1507.509358][T16345] netlink: 'syz.3.19574': attribute type 1 has an invalid length. [ 1507.694158][ T5767] syz-executor: attempt to access beyond end of device [ 1507.694158][ T5767] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1507.735225][ T5767] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 1508.468913][T10898] usb 1-1: new low-speed USB device number 37 using dummy_hcd [ 1508.663137][T10898] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1508.684503][T10898] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1508.718485][T10898] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 4 [ 1508.741212][T10898] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1508.754429][T10898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1508.768839][T10898] hub 1-1:1.0: bad descriptor, ignoring hub [ 1508.774791][T10898] hub: probe of 1-1:1.0 failed with error -5 [ 1508.807378][T10898] cdc_wdm 1-1:1.0: skipping garbage [ 1508.817676][T10898] cdc_wdm 1-1:1.0: skipping garbage [ 1508.841004][T10898] cdc_wdm: probe of 1-1:1.0 failed with error -22 [ 1508.941127][ T77] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1508.952489][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1509.111159][T10898] usb 1-1: USB disconnect, device number 37 [ 1509.150178][T16408] SET target dimension over the limit! [ 1509.423542][T16420] ieee802154 phy1 wpan1: encryption failed: -22 [ 1509.426449][T16422] netlink: 1 bytes leftover after parsing attributes in process `syz.1.19613'. [ 1509.439468][T16422] netlink: 1 bytes leftover after parsing attributes in process `syz.1.19613'. [ 1509.787461][T16438] usb usb8: usbfs: process 16438 (syz.1.19621) did not claim interface 0 before use [ 1510.115571][T22863] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1510.232994][T10898] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1510.334689][T22863] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1510.348566][T22863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1510.367880][T22863] usb 3-1: Product: syz [ 1510.378669][T22863] usb 3-1: Manufacturer: syz [ 1510.386618][T22863] usb 3-1: SerialNumber: syz [ 1510.405795][T22863] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1510.435960][T10898] usb 2-1: Using ep0 maxpacket: 32 [ 1510.440353][ T5597] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1510.442880][T10898] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1510.493166][T10898] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1510.526808][T10898] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1510.546707][T10898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1510.557463][T10898] usb 2-1: Product: syz [ 1510.561699][T10898] usb 2-1: Manufacturer: syz [ 1510.576488][T10898] usb 2-1: SerialNumber: syz [ 1510.597341][T10898] usb 2-1: config 0 descriptor?? [ 1510.712092][T16478] loop0: detected capacity change from 0 to 8192 [ 1510.722995][T16478] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 1510.737694][T16478] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 1510.747518][T16478] REISERFS (device loop0): using ordered data mode [ 1510.754214][T16478] reiserfs: using flush barriers [ 1510.762468][T16478] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 1510.780150][T16478] REISERFS (device loop0): checking transaction log (loop0) [ 1510.865520][ T27] usb 2-1: USB disconnect, device number 23 [ 1510.887330][T16478] REISERFS (device loop0): Using tea hash to sort names [ 1510.894672][T16478] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2) [ 1510.903777][ T6399] usb 3-1: USB disconnect, device number 32 [ 1510.917775][T16478] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 1511.004770][ T77] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1511.017893][T10898] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1511.053859][T16485] loop0: detected capacity change from 0 to 64 [ 1511.218344][T10898] usb 