last executing test programs: 2m39.137177988s ago: executing program 2 (id=134): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x25dfdbfe, {0x1d, 0x1, 0x6}, [@CGW_SRC_IF={0x8, 0x9, r3}, @CGW_DST_IF={0x8, 0xa, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) 2m38.824567639s ago: executing program 2 (id=137): r0 = socket(0x400000000010, 0x3, 0x0) close(0x3) r1 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x4041810}, 0x0) 2m38.528481043s ago: executing program 2 (id=141): openat(0xffffffffffffff9c, 0x0, 0x45042, 0x120) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="1c00000e01000b00000014"], 0x36) 2m37.761265361s ago: executing program 2 (id=146): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x400000, &(0x7f00000000c0)={[{@noload}, {@abort}, {@data_err_ignore}, {@nogrpid}, {@oldalloc}, {@errors_remount}]}, 0x0, 0x467, &(0x7f0000000500)="$eJzs3M9vFFUcAPDvTLflt62KP0DQKhqJPwotPw9eMJp40MREDxhPtS0EWajSmgghWj3g0ZB4Nx5N/As86cWoJxOvejckxHABNSZjZna2XZbd0rVbFtjPJ1n2vZ23zPvuzJt5895MA+hbo/k/ScTmiPgtIoZr2esLjNberl05P/XXlfNTSWTZG38mRbmrV85P1YvWv7eplsmyMr+uxXovvB0xWa3OnCnze+ZPvbdn7uy550+cmjw+c3zm9MThw/v37Rw6OHGgK3HmcV3d/tHsjm2vvHXxtamjF9/56Zu8vpvL5Y1xdMmG0dqv29JTXV5Zr21pSCeVHlaEjgxERL65Bov2PxwDsWFx2XC8/GlPKwesqSzLslbn59JCBtzFkuh1DYDeqJ/o8+vf+usWdT1uC5ePRLx/qBb/tfJVW1KJtCwz2HR9202jEXF04e8v81eszTgEAMB1vjsSEc+16v+l8WBDuXvKOZSRiLg3Iu6LiPsjYmtEPBBRlH0oIh7ucP3NMyQ39n/SS/8rsBXK+38vlHNbi/2/f7Mi/tLIQJnbUsQ/mBw7UZ3ZW/4mu2NwXZ4fX2Yd37/06+ftluXxJwtLfcB8/fW+YE16qdI0QDc9OT+5yrAXXf4kYnulKf5CEvVpnCQitkXE9o7+56UrjBPPfL2jXanG/m/r+JfRhXmm7KuIp2vbfyGa4q9L2s5Pjh86OHFgz/qozuz9J8uyYq9YslC+//zLhdfbrX9V8XdBvv03Nu//hcX4R5L1EXNnz50s5mvnonmG+KYu/P5Z22uam8ffev8fSt4s0kPlZx9Ozs+fGY8YSl698fOJpe+W+Upj/Lt3tYo/LY5x9WgfiYh8J94ZEY9GxGNl3R+PiCciYtcy8f/44pPvdh7/MqPyNZ0ealvK45++2faPxu3feWLg5A/fdh5/Xb799xep3eUnKzn+rbSCq/ntAAAA4E6RFvfAJ+nYYjpNx8Zq9/BvjY1pdXZu/tljsx+cnq7dKz8Sg2l9/HO4YTx0vBwbrucnloZgivy+ctz4i4ENRX5sarY63ePYod9tatP+c38M9Lp2wJrzvBb0L+0f+pf2D/1L+4f+pf1D/2rV/j/uQT2AW8/5H/qX9g/9q6n9d/Z0J3BHc/6HvtT22fh0VY/8S9z1iUg7/1YlelrnpIM/DHH7JCprXed1LRf1+sgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHf8FAAD//4sz60A=") mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x2) 2m36.887442039s ago: executing program 2 (id=154): syz_mount_image$btrfs(&(0x7f0000000000), &(0x7f00000015c0)='./file0\x00', 0x0, &(0x7f0000001600), 0x0, 0x559e, &(0x7f000000ac40)="$eJzs3X9sVeX9B/BzWwoN+C39jhUYfxAgBoMkyJYtjqB4MQa24eKlgsKcCEQlBivYRDcYqUWSZcaghU4EF5GQaDJjscM/FMywy7CMZfzY5hZjs4JSaZZsAzVrHDG69N77XO49l9tembNOXy/SnvPcz3me+9yT88d9X/qcGwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAURUcSc9+d0f3i0ZE1X77/Hz+e+OjGn4zfvX/roVvu23T/gjMjbto5a1nf+mlN8zdsbDjS/PS+ObdGUSLdL5Htf9u136q/88bbvlsdBly+MLOtrS31lJmuJzON4QUP9vcr/FkRRVFVbIDK7PbV7E5FwQC53cbiAQf0Tuui6O7J8ya1dT01bklyYU/xS6df9VBPYKhkr6ue89dSMv27InZErp136SUKLtFM//gF96m8CADgY5mZSm9yb0ezb3Fz7eZ4PdZOxtotsXZ4h9CS37gYmXGHl5rnpHh9iOaZzESFESXnGatnz3+unYr3j7VjUeNjzLPw0GykqS41z7Wx+lDNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCzZOzxo2tWtD2y575fdtQceff9OVc+8KWOw22LT4y8eunKHWum/HTWsr7105rmb9jYcKT56X1zbo2i2nS/RKZ74kTL5b9NjZ3fvXfcG427n6vpq8yOG7bD8g6OXg87s0ZH0cq8Sk8Y9q81UZQqLKSb0Y7iwl3pnW+HAgAAAJ8nX0n/rsi1M3GwqqCdSKfJRPpfkAmL77Quiu6ePG9SW9dT45YkF/Zc/HipEuMlLzherl17/ieRF4xD/I2Pd74eDm0sGmdg8RHjef7SMWPefmty/eSvT5v7xA3PjOru+r8nZ2xJ/bGu5oUrru+tf/a6ovxfO3D+D2dO/gcAAOA/If/HxxnYYPn/jqVTt7z+i2Grft3a8MTB+h1/bv3OMzsXneq54Ud9L09N3v7o1UX5f1LBUxbl/zDjkP8roovL/wAAAPBZ9t/O/8micQY2WP5vONM3+wcHX6vr+PucxXt+9dAVi8+e/tv8U7t3DV9zR8v6uoeuLMr/M8vL/8Pypx0e/F2Y8OrRUTSz/JMKAAAAFAj/737+o4WQ1zOfHMTz+rX/vKp5380ffPMbD97zpzff/s2xA7MnrdteN/PgyzfVf1j5ve3dRfk/WV7+r/p0Xi4AAABQhuePrpw773jPucfPvtB18vDu3pMznjyzrqnvdOslLatXbTr2WlH+T5WX/0cMzcsBAAAALuDeO59bsfnVl/oe2H/X2Ck9FVc1XpK4ZduOqU0TPuq8tPfy7VuL8v/y8vL/yOw2u/Ih06kz/BVC6+goqu7fWZspHIparskVAAAAgE9IyOlbP1ixbOzOsb3jj59+rObQG4dn/2Vt55yN13RXdW/uXNZ4WdH9AkJiL3X//3Cng7D+v+D+f0Xr//MKmbv+zXZjAAAAAL6Iitfzh9vjZ765oNT375e7/n9J3cQTiba33lv11XMHzo1ZsP/7129aV9/be8+El37/wz9M/6i6KP83l5f/K/O3n+T3/wEAAMBF+F/7/r+lReMMbLD7/zdV9DWsWrd3+uota7csTCw7UH3qwdV731+w5l9Tb36+qea6A0X5v6W8/B+2o/JfXkc4P5tGR9H4/p3s3QR/Hqa7OlZor8orZE58rMeNoUe20D4ir5C2Ntbja6OjaHL/TnOs8P+h0BIrnK3JFnbFCsdCIXs95Ap7YoWOcKVtq8lON154MRSyCyzawwqKUbklEbEe75Xq0V+4YI+u3JMDAAB8oYTwnM2yVYXNKB5l2xODHTBysAMqBjugcrADhsUOiB9Y6vFoeWEhPH575yMbNjVMSb7y8NzHfvbms40T9j1+WV3v5g9f2XbvxJ3TW6YW5f9d5eX/cCqGZzal1v9HYf1/9nsNc+v/l4dCbazQHgqp+B0DUuE5MmH34fActalsj7PjcwUAAAD4XAufC1QO8TwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/s3evcdJVd0JAj/d9INumqaNE9GMk3TUgGakaWwNw+AoaoxGRZpZddxkNBBoEGmE8FgFURtQZxziZ3ztrJnoCAoiu+qHGFeDwUhcxIw6iWLiA/Cxjq7r+h6VGM2E/XTfOkXVrS67EFDa+X7/6DpVv/O89eg69946FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/xjuPfjlk4YunP0PHzace8nqqqmL/kfH6Mv+cNW3vvjUPy5b9G9h/i9GnLll3kEXHjd/wbR/6Vi++ogzQmjtKleWFC977oqvPtS613HP3jFw48wbb63fUpWpNxMP/Tr/lGfuXBxbfbF/CHeXhVCRDgypSwKVmft1sb5960LYI2wLZEu01SYl0g2HB2pCWBK2BbJVra4JoS4ncMqG+++7vDNxTU0IXwkhVKfbeKY6aaMmHRhUlQRq04HpFUngt1sT2cBPypMA7LD4Zsi+6Fe15mdo6L5ckddf5U7r2KcrPbw+MdFQPN/rR+3iTuWoSj/QukNPW0F17BIFb4+13m294N1WsJ2v8LTlfpHKfEPZui1UHcontk0aP6d9dnykPDQ19SlW0y56np9+e/6E7Un3mtdh7EDDTnkdXvrYiun9lo2+9OrNvxqz4ayaA3a0m0/lbNLc9K5WHTKvuV7zPEajfJ70grdfwbekRl+6Qghbzz17xtfnTDz7iD63PLnu1QcfrNty9pwFvzhz4nmLLj55w7/Pf6lg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MvFmfzM0BAACg1+gNe01Xnv/6X73+/bWtMxed/u23Dj73w71afz3i/gFVB7yxrqn1/I2ff6Vg/t9Y2vH/eMi/Lne0a0MY1ZVYNCCEvbseTwIrY3e+OyCEL3elWvMDR6UCa0PYpytxULaqVIm+sURjKvByfSYwKhVYHwOtqcDyGLgiFbg4BlalAhNiYG0qcHQMhCn54/hqfWYcJQdqYmBcshFXxbMQ3qmPraW21aZsVQAAADtJZnZYmX8351yHHc0Qp5eranrKEM/ALpqhOlVDegabnVYVraGipxrKe6ohO+6Ojx5+Qc1lPdVccBpGWX6GG9f85X2LXjzsC2P3mvj5xUMvmPKz8eGst++uerx5yYtv7XvEzesK5v/NHz3/r+6mI2UFx/9DGNv1N+Yuz0Tas/FxrXkZAAAAgB1w0R//xR61Lw85oGHT+2X3zl/7xKMrfrl5j1NOf3/c8a//8PCaxnsL5v+jSjv/P+4T6ZOTOTwSd0NMHRBCc34gqXZkYSA56t0vEwAAAIDeIHs8PnssfErmNjlFOz2fLszfup3544H/Ud3m//09/7P2jq3/+mLZBd89d0TNgKX/9GrHhBNOPvqW47/1zj4VB/yyvGD+31ra+f+1+bdJJ9bHXlw9IIS+OYEHYy87A10aY+D5I/MDmfGvjxtgcawqc2JCtqrFscS4GGhOBZYUK/FotsTe+YHMk5VtfFF2HFMyJXICAAAA8ImLuwPicfl4/n/LGSNO++vvzfrbha88eN7qCy75q+Ed80eedP/THzbMvXJp2PTmEQXz/3Hbd/5/1zy44PT+9n4hDK0IoU/6hwGP1CYLA8ZAXVkmcW9tUlefdFULa0MY2TmwdFUvZNb/r0ivMfh4TVJVDOy93y1vD+pMLKsJYWhu4IlvLz2sMzEnFcg2flpNCF/qHG268bv6Jo1Xphu/tm8IX8wJZKua0DeEzsaq0lX9r+rMdQzSVa2qDmHPnEC2quHVIcwNAPRW8X/pxNwHZ82dN3V8e3vbzF2YiDvxa8KkKe1tTROmt0+sLtKniak+561jtKBwTKVe+mZTZo2ixSsnV5aSzv5QsDm3rcyO/IIzBzP345ehyq5xHlKZd7clPeQD9y9sIuR8lSo25PJdPOTa3Eq2PYkF9cf8VaFf6DtnVtvMpvPGz549c1jyt9TshyR/43GmZFsNS2+r2u76VsLLo+hyWSkfd1sNyq1k6OxpM4bOmjtvyJRp4ye3TW47p+XQP2sZMXz410YM7RxUc/K3h5EO6q7m1Ei3Li1xWDtxpF+oyKnkk/jQkJCQ6G2J/f7L5odH77n+nOt/9tqPz+/3zdPu3fvImT889KqpD1Xve/ji24ccWDD/n/HR8//4qRM/+DPrMxQ7/t8QD/Mnj287zD8uBpaUevy/odjR/OyJAY2pQEcMdDjMDwAAwGdD3B0Z92bGndKbb1m/buOSlrk/aHin5dY17Utvuum+U39y58ATvjQ47LXhuhM+VzD/7yjt9/87af3/7NL1JxRb5v+gWKK52Pr/6WX+s+v/dxRb/z+9zH92/f8ln8L6/3OygdQmecf6/wAAwGfBJ7f+f4/L+6cvEFCQocfl/dMXCCjI0OMy/qVeIGC71/9f8+Bff6Wq35g7/qTlN/WXvPZ39xzWeuS6zTP/5Etb10+877qxt6wpmP9fUdr838L9AAAAsPv4z5ddU3H02Xff0bJu6sZxbw5+98m3lgzq80HF0Q+3j3xh4Bu3nlcw/19S2vz/k1//LxQ7/7+xWKC12MKA1v8DAACglyq2/t89Q1sa/zCm/x+eHvab5Q/ePPqnj/z898v3+/mJPyvfZ8Gxz8+8bFLB/H9VafP/eNpFeV7u2JsP65M17UJ6Tbs367M/GQAAAIDeoTw0NVWWmDdvYdSjPn6bT2eWAv2odK7vvXLt2ZtfmH7c46ev+7uaEwbvOWHaBasa/2b4gXd+ftQley7ddGrB/H9tafP/vN9lXPrYiun9lo2+9MOrN/9qzIazag7YdvwfAAAA2HVK3S8BAAAAAAAAAAAAAAB8+s7tWHzhI8uOfe+bt//F/kcseXXwbXcd+Lsh/V664qoHJq1648zJXy/4/X8Y21Wu2O//43X/4u8L/igvd2y15/X/MvdPOfH2uV1LFj5SH8L+uYGpC6fuETLX5h+cG7jvjIMGdiYWpkusefbolzoT30kHjh/yuS2dicNTgXFxkcR90oF4VcUt/VOBuLzi4+lA3B6r0oGqTOCy/sk4ytLb6pW6ZFuVpbfVxroQBuQEstvq7rqkjbL0AK9JBbID/F46EAd4ciZQnu7V7f2SXsVAXSx6Q7+kVwAA7Lbit8DKMGlKe1tz/Aofb79QkX8b5S1ZtqCw2rISm9+UWZps8crJlaWk+6S/i2671nhlqO4cwrCCr6u5Wcq6Rrlzaulh0/1RkSH3tNpbeZFyadu76aqKj6gmGVHThOntEyt7HHhLz1kOqegxy7CCyU5ulvKuTVpCLSX0pYQRlbhtSuhyvF8empr6pHL9eQw2hDw9vSJK/b1+7jp/xV4FuXluO/TKt758zE+f++CfP/9E/2+cVnP7rO+/e+KvX7//wEOOuG5C05otBfP/htLm/9W549qSuRhAR7yy3sgBIYwrcUQAAADw2XfbRbfecfr09a9MWlvx5GOPTS0fc3rl1vl3zp93ycZ7Fx9/2cErdjR+2Fm//f5vBu//b89e9dJPR+7zwA03/58nD3v8z3//8I8eeqduZZ+x7xXM/xtLm//HPViZQ8HJ3o618fr/iwaE0HVp/YYksDIO97sDQvhyV6o1lkguqH9CLNGcBFbGHSYHxRLjWvOr6hsDq1KBl+szgbWpwPoYyOyluCVkduVcWR/CYV2psfklZsQSDanAmBhoTAWaYqA5FegfA6NSgdf6ZwKtqcDDMRCm5G+rH/fPbCsAAIDtkZlnVebfDel53qqKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xAyVqZNXynIyVaZrrUnVUpAhXgx/u/tVkCE8mp8zXbCg6Xj+QfZ8g7L8DFf+4NlT1w+e/tDqzcd8beBt/zhkz4Obp9e9t+CGp3475pzrnv/TQQXz/+bS5v+1+bdJ6+vj/H/b9f+SwIOxe1fHU8cbY+D5I/MDmR0D6+Nkd3G2qtZMicykfXEsMSoGGlOBGTEwKhUYNzYTWDIwP5CZaWcbX5RtfEqmRE4AAAAAPnFxB0HcTRPn/zce9YOr3x8wccuyeTPvH9vyxMmjv3H1XT+6d/9ld767YvCAce99p2D+P6q0+X9sr19uYxfH3rzYP4S7y7b1JhsYUpcE4n6Muvjz+H3rQtgjZwdHtkRbbVKiKtVweKAm+YV6Vbqq1TXJGgPx/ikb7r/v8s7ENTUhfCVn70u2jWeqkzZq0oFBVUmgNh2YXpEE4p6fbOAn5UkAdlh2r2B8QWVOdclq6L5ckdffZ+WaoOnhFewD7SZfd7+52lWq0w9k9qlmbd/TVlAdu0TB22Otd1tvfLc1eLflfpHKfEPZui1UHcontk0aP6d9dnwk95esBXbR85z7K9VS0jvhddjx8Xvbs+p0B5pTHx/N3Zfr/nVYFqu79LEV0/stG33p1Zt/NWbDWTUHlNyNIuIPhX+05X9XPpWzeXe16pB5zfW6z5NWnye98d9Ao6cthHDZ9cfsu+TdX+/33A3Pnbqu7Maxr/7lrHs2Lf+bysNHrXv/yaGjLy+Y/7eWNv+vSN12+V3cmLMGhHBgzsZ9JG7+YwYkn4M5geRTcs/CQHLI/V/ri35yAgAAwM6W3d2R3V8wJXObnBCenicX5m/dzvxxf8WobvOX2u9j121cedLQN6474G8vOPGNv7/28Kceuv6ysnXL//vYD1avuXzxe08UzP/HffT8v2+qm47/O/7PLuL4f7d2913RfdMPdOzQruiC6tglHP/v1u7+bnP8v1uO/zv+3x3H/3vg+H+3dvenreBb0gxfujonwdff+fPfTbzpg7mN+x180lPPHDrxun+6quXuu0555b+de9601761uWD+P6O0+b/1/7pftC+7/t+4Yuv/zSi2/l+H9f8AAIBdqshCc+l5XsHqfQUZ0qv3FWTocYHAHpcYtP7fdq//t3Dkv1904Q+fb7n2nTvHXb5m07Fnvvr0utXPzFpx3Lnnv9V6112tBfP/jtLm//Hl0C+39d6y/l/j2CJVXREDMywMCAAAwO6o2A4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPl2HnvbO+5d8/R/aBv1ixc1/f+v/+7/P1q594JvfuGn4L6f86RllazZcM+LMLfMOuvC4+Qum/UvH8tVHnBHClK5yZUnxsueu+OpDrXsd9+wdAzfOvPHW+i3VmXorM7d/nJc7tvphfQhLch6pi4k36zvvbAuccuLtcys6E4/Uh7B/bmDqwql7dCaW14cwODdw3xkHDexMLEyXWPPs0S91Jr6TDhw/5HNbOhOHZwJl6e5e1z/pblm6u5f3D2FATiDb3bP751eVbeO4TKA83caKuqSNGKiLRa+tS9qIgfZYYkrfEIZWhNAnXdU/VydV9UlXdU91UlWfdFUXVYcwMoRQka7quaqkqor0yB+tSqqKgb33u+XtQZ2JpVUhDM0NPPHtpYd1JmamAtnG/1NVCF/qfMmkG/9xZdJ4Zbrx/1oZwhdDCFXpEu9VJCWq0iVeqAhhz5zAto1YEcLcwGdD/PSZmPvgrLnzpo5vb2+buQsTVZm2asKkKe1tTROmt0+sTvWpmLKc9NYFH3/sm96eP6HzdvHKyZWlpCsy5Sq7unxIZd7dlt2997FftbmVbHs+CuqP+atCv9B3zqy2mU3njZ89e+aw5G+p2Q9J/vbJRJNtNay3bKtBuZUMnT1txtBZc+cNmTJt/OS2yW3ntBz6Zy0jhg//2oihnYNqTv7ujJEu/eRH+oWKnEo+ife/hIREb0uU5326Ne/un+MFX/S3dbQyVHd9QBdMK3KzlHWNcmcM+qiPOeKP8zWlxxENK5g4FGQ5pOcsLQWTiW1ZapIsXV/rCiaHuTWVd23SeL88NDX1KbYdGvLv5m7e13dg8z6d2XSlpgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAA//8fSxmR") chdir(&(0x7f0000000240)='./file0\x00') syz_open_dev$loop(&(0x7f0000000640), 0x0, 0x22400) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x140) ioctl$FITRIM(r0, 0xc4009420, 0x0) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000380)='.