4-1: Using ep0 maxpacket: 8 [ 1511.228853][T10898] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1511.246543][T10898] usb 4-1: config 179 has no interface number 0 [ 1511.253031][T10898] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1511.266506][T10898] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1511.278076][T10898] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1511.293567][T10898] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1511.303992][T10898] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1511.319652][T10898] usb 4-1: config 179 interface 65 has no altsetting 0 [ 1511.328470][T10898] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1511.339686][T10898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1511.381502][T10898] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input95 [ 1511.580027][ T5597] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1511.587108][ T5597] ath9k_htc: Failed to initialize the device [ 1511.625233][ T6399] usb 3-1: ath9k_htc: USB layer deinitialized [ 1511.706467][ T27] usb 4-1: USB disconnect, device number 38 [ 1511.712511][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1511.727217][ T27] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 1512.411530][T16538] loop1: detected capacity change from 0 to 512 [ 1512.430313][T16538] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 1512.538464][T16538] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1512.589390][T16538] ext4 filesystem being mounted at /4891/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1512.715703][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1512.927704][ T5597] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1513.035846][ T42] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1513.119779][ T5597] usb 3-1: Using ep0 maxpacket: 32 [ 1513.126949][ T5597] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1513.150409][ T5597] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1513.170653][T16562] netlink: 136 bytes leftover after parsing attributes in process `syz.3.19680'. [ 1513.180699][T16552] loop0: detected capacity change from 0 to 32768 [ 1513.189912][ T5597] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1513.215145][T16562] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1513.251990][ T5597] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1513.269047][ T5597] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1513.288027][ T5597] usb 3-1: Product: syz [ 1513.298827][ T5597] usb 3-1: Manufacturer: syz [ 1513.303976][ T5597] usb 3-1: SerialNumber: syz [ 1513.362125][T16552] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 1513.364467][ T5597] cdc_ncm 3-1:1.0: skipping garbage [ 1513.377801][ T5597] cdc_ncm 3-1:1.0: skipping garbage [ 1513.383044][ T5597] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 1513.390135][ T5597] cdc_ncm 3-1:1.0: bind() failure [ 1513.445802][T16552] XFS (loop0): Ending clean mount [ 1513.543346][T16576] loop1: detected capacity change from 0 to 4096 [ 1513.551035][ T5764] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 1513.604417][ T5597] usb 3-1: USB disconnect, device number 33 [ 1513.605138][T16576] ntfs: (device loop1): ntfs_is_extended_system_file(): Inode hard link count doesn't match number of name attributes. You should run chkdsk. [ 1513.670107][T16576] ntfs: (device loop1): ntfs_read_locked_inode(): $DATA attribute is missing. [ 1513.679414][T16576] ntfs: (device loop1): ntfs_read_locked_inode(): Failed with error code -2. Marking corrupt inode 0xa as bad. Run chkdsk. [ 1513.692991][T16576] ntfs: (device loop1): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 1513.759450][T16576] ntfs: volume version 3.1. [ 1513.804144][T16576] ntfs: (device loop1): ntfs_mapping_pairs_decompress(): Invalid LCN < -1 in mapping pairs array. [ 1513.825284][T16576] ntfs: (device loop1): ntfs_read_block(): Failed to read from inode 0x5, attribute type 0xa0, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 1513.863118][T16576] ntfs: (device loop1): ntfs_mapping_pairs_decompress(): Invalid LCN < -1 in mapping pairs array. [ 1513.876152][T16576] ntfs: (device loop1): ntfs_read_block(): Failed to read from inode 0x5, attribute type 0xa0, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 1513.922488][T16576] ntfs: (device loop1): ntfs_lookup_inode_by_name(): Failed to map directory index page, error 5. [ 1513.934388][T16576] ntfs: (device loop1): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 1514.074815][T16586] netlink: 'syz.0.19685': attribute type 10 has an invalid length. [ 1514.120486][T16586] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1514.438725][T16600] delete_channel: no stack [ 1514.570346][T16606] loop3: detected capacity change from 0 to 4096 [ 1514.603441][T16606] ntfs: volume version 3.1. [ 1514.609256][T16608] ALSA: mixer_oss: invalid OSS volume ';ʸgԊ8\>Pxi9 h~)V' [ 1514.619011][T16608] ALSA: mixer_oss: invalid OSS volume '*bbX-]OF{T0pc' [ 1514.629240][T16608] ALSA: mixer_oss: invalid OSS volume 'gI"4-Z' [ 1514.637658][T16608] ALSA: mixer_oss: invalid OSS volume 'eQCȡ*qpAڜe T|K' [ 1514.647374][T16608] ALSA: mixer_oss: invalid OSS volume ':az]qeXfb]݆B.' [ 1514.676814][T16608] ALSA: mixer_oss: invalid OSS volume 'j|q⩃˚[w3^.ג' [ 1514.686196][T16608] ALSA: mixer_oss: invalid OSS volume '"P޸ۜo[8>7|YMepq' [ 1514.697073][T16608] ALSA: mixer_oss: invalid OSS volume 'wI׷#t\W,bP=&e' [ 1514.705784][T16608] ALSA: mixer_oss: invalid OSS volume ']za-!)ϻvCYps' [ 1514.723509][T16608] ALSA: mixer_oss: invalid OSS volume 'LE]Dxt݂OY3fk$T "' [ 1514.755056][T10898] usb 1-1: new full-speed USB device number 38 using dummy_hcd [ 1514.765797][T16608] ALSA: mixer_oss: invalid OSS volume '[' [ 1514.789549][T16608] ALSA: mixer_oss: invalid OSS volume '3A14IN+|\' [ 1514.818455][T16608] ALSA: mixer_oss: invalid OSS volume '$S|hnBk矉?qC$F [ 1565.061396][T18589] System zones: 0-1, 15-15, 18-18, 34-34 [ 1565.074295][T13665] hdpvr 3-1:0.0: untested firmware, the driver might not work. [ 1565.087298][T18589] EXT4-fs (loop3): orphan cleanup on readonly fs [ 1565.093897][T18589] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 1565.103692][T18589] EXT4-fs warning (device loop3): ext4_enable_quotas:7184: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 1565.118704][ T5803] usb 2-1: qt2_setup_urbs - submit read urb failed -90 [ 1565.123982][T18589] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 1565.125870][ T5803] quatech2: probe of 2-1:0.51 failed with error -90 [ 1565.134648][T18589] EXT4-fs error (device loop3): ext4_orphan_get:1424: comm syz.3.20604: bad orphan inode 16 [ 1565.153093][T18589] ext4_test_bit(bit=15, block=18) = 1 [ 1565.158495][T18589] is_bad_inode(inode)=0 [ 1565.162901][T18589] NEXT_ORPHAN(inode)=0 [ 1565.167014][T18589] max_ino=32 [ 1565.170201][T18589] i_nlink=2 [ 1565.175004][T18589] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1565.204049][T22863] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1565.227590][T18589] fscrypt (loop3, inode 16): Error -61 getting encryption context [ 1565.253949][ T5768] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1565.280627][T13665] hdpvr 3-1:0.0: device init failed [ 1565.285966][T13665] hdpvr: probe of 3-1:0.0 failed with error -12 [ 1565.302318][T13665] usb 3-1: USB disconnect, device number 38 [ 1565.359323][ T27] usb 2-1: USB disconnect, device number 30 [ 1565.420837][T22863] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1565.432237][T22863] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1565.449842][T22863] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1565.477781][T22863] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1565.522515][T18598] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 1565.720792][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1566.163517][T18629] ip6t_srh: unknown srh invflags 4449 [ 1566.402158][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1566.414037][T17652] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1566.484418][T18647] netlink: 12 bytes leftover after parsing attributes in process `syz.1.20631'. [ 1566.616632][T18655] netlink: 4168 bytes leftover after parsing attributes in process `syz.3.20636'. [ 1566.801287][T22863] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1566.823335][T22863] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1566.839949][T22863] stv0680 1-1:4.0: last error: 86, command = 0x78 [ 1566.859723][T22863] usb 1-1: USB disconnect, device number 44 [ 1566.914509][ T789] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1567.071592][T18657] loop3: detected capacity change from 0 to 32768 [ 1567.094119][T18657] (syz.3.20638,18657,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1567.124076][T18657] (syz.3.20638,18657,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1567.153928][ T789] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1567.164476][ T789] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1567.183675][ T789] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1567.217604][T18657] JBD2: Ignoring recovery information on journal [ 1567.234573][ T789] usb 3-1: config 220 has no interface number 2 [ 1567.277900][ T789] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1567.314197][ T789] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1567.334725][T18657] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 1567.355280][ T789] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1567.362196][ T789] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1567.422710][ T789] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1567.453282][ T789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.477745][ T789] usb 3-1: Product: syz [ 1567.491793][ T789] usb 3-1: Manufacturer: syz [ 1567.496436][ T789] usb 3-1: SerialNumber: syz [ 1567.714181][ T5768] ocfs2: Unmounting device (7,3) on (node local) [ 1567.751689][ T789] usb 3-1: selecting invalid altsetting 0 [ 1567.768949][ T789] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 1567.776343][ T77] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1567.802727][ T789] usb 3-1: No valid video chain found. [ 1567.857439][ T789] usb 3-1: selecting invalid altsetting 0 [ 1567.863226][ T789] usbtest: probe of 3-1:220.1 failed with error -22 [ 1567.894247][ T789] usb 3-1: USB disconnect, device number 39 [ 1568.100695][ T27] IPVS: starting estimator thread 0... [ 1568.197910][T18700] IPVS: using max 25 ests per chain, 60000 per kthread [ 1568.255677][T18707] loop0: detected capacity change from 0 to 64 [ 1568.284622][T18707] hfs: unable to locate alternate MDB [ 1568.290051][T18707] hfs: continuing without an alternate MDB [ 1568.355943][ T28] audit: type=1800 audit(2000000228.390:689): pid=18707 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.20660" name="bus" dev="loop0" ino=21 res=0 errno=0 [ 1568.446544][ T42] [ 1568.448915][ T42] ====================================================== [ 1568.455929][ T42] WARNING: possible circular locking dependency detected [ 1568.458207][T18714] Timeout policy `syz0' can only be used by L3 protocol number 57591 [ 1568.462944][ T42] syzkaller #0 Not tainted [ 1568.475498][ T42] ------------------------------------------------------ [ 1568.482531][ T42] kworker/u4:2/42 is trying to acquire lock: [ 1568.488513][ T42] ffff88801e7c0df8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{3:3}, at: hfs_extend_file+0xff/0x1380 [ 1568.499318][ T42] [ 1568.499318][ T42] but task is already holding lock: [ 1568.506658][ T42] ffff88807c44a0b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfs_find_init+0x17e/0x1f0 [ 1568.515964][ T42] [ 1568.515964][ T42] which lock already depends on the new lock. [ 1568.515964][ T42] [ 1568.526395][ T42] [ 1568.526395][ T42] the existing dependency chain (in reverse order) is: [ 1568.535413][ T42] [ 1568.535413][ T42] -> #1 (&tree->tree_lock/1){+.