\x00', 0x2042023, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, &(0x7f0000000000)) 2m36.084962968s ago: executing program 2 (id=159): r0 = io_uring_setup(0x6bd, &(0x7f00000000c0)={0x0, 0x18a9, 0x2, 0x1, 0x5e}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000180)="1a", 0x212a7, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000080)={0xde, 0xe, 0x2, 0x7f, 0x7, 0x2, 0x81, 0x2, 0x5, 0x2, 0xe, 0xd, 0xb, 0x6}, 0xe) close_range(r0, 0xffffffffffffffff, 0x0) 2m35.518630202s ago: executing program 32 (id=159): r0 = io_uring_setup(0x6bd, &(0x7f00000000c0)={0x0, 0x18a9, 0x2, 0x1, 0x5e}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000180)="1a", 0x212a7, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000080)={0xde, 0xe, 0x2, 0x7f, 0x7, 0x2, 0x81, 0x2, 0x5, 0x2, 0xe, 0xd, 0xb, 0x6}, 0xe) close_range(r0, 0xffffffffffffffff, 0x0) 2m23.259759692s ago: executing program 0 (id=228): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa", 0xf}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000780)) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000001980)=0x1) 2m22.652016204s ago: executing program 0 (id=231): prctl$PR_SET_SECUREBITS(0x1c, 0x1d) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) setreuid(0x0, 0xee01) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0x12) 2m22.310182989s ago: executing program 0 (id=233): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)={0x1c, r2, 0x1, 0x4, 0x0, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2m21.928039044s ago: executing program 0 (id=237): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000340)=0x1) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, 0x0) 2m21.526534839s ago: executing program 0 (id=241): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) setns(0xc9, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/fs/nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='tcp 2', 0x5) 2m20.739752848s ago: executing program 0 (id=247): mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x3}, {&(0x7f0000000300)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 2m5.383424915s ago: executing program 33 (id=247): mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x3}, {&(0x7f0000000300)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 1m22.882902745s ago: executing program 4 (id=511): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x30, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000180)='./bus\x00', 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB='errors=continue,checkpoint_merge,alloc_mode=default,active_logs=6,acl,fault_injection=00000000000000001262,acl,noacl,compress_cache,alloc_mode=default,noextent_cache,compress_cache,mode=lfs,\x00\x00\x00'], 0x1, 0x5505, &(0x7f0000002480)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") r0 = open(&(0x7f0000000240)='./file1\x00', 0x84242, 0x1df2a23c5997fa5f) write$cgroup_pid(r0, &(0x7f0000002140), 0xfffffce2) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) 1m21.050417254s ago: executing program 4 (id=516): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200), 0x401, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fea000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000017e000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2e5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1m17.972854637s ago: executing program 4 (id=523): munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) 1m17.514962862s ago: executing program 4 (id=528): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x2}) r1 = socket(0x2d, 0x2, 0x0) setsockopt(r1, 0x11d, 0x1, &(0x7f0000000200)="01000000", 0x4) ioctl(r1, 0x89e2, &(0x7f0000000300)='\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00') sendmsg(r1, &(0x7f0000000400)={&(0x7f0000000500)=@generic={0x2d, "00000000000008011800020000000600"}, 0x34, &(0x7f0000000600)=[{&(0x7f0000000700)='\x00\x00', 0x2}], 0x1}, 0x0) 1m17.040473224s ago: executing program 4 (id=530): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) setns(0xc9, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/fs/nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='tcp 2', 0x5) 1m16.149201811s ago: executing program 4 (id=538): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) bind$packet(r1, &(0x7f0000000200)={0x11, 0x2, r2, 0x1, 0x5, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}}, 0x14) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0x3ff}, 0x1c) 1m0.95875142s ago: executing program 34 (id=538): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) bind$packet(r1, &(0x7f0000000200)={0x11, 0x2, r2, 0x1, 0x5, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}}, 0x14) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0x3ff}, 0x1c) 6.774188151s ago: executing program 6 (id=926): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 6.163333337s ago: executing program 6 (id=934): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='temp_file\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='/dev/mapper/control', 0x13) lseek(r0, 0x0, 0x0) read(r0, &(0x7f0000000100), 0x14) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r1, 0xc138fd12, &(0x7f0000000200)="04") 5.67554626s ago: executing program 6 (id=938): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000d0039000000000000b4a518110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.118370378s ago: executing program 8 (id=944): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff00000007058102000200"], 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000700)='\x00') read$char_usb(r1, &(0x7f0000000600)=""/64, 0x40) close(r1) 5.077639654s ago: executing program 1 (id=945): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x10b080) read$usbmon(r1, 0x0, 0x0) ioctl$MON_IOCH_MFLUSH(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 5.002029197s ago: executing program 6 (id=946): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff}, 0x800) r1 = timerfd_create(0x0, 0x0) timerfd_settime(r1, 0x3, &(0x7f0000000080)={{}, {0x77359400}}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), 0x8004, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) clock_adjtime(0x0, &(0x7f0000000280)={0xc979, 0x1, 0xbf, 0x8, 0x8, 0x1, 0x0, 0x4, 0xf27, 0x80000000, 0x6, 0x3ff, 0x8a8, 0x6, 0x5, 0x413, 0x69, 0x2, 0x6, 0x100000006, 0x10000, 0x168, 0x2cbf, 0x7, 0xe, 0x5}) 4.58415567s ago: executing program 1 (id=949): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000200)=0x5) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100), 0x80002, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000700)=0x31) writev(r2, &(0x7f0000003480)=[{&(0x7f0000000400)="9caa6923", 0x4}, {0x0}], 0x2) 4.252277614s ago: executing program 1 (id=951): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x15}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @random="000300"}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x3004c047}, 0x4000050) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x20000814) 3.923865757s ago: executing program 1 (id=955): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000300000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000500000002000000ffff000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000cc0)={r2}, 0xc) 3.923514237s ago: executing program 6 (id=956): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x1, "a7c1ed36"}]}}, 0x0}, 0x0) 3.923170641s ago: executing program 3 (id=957): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xc8Ng\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) write$binfmt_misc(r1, &(0x7f0000000040)='\b', 0x1) sendfile(r0, r1, &(0x7f0000000000), 0xfffb) fcntl$addseals(r1, 0x409, 0x8) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x392fc000) 3.532964632s ago: executing program 1 (id=959): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x400000009) syz_clone(0x22023500, 0x0, 0xff4e, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) 3.388296992s ago: executing program 3 (id=960): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x444}) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r0 = syz_clone(0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) 2.710230056s ago: executing program 3 (id=961): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1, 0x1, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xe1000, 0x280000b, 0x28011, r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 2.651944307s ago: executing program 7 (id=962): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0), 0x125842, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x9) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone3(&(0x7f0000000640)={0x29004000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58) 2.205079565s ago: executing program 7 (id=964): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0xf, &(0x7f0000000940)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000007c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', r3}, 0x94) 2.112922682s ago: executing program 5 (id=965): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x28, 0x14, 0x509, 0x8070bd28, 0xfffffffa, {0x2, 0x18, 0x16d, 0x0, r1}, [@IFA_ADDRESS={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x28}}, @IFA_LOCAL={0x8, 0x2, @loopback}]}, 0x28}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000000)="4805000015", 0x5}], 0x1) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.024454088s ago: executing program 8 (id=966): bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x3, @any, 0xfffc, 0x2}, 0xe) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1.879686707s ago: executing program 7 (id=967): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0x4000b, @ipv4={'\x00', '\xff\xff', @empty}, 0x80ad}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}, 0x1c) 1.830193017s ago: executing program 5 (id=968): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0xc3, 0xa, 0xa, 0xfe00, 0x1, 0x71, 0x10, 0xbd}}, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1.784734025s ago: executing program 8 (id=969): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x214802, &(0x7f0000000300), 0xf7, 0x551, &(0x7f0000000cc0)="$eJzs3d9vU1UcAPDv7Tp+KyMhJPpgFnkQg3Rs8wcmPuCjUSKJvmOzXRaylpK1I2ySCA/y4oshJsZIYvwDfPeR+A/4V5AoCTFk0Qdfam53ywprt9EVNuznk9xyzj23nHt67vdwbs8lDWBojWcvhYhXIuLbJOJwR1kx8sLx1eNWHl6fybYkms3P/koiyfe1j0/yPw+2M8WI376OOFl4rMqx7KW+tDxfrlTShXznRKN6ZaK+tHzqUrU8l86ll6emp8+8Mz31/nvvDqytb57/54dP73505pvjK9//cv/I7STOxqG8rLMd23CjMzMe4/lnMhpnnzhwcgCV7SbJTp8AfRnJ43w0sjHgcIzkUQ/8/30VEU1gSCXiH4ZUex7Qvrcf0H3wC+PBh6s3QOvbX1z9biT2te6NDqwkj90ZJe0vMrYpq+PXP+/czrYY3PcQAJu6cTMiTheL68e/JB//+nd6C8c8WYfxD56fu9n8561u85/Co/lPdJn/HOwSu/3YPP4L9wdQTU/Z/O+DrvPffNFqLMZG8txLrexocvFSJc3Gtpcj4kSM7s3yG63nnFm51+xV1jn/y7as/vZcMD+P+8W9j79nttwob6/Vax7cjHi16/w3edT/SZf+zz6P81us41h657VeZZu3/9lq/hzxRtf+X1vRSjZen5xoXQ8T7ativb9vHfu9V/073f6s/w9s3P6xpHO9tv70dfy079+0V1m/1/+e5PNWek++71q50ViYjNiTfLJ+/9Tae9v59vFZ+08c33j863b974+IL7bY/ltHb/U8dFv9P4BF16z9s0/V/0+fuPfxlz/23/6s/99upU7ke7Yy/m31BLfz2QEAAAAAAMBuU4iIQ5EUSo/ShUKptPp8x9E4UKjU6o2TF2uvR6us9fxDob3SfbjjeYjJ/HnYdn7qifx0RByJiO9G9rfypZlaZXanGw8AAAAAAAAAAAAAAAAAAAC7xMEe//8/88fITp8d8Mz5yW8YXpvG/yB+6QnYlfz7D8NL/MPwEv8wvMQ/DC/xD8NL/MPwEv8wvMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAADNT5c+eyrbny8PpMlp+9urQ4X7t6ajatz5eqizOlmdrCldJcrTZXSUsztepmf1+lVrsyORWL1yYaab0xUV9avlCtLV5uXLhULc+lF9LR59IqAAAAAAAAAAAAAAAAAAAAeLHUl5bny5VKuiAh0VeiuDtOQ2LAiZ0emQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgzX8BAAD//7VBN58=") r0 = socket$unix(0x1, 0x2, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x108688d, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x8, 0x0) chdir(&(0x7f00000002c0)='./file0\x00') bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 1.671720799s ago: executing program 6 (id=970): r0 = syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x3, 0x24, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) clock_settime(0x3, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0xfffffffffffffea4}}}, 0x0) 1.627848322s ago: executing program 7 (id=971): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@local, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x9, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) 1.54995149s ago: executing program 5 (id=973): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 1.510671781s ago: executing program 3 (id=974): syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000140)='./bus\x00', 0x2, &(0x7f0000000b40)=ANY=[@ANYRES32=0x0, @ANYRES8=0x0, @ANYRES32], 0xff, 0x2e7, &(0x7f0000000280)="$eJzs3M9LG2kcx/Gvml9GNDksu+wuy37ZveyyMGj2XghFaWmgRU2pLRRGnbQh00QygyWlqD31WvpH9CDe6k1oe+jVS2899dKbhxZKqfTXlEwmGjX+oiZa836B5nGe5+vzTGYcPiNk1q48uFXIOUbOdKW7OyzdIguyLpKstkQq1W9dIhKTmi6JSKMF+bfv3cs/xiauXkhnMsOjqiPp8f9Tqjrw55Pbd5f+eub2XV4eWInKavL62tvU69WfV39d+zp+M+9o3tFiyVVTJ0uv3Mikbel03ikYqpc8z3QszRefT4j4/SXXrPbn7NLMTEXN4nR/fKZsOY6axYoWrIpKSKRcUfOGmS+qYRjaHxfsJ7o4Omqm/Wbs0MVTLVgQvtu5HSd+uZw2e0Skd8fY7GK7VgUAAE6OLfk/ptvzv68reK1u+eJ5XmO9n//fPxY5UP5fieyS/4N8X8//tlXL/45Vdg+W/92SutX8HyL/H0J2M//j1Krm/3jw9+u7d21p0G+Q/wEAAAAAAAAAAAAAAAAAAAAA+BGse17C87xE/bX+FQ0+El7/+bjXidbg+He2MQ0aqjER+/5sdjYrYodrGzeOuyWDkpDP/vkQqLVHzmeGB9WXlKf2fFA/P5vt8QvTOcmLLZYMSUKSzeuHavW6tT4s8cb6lCTkp+b1qab1Efnn74Z6QxLyYkpKYsu0f15v1s8NqZ69mNlW3+uPAwAAAADgNDB0Q9P7d8PYrb9Wn86J+PfX+/9/YNv9dUh+Cx3vvgMAAAAA0Cmcyp2CadtWuY2NmIi0fq7q3rV+d3r3HjP3X/vf3pPTSDRsqT9Euu3LCDVOGg1W0aK5fnn46MPR/cIzy79/atb1sS1v3QEuHuHWXZcAAAAAHL3N0L/7GO9NO1cEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDnad1TxHqCGfZ6sgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQWb4FAAD//9yVIwU=") creat(&(0x7f0000000100)='./bus\x00', 0x1fb978507dcbbbd6) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x68000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x8005, 0x0, 0x0, 0x12, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]}) creat(&(0x7f00000003c0)='./file0\x00', 0xa) 1.407670983s ago: executing program 8 (id=975): mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb) 1.391579391s ago: executing program 7 (id=976): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000005c0)='syz_tun\x00', 0x10) connect$inet6(r0, &(0x7f0000000400)={0xa, 0x4e20, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}, 0x10}, 0x1c) 1.181011266s ago: executing program 5 (id=977): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000001900)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 1.10305078s ago: executing program 7 (id=978): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) recvfrom$l2tp6(r1, 0x0, 0x0, 0x20, 0x0, 0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) 913.311641ms ago: executing program 8 (id=979): close(0xffffffffffffffff) socket$xdp(0x2c, 0x3, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) 771.713868ms ago: executing program 5 (id=980): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x3, 0x800000000000, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x4d4, 0x33}, 0x0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x3, 0x1, 0x7, 0x4}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) 575.903625ms ago: executing program 3 (id=981): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0xf, &(0x7f0000000940)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000007c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', r3}, 0x94) 310.644942ms ago: executing program 1 (id=982): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) syz_usb_connect(0x5, 0x3f, &(0x7f0000000140)=ANY=[], 0x0) 210.892832ms ago: executing program 8 (id=983): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80", 0x63}], 0x3}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000740)=""/105, 0x69}], 0x1}, 0x0) 112.66728ms ago: executing program 3 (id=984): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r1, 0x0, 0xffffffdb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) 0s ago: executing program 5 (id=985): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) kernel console output (not intermixed with test programs): oop1: rw=524288, sector=89, nr_sectors = 1 limit=16 [ 155.270549][ T6664] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 155.322908][ T6820] syz.1.304: attempt to access beyond end of device [ 155.322908][ T6820] loop1: rw=524288, sector=65642, nr_sectors = 1 limit=16 [ 155.363749][ T6664] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.385824][ T6822] XFS (loop3): Quotacheck: Done. [ 155.397941][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 155.398936][ T6820] syz.1.304: attempt to access beyond end of device [ 155.398936][ T6820] loop1: rw=524288, sector=98797, nr_sectors = 1 limit=16 [ 155.433169][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 155.459593][ T6664] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.468359][ T9] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 155.481413][ T6664] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 155.537163][ T6820] syz.1.304: attempt to access beyond end of device [ 155.537163][ T6820] loop1: rw=524288, sector=36, nr_sectors = 1 limit=16 [ 155.589734][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.640504][ T6664] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.642498][ T9] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 155.658569][ T6820] erofs (device loop1): bogus lookback distance 0 @ lcn 4 of nid 36 [ 155.714162][ T6820] syz.1.304: attempt to access beyond end of device [ 155.714162][ T6820] loop1: rw=0, sector=89, nr_sectors = 1 limit=16 [ 155.744745][ T5627] svc: failed to register nfsdv3 RPC service (errno 111). [ 155.775159][ T9] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 155.815337][ T5627] svc: failed to register nfsaclv3 RPC service (errno 111). [ 155.815745][ T6820] syz.1.304: attempt to access beyond end of device [ 155.815745][ T6820] loop1: rw=0, sector=65642, nr_sectors = 1 limit=16 [ 155.846675][ T5627] failed to unregister tcp with rpcbind [ 155.853865][ T75] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.897898][ T5627] svc: failed to register nfsdv3 RPC service (errno 97). [ 155.936442][ T6820] erofs (device loop1): read error -5 @ 0 of nid 36 [ 155.941810][ T5627] svc: failed to register nfsaclv3 RPC service (errno 97). [ 155.954749][ T6820] erofs (device loop1): failed to readdir of logical block 0 of nid 36 [ 155.994206][ T5627] failed to unregister tcp with rpcbind [ 156.018539][ T80] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.038099][ T9] usb 5-1: USB disconnect, device number 5 [ 156.068132][ T5644] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 156.080316][ T80] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.080423][ T5644] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 156.108534][ T5644] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 156.122023][ T5644] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 156.132604][ T5644] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 156.202248][ T9] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 156.359231][ T9] garmin_gps 5-1:1.0: device disconnected [ 156.365577][ T80] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.490266][ T6664] hsr_slave_0: entered promiscuous mode [ 156.524443][ T6664] hsr_slave_1: entered promiscuous mode [ 156.547095][ T6664] debugfs: 'hsr0' already exists in 'hsr' [ 156.580003][ T6664] Cannot create hsr debugfs directory [ 156.609211][ T6849] netlink: 'syz.1.306': attribute type 11 has an invalid length. [ 156.635965][ T5284] 8021q: adding VLAN 0 to HW filter on device eth6 [ 156.904958][ T5624] XFS (loop3): Unmounting Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 157.184606][ T30] audit: type=1800 audit(1785510532.806:40): pid=6860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.310" name="compatible_id" dev="configfs" ino=13458 res=0 errno=0 [ 157.229392][ T9] xhci_hcd 0000:00:01.0: init 0000:00:01.0 fail, -16 [ 157.277606][ T6859] xhci_hcd 0000:00:01.0: probe with driver xhci_hcd failed with error -16 [ 157.478177][ T5627] bond0: (slave syz_tun): Releasing backup interface [ 157.514914][ T6864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.312'. [ 157.544504][ T6864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.312'. [ 157.693703][ T6864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.312'. [ 157.703198][ T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 157.726051][ T6864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.312'. [ 158.131032][ T75] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 158.190774][ T75] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 158.234261][ T9] IPVS: starting estimator thread 0... [ 158.242972][ T5644] Bluetooth: hci6: command tx timeout [ 158.362511][ T6883] IPVS: using max 22 ests per chain, 52800 per kthread [ 158.415483][ T693] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.485269][ T693] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.545059][ T693] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.631041][ T6893] loop3: detected capacity change from 0 to 64 [ 158.709065][ T6893] BFS-fs: bfs_fill_super(): loop3 is unclean, continuing [ 158.712884][ T75] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 158.765500][ T75] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 158.828733][ T6900] loop6: detected capacity change from 0 to 8 [ 158.849751][ T6900] MTD: Attempt to mount non-MTD device "/dev/loop6" [ 158.913573][ T6281] udevd[6281]: incorrect cramfs checksum on /dev/loop6 [ 159.037243][ T6900] cramfs: Error -3 while decompressing! [ 159.040344][ T5631] udevd[5631]: incorrect cramfs checksum on /dev/loop6 [ 159.087073][ T6900] cramfs: ffffffff9b812008(18)->ffff8880485ba000(4096) [ 159.150490][ T6900] cramfs: Error -3 while decompressing! [ 159.207174][ T6900] cramfs: ffffffff9b812008(18)->ffff8880485ba000(4096) [ 159.276704][ T30] audit: type=1800 audit(1785510534.856:41): pid=6900 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.322" name="file1" dev="loop6" ino=324 res=0 errno=0 [ 159.468417][ T6910] loop3: detected capacity change from 0 to 32768 [ 159.498270][ T6910] (syz.3.324,6910,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 159.514796][ T6910] (syz.3.324,6910,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 159.560462][ T6910] JBD2: Ignoring recovery information on journal [ 159.621341][ T6910] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 159.908971][ T75] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 159.941391][ T75] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.957323][ T6920] dummy_hcd dummy_hcd.0: remove, state 4 [ 159.995926][ T6920] usb usb1: USB disconnect, device number 1 [ 160.260419][ T5624] ocfs2: Unmounting device (7,3) on (node local) [ 160.326562][ T5644] Bluetooth: hci6: command tx timeout [ 160.444092][ T6920] dummy_hcd dummy_hcd.0: stopped [ 160.465996][ T6920] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 160.516840][ T75] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 160.549477][ T75] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.586523][ T6923] dummy_hcd dummy_hcd.0: USB Host+Gadget Emulator, driver 02 May 2005 [ 160.610452][ T6923] dummy_hcd dummy_hcd.0: Dummy host controller [ 160.710102][ T6923] dummy_hcd dummy_hcd.0: new USB bus registered, assigned bus number 1 [ 160.757323][ T6923] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 160.771452][ T6923] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 160.790729][ T6923] usb usb1: Product: Dummy host controller [ 160.813568][ T6923] usb usb1: Manufacturer: Linux syzkaller dummy_hcd [ 160.838027][ T6923] usb usb1: SerialNumber: dummy_hcd.0 [ 160.889811][ T6935] loop3: detected capacity change from 0 to 512 [ 160.950713][ T6923] hub 1-0:1.0: USB hub found [ 160.966004][ T6923] hub 1-0:1.0: 1 port detected [ 160.979532][ T6935] EXT4-fs error (device loop3): ext4_orphan_get:1399: inode #15: comm syz.3.332: iget: bad i_size value: 38620345925642 [ 161.011111][ T6935] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 161.012421][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 161.013755][ T6935] EXT4-fs error (device loop3): ext4_orphan_get:1402: comm syz.3.332: couldn't read orphan inode 15 (err -117) [ 161.022867][ C0] EXT4-fs (loop3): initial error at time 1785510536: ext4_orphan_get:1399: inode 15 [ 161.050916][ C0] EXT4-fs (loop3): last error at time 1785510536: ext4_orphan_get:1399: inode 15 [ 161.079351][ T6935] loop3: lost filesystem error report for type 5 error -117 [ 161.094697][ T6935] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 161.269897][ T6934] EXT4-fs error (device loop3): ext4_validate_block_bitmap:431: comm syz.3.332: bg 0: block 5: invalid block bitmap [ 161.361503][ T6935] EXT4-fs (loop3): shut down requested (0) [ 161.653196][ T6948] loop4: detected capacity change from 0 to 8 [ 161.736382][ T6952] netlink: 8 bytes leftover after parsing attributes in process `syz.6.335'. [ 161.747291][ T5624] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 162.121412][ T6960] netlink: 4 bytes leftover after parsing attributes in process `syz.6.338'. [ 162.392760][ T5355] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 162.402534][ T5644] Bluetooth: hci6: command tx timeout [ 162.570379][ T5355] usb 4-1: Using ep0 maxpacket: 8 [ 162.586143][ T5355] usb 4-1: config 0 has no interfaces? [ 162.591962][ T5355] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 162.611483][ T5355] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.631428][ T5355] usb 4-1: config 0 descriptor?? [ 162.873578][ T5355] usb 4-1: USB disconnect, device number 5 [ 163.054596][ T75] bridge_slave_1: left allmulticast mode [ 163.078887][ T75] bridge_slave_1: left promiscuous mode [ 163.091816][ T75] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.105776][ T75] bridge_slave_0: left allmulticast mode [ 163.119272][ T75] bridge_slave_0: left promiscuous mode [ 163.132737][ T75] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.570651][ T6990] loop4: detected capacity change from 0 to 2048 [ 163.640255][ T6990] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 163.752906][ T6990] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 163.767820][ T6990] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 11 with max blocks 242 with error 28 [ 163.781521][ T6990] EXT4-fs (loop4): This should not happen!! Data will be lost [ 163.781521][ T6990] [ 163.806924][ T6990] EXT4-fs (loop4): Total free blocks count 0 [ 163.822263][ T6990] EXT4-fs (loop4): Free/Dirty block details [ 163.838925][ T6990] EXT4-fs (loop4): free_blocks=4096 [ 163.845912][ T6990] EXT4-fs (loop4): dirty_blocks=256 [ 163.862296][ T6990] EXT4-fs (loop4): Block reservation details [ 163.870478][ T6990] EXT4-fs (loop4): i_reserved_data_blocks=16 [ 163.880835][ T75] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 163.928216][ T75] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 163.952300][ T75] bond0 (unregistering): Released all slaves [ 164.091833][ T6842] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.123803][ T6842] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.141156][ T6842] bridge_slave_0: entered allmulticast mode [ 164.183675][ T6842] bridge_slave_0: entered promiscuous mode [ 164.300394][ T6842] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.336191][ T6842] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.368444][ T6842] bridge_slave_1: entered allmulticast mode [ 164.395047][ T6842] bridge_slave_1: entered promiscuous mode [ 164.441033][ T693] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 253 with error 28 [ 164.482456][ T5644] Bluetooth: hci6: command tx timeout [ 164.526838][ T7007] loop6: detected capacity change from 0 to 4096 [ 164.541316][ T7007] ntfs3(loop6): Different NTFS sector size (1024) and media sector size (512). [ 164.555440][ T5623] EXT4-fs warning (device loop4): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 164.588865][ T7007] ntfs3(loop6): Mark volume as dirty due to NTFS errors [ 164.617045][ T7007] ntfs3(loop6): Failed to load $Extend (-22). [ 164.630486][ T7007] ntfs3(loop6): Failed to initialize $Extend. [ 164.870032][ T6664] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 164.901292][ T30] audit: type=1800 audit(1785510540.526:42): pid=7007 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.351" name="file1" dev="loop6" ino=30 res=0 errno=0 [ 164.937367][ T7016] ntfs3(loop6): ino=0, attr_set_size_ex [ 164.969515][ T6664] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 165.013132][ T6664] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 165.022274][ T7007] ntfs3(loop6): ino=0, attr_set_size_ex [ 165.065835][ T6664] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 165.168932][ T6842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 165.245377][ T6842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 165.318860][ T6664] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 165.376333][ T6664] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 165.648902][ T6664] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 165.712997][ T6664] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 166.133830][ T75] hsr_slave_0: left promiscuous mode [ 166.189750][ T75] hsr_slave_1: left promiscuous mode [ 166.234834][ T75] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 166.280070][ T75] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 166.309701][ T7022] loop3: detected capacity change from 0 to 131072 [ 166.319452][ T7022] F2FS-fs (loop3): Wrong CP boundary, start(512) end(1536) blocks(0) [ 166.329002][ T7022] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 166.341947][ T7022] F2FS-fs (loop3): invalid crc value [ 166.364984][ T75] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 166.413795][ T7012] loop1: detected capacity change from 0 to 32768 [ 166.422202][ T75] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 166.487394][ T7022] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 166.506799][ T7022] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 166.515256][ T7022] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 166.572027][ T75] veth1_macvtap: left promiscuous mode [ 166.599365][ T75] veth0_macvtap: left promiscuous mode [ 166.626043][ T75] veth1_vlan: left promiscuous mode [ 166.654833][ T75] veth0_vlan: left promiscuous mode [ 166.745963][ T7012] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 167.023420][ T5766] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 167.229194][ T5766] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 167.269182][ T5766] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 167.286276][ T5766] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 167.298574][ T5766] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.376667][ T5766] usb 5-1: config 0 descriptor?? [ 167.695882][ T5626] ocfs2: Unmounting device (7,1) on (node local) [ 