+.}-{3:3}: [ 1568.543337][ T42] __mutex_lock+0x136/0xcc0 [ 1568.548369][ T42] hfs_find_init+0x17e/0x1f0 [ 1568.553482][ T42] hfs_get_block+0x557/0xc50 [ 1568.558589][ T42] block_read_full_folio+0x44b/0xf60 [ 1568.564400][ T42] filemap_read_folio+0x172/0x760 [ 1568.569935][ T42] do_read_cache_folio+0x468/0x7d0 [ 1568.575550][ T42] do_read_cache_page+0x32/0x250 [ 1568.580992][ T42] __hfs_bnode_create+0x4b1/0x7b0 [ 1568.586543][ T42] hfs_bnode_find+0x222/0xd40 [ 1568.591727][ T42] hfs_brec_find+0x17c/0x500 [ 1568.596822][ T42] hfs_brec_read+0x24/0x110 [ 1568.601835][ T42] hfs_cat_find_brec+0x178/0x3f0 [ 1568.607273][ T42] hfs_fill_super+0xee2/0x14a0 [ 1568.612541][ T42] mount_bdev+0x221/0x2d0 [ 1568.617372][ T42] legacy_get_tree+0xea/0x180 [ 1568.622557][ T42] vfs_get_tree+0x8c/0x280 [ 1568.627476][ T42] do_new_mount+0x24b/0xa40 [ 1568.632487][ T42] __se_sys_mount+0x2e7/0x3d0 [ 1568.637666][ T42] do_syscall_64+0x55/0xa0 [ 1568.642594][ T42] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1568.648996][ T42] [ 1568.648996][ T42] -> #0 (&HFS_I(tree->inode)->extents_lock){+.+.}-{3:3}: [ 1568.658189][ T42] __lock_acquire+0x2df1/0x7d40 [ 1568.663545][ T42] lock_acquire+0x19e/0x420 [ 1568.668552][ T42] __mutex_lock+0x136/0xcc0 [ 1568.673564][ T42] hfs_extend_file+0xff/0x1380 [ 1568.678831][ T42] hfs_bmap_reserve+0x107/0x430 [ 1568.684186][ T42] __hfs_ext_write_extent+0x1fa/0x470 [ 1568.690061][ T42] hfs_ext_write_extent+0x17f/0x210 [ 1568.695760][ T42] hfs_write_inode+0xdc/0x880 [ 1568.700939][ T42] __writeback_single_inode+0x705/0xec0 [ 1568.706990][ T42] writeback_sb_inodes+0x7cd/0xf50 [ 1568.712695][ T42] wb_writeback+0x46a/0xbf0 [ 1568.717703][ T42] wb_workfn+0x400/0xe60 [ 1568.722451][ T42] process_scheduled_works+0xa5d/0x15d0 [ 1568.728506][ T42] worker_thread+0xa55/0xfc0 [ 1568.733604][ T42] kthread+0x2fa/0x390 [ 1568.738176][ T42] ret_from_fork+0x48/0x80 [ 1568.743100][ T42] ret_from_fork_asm+0x11/0x20 [ 1568.748373][ T42] [ 1568.748373][ T42] other info that might help us debug this: [ 1568.748373][ T42] [ 1568.758582][ T42] Possible unsafe locking scenario: [ 1568.758582][ T42] [ 1568.766011][ T42] CPU0 CPU1 [ 1568.771444][ T42] ---- ---- [ 1568.776792][ T42] lock(&tree->tree_lock/1); [ 1568.781459][ T42] lock(&HFS_I(tree->inode)->extents_lock); [ 1568.789944][ T42] lock(&tree->tree_lock/1); [ 1568.797127][ T42] lock(&HFS_I(tree->inode)->extents_lock); [ 1568.803089][ T42] [ 1568.803089][ T42] *** DEADLOCK *** [ 1568.803089][ T42] [ 1568.811214][ T42] 3 locks held by kworker/u4:2/42: [ 1568.816301][ T42] #0: ffff88801ce45938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1568.827509][ T42] #1: ffffc90000b2fd00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1568.839927][ T42] #2: ffff88807c44a0b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfs_find_init+0x17e/0x1f0 [ 1568.849660][ T42] [ 1568.849660][ T42] stack backtrace: [ 1568.855532][ T42] CPU: 1 PID: 42 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 1568.862880][ T42] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1568.872919][ T42] Workqueue: writeback wb_workfn (flush-7:0) [ 1568.878895][ T42] Call Trace: [ 1568.882257][ T42] [ 1568.885204][ T42] dump_stack_lvl+0x18c/0x250 [ 1568.889879][ T42] ? load_image+0x400/0x400 [ 1568.894369][ T42] ? show_regs_print_info+0x20/0x20 [ 1568.899559][ T42] ? print_circular_bug+0x12b/0x1a0 [ 1568.904771][ T42] check_noncircular+0x2fc/0x400 [ 1568.909701][ T42] ? look_up_lock_class+0x75/0x140 [ 1568.914800][ T42] ? print_deadlock_bug+0x5d0/0x5d0 [ 1568.919981][ T42] ? lockdep_lock+0xf5/0x230 [ 1568.924557][ T42] ? _find_first_zero_bit+0xd3/0x100 [ 1568.929833][ T42] __lock_acquire+0x2df1/0x7d40 [ 1568.934676][ T42] ? arch_stack_walk+0x16e/0x190 [ 1568.939603][ T42] ? ret_from_fork_asm+0x11/0x20 [ 1568.944529][ T42] ? verify_lock_unused+0x140/0x140 [ 1568.949712][ T42] ? stack_trace_save+0xaa/0x100 [ 1568.954636][ T42] ? stack_trace_snprint+0xf0/0xf0 [ 1568.959736][ T42] ? check_noncircular+0x18a/0x400 [ 1568.964847][ T42] ? print_deadlock_bug+0x5d0/0x5d0 [ 1568.970032][ T42] lock_acquire+0x19e/0x420 [ 1568.974523][ T42] ? hfs_extend_file+0xff/0x1380 [ 1568.979446][ T42] ? __might_sleep+0xe0/0xe0 [ 1568.984020][ T42] ? read_lock_is_recursive+0x20/0x20 [ 1568.989383][ T42] __mutex_lock+0x136/0xcc0 [ 1568.993877][ T42] ? hfs_extend_file+0xff/0x1380 [ 1568.998800][ T42] ? verify_lock_unused+0x140/0x140 [ 1569.003985][ T42] ? hfs_extend_file+0xff/0x1380 [ 1569.008908][ T42] ? mutex_lock_nested+0x20/0x20 [ 1569.013840][ T42] hfs_extend_file+0xff/0x1380 [ 1569.018587][ T42] ? hfs_ext_write_extent+0x152/0x210 [ 1569.023941][ T42] ? hfs_write_inode+0xdc/0x880 [ 1569.028775][ T42] ? hfs_get_block+0xc50/0xc50 [ 1569.033520][ T42] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1569.039667][ T42] ? rcu_is_watching+0x15/0xb0 [ 1569.044418][ T42] ? trace_contention_end+0x39/0xe0 [ 1569.049601][ T42] ? __asan_memset+0x22/0x40 [ 1569.054178][ T42] ? hfs_brec_find+0x19b/0x500 [ 1569.058929][ T42] ? hfs_find_init+0x17e/0x1f0 [ 1569.063680][ T42] hfs_bmap_reserve+0x107/0x430 [ 1569.068517][ T42] __hfs_ext_write_extent+0x1fa/0x470 [ 1569.073876][ T42] hfs_ext_write_extent+0x17f/0x210 [ 1569.079057][ T42] ? verify_lock_unused+0x140/0x140 [ 1569.084239][ T42] ? hfs_ext_find_block+0x190/0x190 [ 1569.089424][ T42] ? blk_start_plug+0x51/0x1a0 [ 1569.094175][ T42] hfs_write_inode+0xdc/0x880 [ 1569.098839][ T42] ? hfs_inode_write_fork+0x1a0/0x1a0 [ 1569.104230][ T42] ? __writeback_single_inode+0x48d/0xec0 [ 1569.109936][ T42] ? __lock_acquire+0x7d40/0x7d40 [ 1569.114948][ T42] ? do_raw_spin_lock+0x11f/0x2c0 [ 1569.119960][ T42] ? __rwlock_init+0x150/0x150 [ 1569.124713][ T42] __writeback_single_inode+0x705/0xec0 [ 1569.130249][ T42] writeback_sb_inodes+0x7cd/0xf50 [ 1569.135368][ T42] ? queue_io+0x550/0x550 [ 1569.139688][ T42] ? rcu_is_watching+0x15/0xb0 [ 1569.144441][ T42] wb_writeback+0x46a/0xbf0 [ 1569.148939][ T42] ? queue_io+0x3b1/0x550 [ 1569.153265][ T42] ? percpu_ref_tryget+0x250/0x250 [ 1569.158379][ T42] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1569.164350][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 1569.169538][ T42] wb_workfn+0x400/0xe60 [ 1569.173776][ T42] ? inode_wait_for_writeback+0x230/0x230 [ 1569.179485][ T42] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1569.185448][ T42] ? read_lock_is_recursive+0x20/0x20 [ 1569.190807][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 1569.195988][ T42] ? process_scheduled_works+0x96f/0x15d0 [ 1569.201697][ T42] ? process_scheduled_works+0x96f/0x15d0 [ 1569.207403][ T42] process_scheduled_works+0xa5d/0x15d0 [ 1569.212950][ T42] ? worker_attach_to_pool+0x380/0x380 [ 1569.218397][ T42] ? assign_work+0x3d2/0x5d0 [ 1569.222990][ T42] worker_thread+0xa55/0xfc0 [ 1569.227594][ T42] kthread+0x2fa/0x390 [ 1569.231664][ T42] ? pr_cont_work+0x560/0x560 [ 1569.236340][ T42] ? kthread_blkcg+0xd0/0xd0 [ 1569.240915][ T42] ret_from_fork+0x48/0x80 [ 1569.245324][ T42] ? kthread_blkcg+0xd0/0xd0 [ 1569.249898][ T42] ret_from_fork_asm+0x11/0x20 [ 1569.254660][ T42] [ 1569.284178][ T42] hfs: new node 0 already hashed? [ 1569.290515][ T42] ------------[ cut here ]------------ [ 1569.296012][ T42] WARNING: CPU: 1 PID: 42 at fs/hfs/bnode.c:520 hfs_bnode_create+0x3b9/0x440 [ 1569.304933][ T42] Modules linked in: [ 1569.308849][ T42] CPU: 1 PID: 42 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 1569.316306][ T42] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1569.326409][ T42] Workqueue: writeback wb_workfn (flush-7:0) [ 1569.332431][ T42] RIP: 0010:hfs_bnode_create+0x3b9/0x440 [ 1569.338067][ T42] Code: d4 e0 8a 89 ee e8 47 8c 1f 08 e9 73 fd ff ff e8 1d 1c 2d ff 4c 89 