167.929199][ T75] team0 (unregistering): Port device team_slave_1 removed [ 168.024583][ T75] team0 (unregistering): Port device team_slave_0 removed [ 168.263994][ T5766] hid-led 0003:27B8:01ED.0003: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.4-1/input0 [ 168.439430][ T5766] hid-led 0003:27B8:01ED.0003: ThingM blink(1) initialized [ 168.462539][ T5355] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 168.477421][ T5766] usb 5-1: USB disconnect, device number 6 [ 168.645379][ T5355] usb 7-1: Using ep0 maxpacket: 8 [ 168.662233][ T5355] usb 7-1: config index 0 descriptor too short (expected 6427, got 27) [ 168.682073][ T5355] usb 7-1: config 0 has an invalid interface number: 21 but max is 0 [ 168.698019][ T6842] team0: Port device team_slave_0 added [ 168.703967][ T5355] usb 7-1: config 0 has no interface number 0 [ 168.714150][ T5355] usb 7-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 168.726951][ T6842] team0: Port device team_slave_1 added [ 168.735389][ T5355] usb 7-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59219, setting to 1024 [ 168.757848][ T5355] usb 7-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 168.776040][ T5355] usb 7-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 168.830402][ T5355] usb 7-1: Product: syz [ 168.860856][ T5355] usb 7-1: config 0 descriptor?? [ 168.880200][ T7064] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 168.957905][ T6842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 168.973310][ T6842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.043573][ T6842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 169.100699][ T6842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 169.135069][ T6842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.208177][ T6842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 169.477502][ T7085] loop3: detected capacity change from 0 to 1024 [ 169.519597][ T7083] loop1: detected capacity change from 0 to 2048 [ 169.560472][ T7083] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 169.589712][ T5355] input: syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.21/input/input7 [ 169.688413][ T5648] udevd[5648]: incorrect nilfs2 checksum on /dev/loop1 [ 169.712478][ T7090] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 169.731071][ T6842] hsr_slave_0: entered promiscuous mode [ 169.786865][ T6842] hsr_slave_1: entered promiscuous mode [ 169.834275][ T6842] debugfs: 'hsr0' already exists in 'hsr' [ 169.862408][ T6842] Cannot create hsr debugfs directory [ 169.920805][ T5766] usb 7-1: USB disconnect, device number 2 [ 169.920871][ C1] keyspan_remote 7-1:0.21: keyspan_irq_recv - usb_submit_urb failed with result: -19 [ 170.012158][ T7093] mmap: syz.4.373 (7093) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 170.112151][ T7095] overlay: ./file2 is not a directory [ 170.542320][ T6664] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.612301][ T7090] NILFS (loop1): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 170.684371][ T7090] NILFS error (device loop1): nilfs_bmap_propagate: broken bmap (inode number=4) [ 170.790334][ T7090] Remounting filesystem read-only [ 170.806377][ T7107] netlink: 27 bytes leftover after parsing attributes in process `syz.6.377'. [ 170.857586][ T5626] NILFS (loop1): disposed unprocessed dirty file(s) when stopping log writer [ 170.889813][ T7110] loop4: detected capacity change from 0 to 128 [ 170.977500][ T6664] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.006137][ T7112] loop3: detected capacity change from 0 to 1024 [ 171.065943][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.073177][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.105850][ T7112] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 171.177055][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.184313][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.234811][ T7118] loop1: detected capacity change from 0 to 512 [ 171.447471][ T30] audit: type=1800 audit(1785510547.076:43): pid=7118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.376" name="bus" dev="loop1" ino=1048619 res=0 errno=0 [ 171.452458][ T7119] EXT4-fs warning (device loop3): empty_inline_dir:1765: bad inline directory (dir #12) - no `..' [ 171.835800][ T5624] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 172.066715][ T6842] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 172.151646][ T6842] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 172.167457][ T6842] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 172.188123][ T6842] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 172.279780][ T6842] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 172.341228][ T6842] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 172.504158][ T30] audit: type=1326 audit(1785510548.126:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 172.712450][ T30] audit: type=1326 audit(1785510548.176:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 172.789099][ T7146] loop3: detected capacity change from 0 to 32768 [ 172.805627][ T6842] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 172.813021][ T30] audit: type=1326 audit(1785510548.176:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=5 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 172.852469][ T30] audit: type=1326 audit(1785510548.176:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 172.883956][ T7146] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 172.894625][ T7146] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 172.958798][ T30] audit: type=1326 audit(1785510548.176:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 172.960951][ T6842] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 173.035814][ T7146] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 1ms [ 173.052104][ T29] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 173.060688][ T29] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 173.130539][ T30] audit: type=1326 audit(1785510548.186:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=113 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 173.211805][ T30] audit: type=1326 audit(1785510548.186:50): auid=4294967295 uid=384 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 173.252872][ T10] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 173.326917][ T30] audit: type=1326 audit(1785510548.186:51): auid=4294967295 uid=384 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 173.400808][ T29] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 340ms [ 173.420162][ T30] audit: type=1326 audit(1785510548.186:52): auid=4294967295 uid=384 gid=0 ses=4294967295 subj=unconfined pid=7145 comm="syz.6.386" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=59 compat=0 ip=0x7f08d539e019 code=0x7ffc0000 [ 173.452989][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 173.464914][ T29] gfs2: fsid=syz:syz.0: jid=0: Done [ 173.490310][ T7146] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 173.496765][ T10] usb 7-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 173.569789][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.675239][ T10] usb 7-1: config 0 descriptor?? [ 173.744545][ T10] ftdi_sio 7-1:0.0: FTDI USB Serial Device converter detected [ 173.761615][ T6842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.976334][ T10] usb 7-1: Detected FT232A [ 173.994658][ T6842] 8021q: adding VLAN 0 to HW filter on device team0 [ 174.005334][ T10] usb 7-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 174.055552][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.062799][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.141556][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.148813][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 174.355027][ T5773] usb 7-1: USB disconnect, device number 3 [ 174.496606][ T5773] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 174.549126][ T5773] ftdi_sio 7-1:0.0: device disconnected [ 174.600063][ T7189] netlink: 8 bytes leftover after parsing attributes in process `syz.4.394'. [ 175.304551][ T6664] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 176.506980][ T7246] loop4: detected capacity change from 0 to 128 [ 176.576243][ T7246] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 176.595508][ T7246] ext4 filesystem being mounted at /99/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 176.619220][ T6842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 176.954635][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 176.954661][ T30] audit: type=1326 audit(1785510552.576:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.405" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefa5d9e019 code=0x7fc00000 [ 177.010253][ T6664] veth0_vlan: entered promiscuous mode [ 177.015152][ T7246] EXT4-fs error (device loop4): dx_make_map:1295: inode #2: block 20: comm syz.4.404: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 177.062911][ T7246] EXT4-fs error (device loop4) in do_split:2027: Corrupt filesystem [ 177.079366][ T30] audit: type=1326 audit(1785510552.586:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.405" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fefa5d9e019 code=0x7fc00000 [ 177.089461][ T6664] veth1_vlan: entered promiscuous mode [ 177.129465][ T7211] loop1: detected capacity change from 0 to 32768 [ 177.170946][ T30] audit: type=1326 audit(1785510552.646:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.405" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefa5d9e019 code=0x7fc00000 [ 177.197359][ T7262] EXT4-fs error (device loop4): dx_make_map:1295: inode #2: block 20: comm syz.4.404: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 177.218917][ T7262] EXT4-fs error (device loop4) in do_split:2027: Corrupt filesystem [ 177.306892][ T6664] veth0_macvtap: entered promiscuous mode [ 177.318766][ T6664] veth1_macvtap: entered promiscuous mode [ 177.438658][ T7211] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 177.458720][ T6664] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 177.565732][ T6664] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.691720][ T5623] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 177.724460][ T48] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.747157][ T7211] XFS (loop1): Ending clean mount [ 177.816334][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.909425][ T80] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.951303][ T80] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.968830][ T7211] XFS (loop1): Quotacheck needed: Please wait. [ 178.286861][ T6842] veth0_vlan: entered promiscuous mode [ 178.294567][ T7211] XFS (loop1): Quotacheck: Done. [ 178.467591][ T6842] veth1_vlan: entered promiscuous mode [ 178.482224][ T5626] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 178.502411][ T80] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.522503][ T80] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.583955][ T7294] loop3: detected capacity change from 0 to 256 [ 178.674163][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.716401][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.921522][ T6842] veth0_macvtap: entered promiscuous mode [ 178.966155][ T7294] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 178.991737][ T6842] veth1_macvtap: entered promiscuous mode [ 179.003025][ T5766] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 179.013518][ T7294] FAT-fs (loop3): Filesystem has been set read-only [ 179.020254][ T7294] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 179.063203][ T7294] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 179.110823][ T6842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 179.131659][ T30] audit: type=1800 audit(1785510554.756:58): pid=7294 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.413" name="file1" dev="loop3" ino=1048620 res=0 errno=0 [ 179.196670][ T6842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 179.243182][ T5766] usb 5-1: Using ep0 maxpacket: 16 [ 179.269132][ T5766] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 179.296125][ T5766] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 179.323912][ T5766] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 179.364261][ T75] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.389125][ T5766] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 179.448887][ T5766] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.535853][ T75] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.569046][ T5766] usb 5-1: config 0 descriptor?? [ 179.585567][ T693] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.616062][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.002610][ T80] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.029914][ T80] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.046914][ T7323] netlink: 8 bytes leftover after parsing attributes in process `syz.5.418'. [ 180.065066][ T5766] hid-multitouch 0003:0457:07DA.0004: unknown main item tag 0x0 [ 180.087182][ T5766] hid-multitouch 0003:0457:07DA.0004: unknown main item tag 0x0 [ 180.098213][ T7324] netlink: 60 bytes leftover after parsing attributes in process `syz.5.418'. [ 180.142558][ T5766] hid-multitouch 0003:0457:07DA.0004: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.4-1/input0 [ 180.234520][ T7324] netlink: 16 bytes leftover after parsing attributes in process `syz.5.418'. [ 180.289628][ T5766] usb 5-1: USB disconnect, device number 7 [ 180.329165][ T80] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.356280][ T7328] fido_id[7328]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 180.385425][ T80] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.749359][ T7333] loop5: detected capacity change from 0 to 16 [ 180.781532][ T7333] erofs (device loop5): mounted with root inode @ nid 36. [ 180.829517][ T10] IPVS: starting estimator thread 0... [ 180.886539][ T7336] IPVS: fo: FWM 3 0x00000003 - no destination available [ 180.919791][ C0] IPVS: fo: FWM 3 0x00000003 - no destination available [ 180.943692][ T7337] IPVS: using max 22 ests per chain, 52800 per kthread [ 181.714451][ T7350] loop3: detected capacity change from 0 to 40427 [ 181.736079][ T7350] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 181.743915][ T7350] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 181.872518][ T7350] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 181.888110][ T7350] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 181.900760][ T7350] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 182.564789][ T7380] loop1: detected capacity change from 0 to 256 [ 182.728594][ T7380] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 182.787071][ T7380] FAT-fs (loop1): Filesystem has been set read-only [ 182.829690][ T7380] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 182.886972][ T7380] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 182.946345][ T30] audit: type=1800 audit(1785510558.576:59): pid=7380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.433" name="file1" dev="loop1" ino=1048631 res=0 errno=0 [ 183.050189][ T7350] syz.3.424: attempt to access beyond end of device [ 183.050189][ T7350] loop3: rw=2049, sector=45096, nr_sectors = 8152 limit=40427 [ 183.072014][ T7350] syz.3.424: attempt to access beyond end of device [ 183.072014][ T7350] loop3: rw=2049, sector=45056, nr_sectors = 8 limit=40427 [ 183.098013][ T7389] netlink: 8 bytes leftover after parsing attributes in process `syz.4.435'. [ 183.185940][ T7389] netlink: 4 bytes leftover after parsing attributes in process `syz.4.435'. [ 183.208198][ T7350] syz.3.424: attempt to access beyond end of device [ 183.208198][ T7350] loop3: rw=2049, sector=57344, nr_sectors = 16384 limit=40427 [ 183.241280][ T7350] syz.3.424: attempt to access beyond end of device [ 183.241280][ T7350] loop3: rw=2049, sector=73728, nr_sectors = 8 limit=40427 [ 183.255343][ T7350] syz.3.424: attempt to access beyond end of device [ 183.255343][ T7350] loop3: rw=2049, sector=73736, nr_sectors = 8 limit=40427 [ 183.269499][ T7350] syz.3.424: attempt to access beyond end of device [ 183.269499][ T7350] loop3: rw=2049, sector=73744, nr_sectors = 8 limit=40427 [ 183.283845][ T7350] syz.3.424: attempt to access beyond end of device [ 183.283845][ T7350] loop3: rw=2049, sector=73752, nr_sectors = 8 limit=40427 [ 183.300137][ T7350] syz.3.424: attempt to access beyond end of device [ 183.300137][ T7350] loop3: rw=2049, sector=73760, nr_sectors = 8 limit=40427 [ 183.314290][ T7350] syz.3.424: attempt to access beyond end of device [ 183.314290][ T7350] loop3: rw=2049, sector=73768, nr_sectors = 8 limit=40427 [ 183.328293][ T7350] syz.3.424: attempt to access beyond end of device [ 183.328293][ T7350] loop3: rw=2049, sector=73776, nr_sectors = 8 limit=40427 [ 183.371061][ T7389] netlink: 8 bytes leftover after parsing attributes in process `syz.4.435'. [ 183.380186][ T693] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.422009][ T693] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.440541][ T7389] netlink: 4 bytes leftover after parsing attributes in process `syz.4.435'. [ 183.510680][ T693] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.582552][ T5766] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 183.617272][ T693] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.827550][ T5766] usb 8-1: Using ep0 maxpacket: 16 [ 183.878877][ T5766] usb 8-1: config 0 has an invalid interface number: 34 but max is 0 [ 183.898451][ T5624] CPU: 0 UID: 0 PID: 5624 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 183.898502][ T5624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 183.898524][ T5624] Call Trace: [ 183.898536][ T5624] [ 183.898550][ T5624] dump_stack_lvl+0x100/0x190 [ 183.898604][ T5624] f2fs_stop_checkpoint+0x5e6/0xb30 [ 183.898668][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.898715][ T5624] ? errseq_set+0xe3/0x150 [ 183.898774][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.898829][ T5624] f2fs_write_end_bio+0xf53/0x1340 [ 183.898875][ T5624] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 183.898922][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.898978][ T5624] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 183.899018][ T5624] bio_endio+0x778/0x8e0 [ 183.899066][ T5624] submit_bio_noacct+0x64c/0x1ff0 [ 183.899139][ T5624] f2fs_submit_write_bio+0x133/0x330 [ 183.899203][ T5624] __submit_merged_bio+0x330/0x7b0 [ 183.899242][ T5624] ? rcu_is_watching+0x12/0xc0 [ 183.899305][ T5624] __submit_merged_write_cond+0x3fe/0x510 [ 183.899356][ T5624] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 183.899410][ T5624] ? __pfx___might_resched+0x10/0x10 [ 183.899452][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.899502][ T5624] ? folio_clear_dirty_for_io+0x178/0x960 [ 183.899577][ T5624] f2fs_sync_node_pages+0x13c6/0x1690 [ 183.899654][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.899707][ T5624] ? __pfx_f2fs_sync_node_pages+0x10/0x10 [ 183.899770][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.899816][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.899863][ T5624] ? __lock_acquire+0xc91/0x1a40 [ 183.899947][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.899995][ T5624] ? down_write+0x146/0x1f0 [ 183.900052][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.900101][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.900147][ T5624] ? up_write+0x2e5/0x5c0 [ 183.900202][ T5624] block_operations+0x932/0xfc0 [ 183.900264][ T5624] ? __pfx_block_operations+0x10/0x10 [ 183.900368][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.900417][ T5624] ? ktime_get+0x22c/0x320 [ 183.900460][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.900506][ T5624] ? rcu_is_watching+0x12/0xc0 [ 183.900580][ T5624] f2fs_write_checkpoint+0x58b/0x53d0 [ 183.900635][ T5624] ? _raw_spin_unlock_irq+0x23/0x50 [ 183.900682][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.900729][ T5624] ? _raw_spin_unlock_irq+0x2e/0x50 [ 183.900768][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.900813][ T5624] ? __wait_for_common+0x1f3/0x4c0 [ 183.900858][ T5624] ? __pfx_schedule_timeout+0x10/0x10 [ 183.900902][ T5624] ? __pfx___wait_for_common+0x10/0x10 [ 183.900952][ T5624] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 183.901002][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901059][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901099][ T5624] ? rcu_is_watching+0x12/0xc0 [ 183.901152][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901198][ T5624] ? kthread_stop+0x280/0x630 [ 183.901255][ T5624] kill_f2fs_super+0x3f1/0x4a0 [ 183.901304][ T5624] ? __pfx_kill_f2fs_super+0x10/0x10 [ 183.901375][ T5624] ? lockdep_hardirqs_on+0x78/0x100 [ 183.901423][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901471][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901532][ T5624] deactivate_locked_super+0xc1/0x1b0 [ 183.901587][ T5624] deactivate_super+0xe7/0x110 [ 183.901633][ T5624] cleanup_mnt+0x21f/0x450 [ 183.901688][ T5624] task_work_run+0x150/0x240 [ 183.901728][ T5624] ? __pfx_task_work_run+0x10/0x10 [ 183.901769][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901822][ T5624] exit_to_user_mode_loop+0x1d8/0x6f0 [ 183.901868][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 183.901912][ T5624] ? rcu_is_watching+0x12/0xc0 [ 183.901971][ T5624] do_syscall_64+0x666/0x870 [ 183.902029][ T5624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.902069][ T5624] RIP: 0033:0x7fefa5d9f257 [ 183.902100][ T5624] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 183.902137][ T5624] RSP: 002b:00007ffdedba8878 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 183.902174][ T5624] RAX: 0000000000000000 RBX: 00007fefa5e3445c RCX: 00007fefa5d9f257 [ 183.902198][ T5624] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdedba8930 [ 183.902221][ T5624] RBP: 00007ffdedba8930 R08: 00007ffdedba9930 R09: 00000000ffffffff [ 183.902245][ T5624] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdedba99c0 [ 183.902269][ T5624] R13: 00007fefa5e3445c R14: 000000000002ca65 R15: 00007ffdedba9a00 [ 183.902319][ T5624] [ 184.392278][ T5766] usb 8-1: config 0 has no interface number 0 [ 184.398523][ T5766] usb 8-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 184.408605][ T5766] usb 8-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 184.444079][ T5624] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 184.543757][ T5766] usb 8-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 184.552909][ T5766] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.562433][ T5766] usb 8-1: Product: syz [ 184.566609][ T5766] usb 8-1: Manufacturer: syz [ 184.571209][ T5766] usb 8-1: SerialNumber: syz [ 184.593766][ T5766] usb 8-1: config 0 descriptor?? [ 184.600639][ T7393] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 184.661274][ T7393] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 184.953998][ T7393] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 184.995075][ T7393] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 185.227586][ T5766] asix 8-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 185.271660][ T7414] netlink: 4 bytes leftover after parsing attributes in process `syz.5.444'. [ 185.384655][ T7417] loop6: detected capacity change from 0 to 16 [ 185.463133][ T7417] erofs (device loop6): mounted with root inode @ nid 36. [ 186.033000][ T5766] asix 8-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 186.070405][ T5766] asix 8-1:0.34: probe with driver asix failed with error -71 [ 186.150536][ T5766] usb 8-1: USB disconnect, device number 2 [ 186.806596][ T7443] loop4: detected capacity change from 0 to 64 [ 186.860100][ T7443] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 186.889285][ T7441] loop1: detected capacity change from 0 to 2048 [ 186.982153][ T7441] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 187.112187][ T5284] 8021q: adding VLAN 0 to HW filter on device eth5 [ 187.421220][ T7441] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 187.552287][ T7441] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 11 with max blocks 242 with error 28 [ 187.625501][ T7441] EXT4-fs (loop1): This should not happen!! Data will be lost [ 187.625501][ T7441] [ 187.695360][ T7441] EXT4-fs (loop1): Total free blocks count 0 [ 187.704049][ T10] IPVS: starting estimator thread 0... [ 187.739934][ T7441] EXT4-fs (loop1): Free/Dirty block details [ 187.760944][ T7441] EXT4-fs (loop1): free_blocks=4096 [ 187.780850][ T7469] IPVS: fo: FWM 3 0x00000003 - no destination available [ 187.819387][ T7441] EXT4-fs (loop1): dirty_blocks=256 [ 187.838646][ C1] IPVS: fo: FWM 3 0x00000003 - no destination available [ 187.854430][ T7441] EXT4-fs (loop1): Block reservation details [ 187.858911][ T7467] IPVS: using max 23 ests per chain, 55200 per kthread [ 187.874562][ T7441] EXT4-fs (loop1): i_reserved_data_blocks=16 [ 188.058353][ T1119] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 188.109120][ T5626] EXT4-fs warning (device loop1): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 188.278326][ T7482] netlink: 8 bytes leftover after parsing attributes in process `syz.4.460'. [ 188.344462][ T7482] netlink: 60 bytes leftover after parsing attributes in process `syz.4.460'. [ 188.389057][ T7482] netlink: 16 bytes leftover after parsing attributes in process `syz.4.460'. [ 189.847779][ T7516] loop4: detected capacity change from 0 to 4096 [ 189.872750][ T5284] 8021q: adding VLAN 0 to HW filter on device eth6 [ 189.906046][ T7516] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 190.140241][ T7516] ntfs3(loop4): ino=19, mi_enum_attr [ 190.172128][ T7516] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 190.233239][ T7516] ntfs3(loop4): ino=1a, mi_enum_attr [ 190.257780][ T7516] ntfs3(loop4): ino=1a, mi_enum_attr [ 190.282065][ T7516] ntfs3(loop4): Failed to initialize $Extend/$Reparse. [ 190.478215][ T7516] ntfs3(loop4): ino=5, "/" ntfs_readdir [ 190.883137][ T7512] loop7: detected capacity change from 0 to 32768 [ 190.947190][ T7512] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 (7:7) scanned by syz.7.468 (7512) [ 191.194340][ T7512] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 191.230049][ T7542] loop4: detected capacity change from 0 to 2048 [ 191.257650][ T7512] BTRFS info (device loop7): using sha256 checksum algorithm [ 191.309979][ T7542] UDF-fs: error (device loop4): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 191.389727][ T7542] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 191.463214][ T7542] UDF-fs: Scanning with blocksize 512 failed [ 191.587895][ T7542] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 191.720814][ T30] audit: type=1800 audit(1785510567.346:60): pid=7542 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.479" name="file1" dev="loop4" ino=838 res=0 errno=0 [ 191.766981][ T7512] BTRFS info (device loop7): enabling ssd optimizations [ 191.822754][ T7512] BTRFS info (device loop7): turning on async discard [ 191.877546][ T7512] BTRFS info (device loop7): enabling free space tree [ 192.242601][ T6842] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 192.362073][ T5758] IPVS: starting estimator thread 0... [ 192.482598][ T7578] IPVS: using max 22 ests per chain, 52800 per kthread [ 192.949785][ T5284] 8021q: adding VLAN 0 to HW filter on device eth7 [ 193.252320][ T7599] loop1: detected capacity change from 0 to 512 [ 193.604852][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.273328][ T7610] loop3: detected capacity change from 0 to 4096 [ 194.432001][ T7622] loop7: detected capacity change from 0 to 2048 [ 194.479047][ T7622] UDF-fs: error (device loop7): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 194.543349][ T7622] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 194.578514][ T7624] loop6: detected capacity change from 0 to 2048 [ 194.585778][ T7622] UDF-fs: Scanning with blocksize 512 failed [ 194.664733][ T7622] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 194.818009][ T30] audit: type=1800 audit(1785510570.446:61): pid=7622 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.498" name="file1" dev="loop7" ino=838 res=0 errno=0 [ 194.883658][ T7624] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 194.904812][ T7629] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 195.820168][ T7642] netlink: 'syz.5.502': attribute type 10 has an invalid length. [ 195.887599][ T7642] syz_tun: entered promiscuous mode [ 195.962194][ T7642] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 196.171326][ T5284] 8021q: adding VLAN 0 to HW filter on device eth8 [ 197.786459][ T7654] loop5: detected capacity change from 0 to 131072 [ 197.799901][ T7654] F2FS-fs (loop5): Wrong CP boundary, start(512) end(1536) blocks(0) [ 197.808067][ T7654] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 197.826038][ T7654] F2FS-fs (loop5): invalid crc value [ 197.920766][ T7654] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 197.947305][ T7654] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 197.954438][ T7654] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 198.501800][ T7678] loop4: detected capacity change from 0 to 40427 [ 198.521105][ T7678] F2FS-fs (loop4): Image doesn't support compression [ 198.528943][ T7678] F2FS-fs (loop4): build fault injection rate: 690 [ 198.547095][ T7678] F2FS-fs (loop4): invalid crc value [ 198.694695][ T7678] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 198.722516][ T7678] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 198.935387][ T30] audit: type=1800 audit(1785510574.556:62): pid=7678 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.511" name="file1" dev="loop4" ino=10 res=0 errno=0 [ 199.504705][ T5623] bio_check_eod: 1004 callbacks suppressed [ 199.504731][ T5623] syz-executor: attempt to access beyond end of device [ 199.504731][ T5623] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 199.633773][ T5623] CPU: 0 UID: 0 PID: 5623 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 199.633823][ T5623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 199.633846][ T5623] Call Trace: [ 199.633857][ T5623] [ 199.633872][ T5623] dump_stack_lvl+0x100/0x190 [ 199.633920][ T5623] f2fs_stop_checkpoint+0x5e6/0xb30 [ 199.633985][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.634033][ T5623] ? errseq_set+0xe3/0x150 [ 199.634091][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.634148][ T5623] f2fs_write_end_bio+0xf53/0x1340 [ 199.634192][ T5623] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 199.634228][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.634273][ T5623] ? rcu_preempt_deferred_qs_irqrestore+0x4fd/0xb90 [ 199.634328][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.634388][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.634436][ T5623] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 199.634476][ T5623] bio_endio+0x778/0x8e0 [ 199.634525][ T5623] submit_bio_noacct+0x64c/0x1ff0 [ 199.634603][ T5623] f2fs_submit_write_bio+0x133/0x330 [ 199.634669][ T5623] __submit_merged_bio+0x330/0x7b0 [ 