ef e8 45 bc 34 08 48 c7 c7 c0 d4 e0 8a 89 ee e8 27 8c 1f 08 <0f> 0b eb b7 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 7f fc ff ff 4c [ 1569.357732][ T42] RSP: 0018:ffffc90000b2ee18 EFLAGS: 00010246 [ 1569.363820][ T42] RAX: 000000000000001f RBX: ffff88807c44a000 RCX: 92830071c3751b00 [ 1569.371779][ T42] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 1569.379775][ T42] RBP: 0000000000000000 R08: ffffc90000b2eb27 R09: 1ffff92000165d64 [ 1569.387788][ T42] R10: dffffc0000000000 R11: fffff52000165d65 R12: 0000000000000000 [ 1569.395862][ T42] R13: ffff88807c44a0e0 R14: ffff888021b85300 R15: dffffc0000000000 [ 1569.403858][ T42] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 1569.412858][ T42] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1569.419506][ T42] CR2: 00007f5624fe92f8 CR3: 000000002bf69000 CR4: 00000000003506e0 [ 1569.427607][ T42] Call Trace: [ 1569.430884][ T42] [ 1569.433798][ T42] hfs_bmap_alloc+0x541/0x5d0 [ 1569.438540][ T42] ? hfs_bmap_reserve+0x430/0x430 [ 1569.443565][ T42] ? rcu_is_watching+0x15/0xb0 [ 1569.448387][ T42] hfs_btree_inc_height+0x101/0xac0 [ 1569.453584][ T42] ? __rwlock_init+0x150/0x150 [ 1569.458340][ T42] ? hfs_brec_insert+0xbd0/0xbd0 [ 1569.463298][ T42] ? do_raw_spin_unlock+0x121/0x230 [ 1569.468503][ T42] hfs_brec_insert+0x748/0xbd0 [ 1569.473317][ T42] ? hfs_brec_keylen+0x360/0x360 [ 1569.478265][ T42] __hfs_ext_write_extent+0x2a1/0x470 [ 1569.483818][ T42] hfs_ext_write_extent+0x17f/0x210 [ 1569.489126][ T42] ? verify_lock_unused+0x140/0x140 [ 1569.494373][ T42] ? hfs_ext_find_block+0x190/0x190 [ 1569.499579][ T42] ? blk_start_plug+0x51/0x1a0 [ 1569.504380][ T42] hfs_write_inode+0xdc/0x880 [ 1569.509069][ T42] ? hfs_inode_write_fork+0x1a0/0x1a0 [ 1569.514506][ T42] ? __writeback_single_inode+0x48d/0xec0 [ 1569.520256][ T42] ? __lock_acquire+0x7d40/0x7d40 [ 1569.525317][ T42] ? do_raw_spin_lock+0x11f/0x2c0 [ 1569.530346][ T42] ? __rwlock_init+0x150/0x150 [ 1569.535147][ T42] __writeback_single_inode+0x705/0xec0 [ 1569.540699][ T42] writeback_sb_inodes+0x7cd/0xf50 [ 1569.545857][ T42] ? queue_io+0x550/0x550 [ 1569.550197][ T42] ? rcu_is_watching+0x15/0xb0 [ 1569.554994][ T42] wb_writeback+0x46a/0xbf0 [ 1569.559511][ T42] ? queue_io+0x3b1/0x550 [ 1569.563851][ T42] ? percpu_ref_tryget+0x250/0x250 [ 1569.569006][ T42] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1569.574998][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 1569.580227][ T42] wb_workfn+0x400/0xe60 [ 1569.584472][ T42] ? inode_wait_for_writeback+0x230/0x230 [ 1569.590223][ T42] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1569.596206][ T42] ? read_lock_is_recursive+0x20/0x20 [ 1569.601609][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 1569.606810][ T42] ? process_scheduled_works+0x96f/0x15d0 [ 1569.612578][ T42] ? process_scheduled_works+0x96f/0x15d0 [ 1569.618298][ T42] process_scheduled_works+0xa5d/0x15d0 [ 1569.623888][ T42] ? worker_attach_to_pool+0x380/0x380 [ 1569.629363][ T42] ? assign_work+0x3d2/0x5d0 [ 1569.634003][ T42] worker_thread+0xa55/0xfc0 [ 1569.638603][ T42] kthread+0x2fa/0x390 [ 1569.642688][ T42] ? pr_cont_work+0x560/0x560 [ 1569.647364][ T42] ? kthread_blkcg+0xd0/0xd0 [ 1569.651986][ T42] ret_from_fork+0x48/0x80 [ 1569.656401][ T42] ? kthread_blkcg+0xd0/0xd0 [ 1569.660973][ T42] ret_from_fork_asm+0x11/0x20 [ 1569.665767][ T42] [ 1569.668786][ T42] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1569.676045][ T42] CPU: 1 PID: 42 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 1569.683395][ T42] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1569.693431][ T42] Workqueue: writeback wb_workfn (flush-7:0) [ 1569.699403][ T42] Call Trace: [ 1569.702672][ T42] [ 1569.705585][ T42] dump_stack_lvl+0x18c/0x250 [ 1569.710247][ T42] ? show_regs_print_info+0x20/0x20 [ 1569.715426][ T42] ? load_image+0x400/0x400 [ 1569.719913][ T42] panic+0x2dc/0x730 [ 1569.723788][ T42] ? bpf_jit_dump+0xd0/0xd0 [ 1569.728281][ T42] ? ret_from_fork_asm+0x11/0x20 [ 1569.733210][ T42] __warn+0x2e0/0x470 [ 1569.737175][ T42] ? hfs_bnode_create+0x3b9/0x440 [ 1569.742181][ T42] ? hfs_bnode_create+0x3b9/0x440 [ 1569.747184][ T42] report_bug+0x2be/0x4f0 [ 1569.751497][ T42] ? hfs_bnode_create+0x3b9/0x440 [ 1569.756502][ T42] ? hfs_bnode_create+0x3b9/0x440 [ 1569.761505][ T42] ? hfs_bnode_create+0x3bb/0x440 [ 1569.766509][ T42] handle_bug+0xcf/0x120 [ 1569.770740][ T42] exc_invalid_op+0x1a/0x50 [ 1569.775229][ T42] asm_exc_invalid_op+0x1a/0x20 [ 1569.780063][ T42] RIP: 0010:hfs_bnode_create+0x3b9/0x440 [ 1569.785679][ T42] Code: d4 e0 8a 89 ee e8 47 8c 1f 08 e9 73 fd ff ff e8 1d 1c 2d ff 4c 89 ef e8 45 bc 34 08 48 c7 c7 c0 d4 e0 8a 89 ee e8 27 8c 1f 08 <0f> 0b eb b7 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 7f fc ff ff 4c [ 1569.805268][ T42] RSP: 0018:ffffc90000b2ee18 EFLAGS: 00010246 [ 1569.811321][ T42] RAX: 000000000000001f RBX: ffff88807c44a000 RCX: 92830071c3751b00 [ 1569.819275][ T42] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 1569.827231][ T42] RBP: 0000000000000000 R08: ffffc90000b2eb27 R09: 1ffff92000165d64 [ 1569.835185][ T42] R10: dffffc0000000000 R11: fffff52000165d65 R12: 0000000000000000 [ 1569.843140][ T42] R13: ffff88807c44a0e0 R14: ffff888021b85300 R15: dffffc0000000000 [ 1569.851103][ T42] ? hfs_bnode_create+0x3b9/0x440 [ 1569.856116][ T42] hfs_bmap_alloc+0x541/0x5d0 [ 1569.860778][ T42] ? hfs_bmap_reserve+0x430/0x430 [ 1569.865783][ T42] ? rcu_is_watching+0x15/0xb0 [ 1569.870536][ T42] hfs_btree_inc_height+0x101/0xac0 [ 1569.875723][ T42] ? __rwlock_init+0x150/0x150 [ 1569.880475][ T42] ? hfs_brec_insert+0xbd0/0xbd0 [ 1569.885409][ T42] ? do_raw_spin_unlock+0x121/0x230 [ 1569.890613][ T42] hfs_brec_insert+0x748/0xbd0 [ 1569.895378][ T42] ? hfs_brec_keylen+0x360/0x360 [ 1569.900318][ T42] __hfs_ext_write_extent+0x2a1/0x470 [ 1569.905685][ T42] hfs_ext_write_extent+0x17f/0x210 [ 1569.910868][ T42] ? verify_lock_unused+0x140/0x140 [ 1569.916054][ T42] ? hfs_ext_find_block+0x190/0x190 [ 1569.921236][ T42] ? blk_start_plug+0x51/0x1a0 [ 1569.925985][ T42] hfs_write_inode+0xdc/0x880 [ 1569.930647][ T42] ? hfs_inode_write_fork+0x1a0/0x1a0 [ 1569.936002][ T42] ? __writeback_single_inode+0x48d/0xec0 [ 1569.941712][ T42] ? __lock_acquire+0x7d40/0x7d40 [ 1569.946721][ T42] ? do_raw_spin_lock+0x11f/0x2c0 [ 1569.951733][ T42] ? __rwlock_init+0x150/0x150 [ 1569.956487][ T42] __writeback_single_inode+0x705/0xec0 [ 1569.962021][ T42] writeback_sb_inodes+0x7cd/0xf50 [ 1569.967123][ T42] ? queue_io+0x550/0x550 [ 1569.971442][ T42] ? rcu_is_watching+0x15/0xb0 [ 1569.976195][ T42] wb_writeback+0x46a/0xbf0 [ 1569.980685][ T42] ? queue_io+0x3b1/0x550 [ 1569.985001][ T42] ? percpu_ref_tryget+0x250/0x250 [ 1569.990096][ T42] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1569.996061][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 1570.001242][ T42] wb_workfn+0x400/0xe60 [ 1570.005475][ T42] ? inode_wait_for_writeback+0x230/0x230 [ 1570.011182][ T42] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1570.017145][ T42] ? read_lock_is_recursive+0x20/0x20 [ 1570.022499][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 1570.027765][ T42] ? process_scheduled_works+0x96f/0x15d0 [ 1570.033469][ T42] ? process_scheduled_works+0x96f/0x15d0 [ 1570.039170][ T42] process_scheduled_works+0xa5d/0x15d0 [ 1570.044709][ T42] ? worker_attach_to_pool+0x380/0x380 [ 1570.050153][ T42] ? assign_work+0x3d2/0x5d0 [ 1570.054729][ T42] worker_thread+0xa55/0xfc0 [ 1570.059309][ T42] kthread+0x2fa/0x390 [ 1570.063365][ T42] ? pr_cont_work+0x560/0x560 [ 1570.068025][ T42] ? kthread_blkcg+0xd0/0xd0 [ 1570.072597][ T42] ret_from_fork+0x48/0x80 [ 1570.077009][ T42] ? kthread_blkcg+0xd0/0xd0 [ 1570.081590][ T42] ret_from_fork_asm+0x11/0x20 [ 1570.086344][ T42] [ 1570.089645][ T42] Kernel Offset: disabled [ 1570.093951][ T42] Rebooting in 86400 seconds..