199.634708][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.634770][ T5623] __submit_merged_write_cond+0x3fe/0x510 [ 199.634820][ T5623] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 199.634871][ T5623] ? __pfx___might_resched+0x10/0x10 [ 199.634913][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.634959][ T5623] ? folio_clear_dirty_for_io+0x178/0x960 [ 199.635028][ T5623] f2fs_write_cache_pages+0x20e9/0x2630 [ 199.635098][ T5623] ? __bfs+0xef/0x2a0 [ 199.635158][ T5623] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 199.635206][ T5623] ? is_bpf_text_address+0x8a/0x1a0 [ 199.635250][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635296][ T5623] ? __kasan_check_byte+0x13/0x50 [ 199.635337][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635384][ T5623] ? unwind_next_frame+0x3be/0x2090 [ 199.635445][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.635499][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635548][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635600][ T5623] ? __kasan_check_byte+0x13/0x50 [ 199.635639][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635702][ T5623] ? is_bpf_text_address+0x94/0x1a0 [ 199.635744][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635790][ T5623] ? kernel_text_address+0x8d/0x100 [ 199.635894][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.635942][ T5623] ? check_prev_add+0x354/0xe60 [ 199.635984][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.636031][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.636094][ T5623] f2fs_write_data_pages+0x799/0x16d0 [ 199.636158][ T5623] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 199.636218][ T5623] ? do_writepages+0x4b5/0x600 [ 199.636281][ T5623] ? do_writepages+0x4b5/0x600 [ 199.636341][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.636392][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.636440][ T5623] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 199.636494][ T5623] do_writepages+0x278/0x600 [ 199.636568][ T5623] ? __pfx_do_writepages+0x10/0x10 [ 199.636635][ T5623] ? do_raw_spin_unlock+0x145/0x1e0 [ 199.636689][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.636737][ T5623] ? _raw_spin_unlock+0x28/0x50 [ 199.636784][ T5623] filemap_writeback+0x22d/0x2e0 [ 199.636825][ T5623] ? __pfx_filemap_writeback+0x10/0x10 [ 199.636890][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.636991][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.637039][ T5623] ? find_held_lock+0x2b/0x80 [ 199.637096][ T5623] ? f2fs_sync_dirty_inodes+0x3a7/0x970 [ 199.637147][ T5623] ? f2fs_sync_dirty_inodes+0x3a7/0x970 [ 199.637196][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.637255][ T5623] f2fs_sync_dirty_inodes+0x46a/0x970 [ 199.637324][ T5623] block_operations+0x2a6/0xfc0 [ 199.637385][ T5623] ? __pfx_block_operations+0x10/0x10 [ 199.637490][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.637540][ T5623] ? ktime_get+0x22c/0x320 [ 199.637583][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.637635][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.637698][ T5623] f2fs_write_checkpoint+0x58b/0x53d0 [ 199.637777][ T5623] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 199.637839][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.637886][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.637940][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.637987][ T5623] ? kthread_stop+0x280/0x630 [ 199.638050][ T5623] kill_f2fs_super+0x3f1/0x4a0 [ 199.638100][ T5623] ? __pfx_kill_f2fs_super+0x10/0x10 [ 199.638170][ T5623] ? lockdep_hardirqs_on+0x78/0x100 [ 199.638219][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.638266][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.638329][ T5623] deactivate_locked_super+0xc1/0x1b0 [ 199.638378][ T5623] deactivate_super+0xe7/0x110 [ 199.638427][ T5623] cleanup_mnt+0x21f/0x450 [ 199.638486][ T5623] task_work_run+0x150/0x240 [ 199.638525][ T5623] ? __pfx_task_work_run+0x10/0x10 [ 199.638568][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.638630][ T5623] exit_to_user_mode_loop+0x1d8/0x6f0 [ 199.638677][ T5623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 199.638721][ T5623] ? rcu_is_watching+0x12/0xc0 [ 199.638779][ T5623] do_syscall_64+0x666/0x870 [ 199.638835][ T5623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.638874][ T5623] RIP: 0033:0x7fdf1ef9f257 [ 199.638903][ T5623] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 199.638940][ T5623] RSP: 002b:00007fffbcdfa328 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 199.638977][ T5623] RAX: 0000000000000000 RBX: 00007fdf1f03445c RCX: 00007fdf1ef9f257 [ 199.639001][ T5623] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffbcdfa3e0 [ 199.639025][ T5623] RBP: 00007fffbcdfa3e0 R08: 00007fffbcdfb3e0 R09: 00000000ffffffff [ 199.639050][ T5623] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffbcdfb470 [ 199.639074][ T5623] R13: 00007fdf1f03445c R14: 0000000000030a55 R15: 00007fffbcdfb4b0 [ 199.639124][ T5623] [ 200.225431][ T5623] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 200.321762][ T7696] loop7: detected capacity change from 0 to 2048 [ 200.535509][ T7698] loop1: detected capacity change from 0 to 2048 [ 200.621861][ T7698] UDF-fs: error (device loop1): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 200.736228][ T7698] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 200.784747][ T7698] UDF-fs: Scanning with blocksize 512 failed [ 200.867927][ T7696] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 200.930235][ T7698] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 201.106082][ T7696] EXT4-fs error (device loop7): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 201.136754][ T30] audit: type=1800 audit(1785510576.766:63): pid=7698 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.515" name="file1" dev="loop1" ino=838 res=0 errno=0 [ 201.254015][ T7696] EXT4-fs (loop7): Delayed block allocation failed for inode 16 at logical offset 16 with max blocks 17 with error 28 [ 201.365642][ T7696] EXT4-fs (loop7): This should not happen!! Data will be lost [ 201.365642][ T7696] [ 201.444671][ T7696] EXT4-fs (loop7): Total free blocks count 0 [ 201.476687][ T7696] EXT4-fs (loop7): Free/Dirty block details [ 201.504365][ T7696] EXT4-fs (loop7): free_blocks=4096 [ 201.532367][ T7696] EXT4-fs (loop7): dirty_blocks=32 [ 201.555181][ T7696] EXT4-fs (loop7): Block reservation details [ 201.585005][ T7696] EXT4-fs (loop7): i_reserved_data_blocks=2 [ 201.621212][ T7707] EXT4-fs (loop7): Delayed block allocation failed for inode 16 at logical offset 16 with max blocks 16 with error 28 [ 201.980954][ T6842] EXT4-fs warning (device loop7): ext4_evict_inode:195: inode #16: comm syz-executor: data will be lost [ 202.278503][ T7713] netlink: 'syz.6.519': attribute type 1 has an invalid length. [ 202.344726][ T7713] netlink: 'syz.6.519': attribute type 2 has an invalid length. [ 202.392214][ T7713] netlink: 240 bytes leftover after parsing attributes in process `syz.6.519'. [ 203.389286][ T7734] netlink: 8 bytes leftover after parsing attributes in process `syz.7.525'. [ 203.486211][ T7734] netlink: 'syz.7.525': attribute type 9 has an invalid length. [ 203.814158][ T1119] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.876154][ T1119] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.953804][ T1119] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.964052][ T7723] loop5: detected capacity change from 0 to 131072 [ 203.988343][ T7723] F2FS-fs (loop5): invalid crc value [ 204.025756][ T75] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 204.096587][ T7723] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 204.111267][ T7723] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 204.288924][ T30] audit: type=1800 audit(1785510579.916:64): pid=7723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.521" name="bus" dev="loop5" ino=10 res=0 errno=0 [ 204.336456][ T7749] loop6: detected capacity change from 0 to 512 [ 204.380690][ T7749] EXT4-fs (loop6): orphan cleanup on readonly fs [ 204.406568][ T7749] EXT4-fs warning (device loop6): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 204.445291][ T7749] EXT4-fs (loop6): Cannot turn on quotas: error -22 [ 204.500028][ T7749] EXT4-fs error (device loop6): ext4_ext_check_inode:521: inode #13: comm syz.6.531: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 204.606236][ T7749] loop6: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 204.606839][ T7749] EXT4-fs error (device loop6): ext4_orphan_get:1402: comm syz.6.531: couldn't read orphan inode 13 (err -117) [ 204.616092][ C1] EXT4-fs (loop6): error count since last fsck: 1 [ 204.616127][ C1] EXT4-fs (loop6): last error at time 1785510580: ext4_ext_check_inode:521: inode 13 [ 204.738610][ T7757] loop1: detected capacity change from 0 to 164 [ 204.796750][ T7749] loop6: lost filesystem error report for type 5 error -117 [ 204.858496][ T7749] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 204.884427][ T7757] rock: corrupted directory entry. extent=32, offset=131072, size=237 [ 205.017581][ T7749] EXT4-fs (loop6): re-mounted 00000000-0000-0000-0000-000000000000. [ 205.070228][ T7749] EXT4-fs (loop6): warning: mounting fs with errors, running e2fsck is recommended [ 205.177708][ T7749] EXT4-fs warning (device loop6): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 205.621570][ T6308] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.204152][ T7808] loop3: detected capacity change from 0 to 512 [ 208.299166][ T7793] loop5: detected capacity change from 0 to 32768 [ 208.336043][ T7793] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.549 (7793) [ 208.415356][ T7808] EXT4-fs (loop3): orphan cleanup on readonly fs [ 208.462224][ T7793] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 208.544806][ T7793] BTRFS info (device loop5): using sha256 checksum algorithm [ 208.565411][ T7808] EXT4-fs warning (device loop3): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 208.781737][ T7793] BTRFS info (device loop5): enabling ssd optimizations [ 208.803709][ T7808] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 208.817698][ T7793] BTRFS info (device loop5): turning on async discard [ 208.849533][ T7793] BTRFS info (device loop5): enabling free space tree [ 208.858724][ T7808] EXT4-fs error (device loop3): ext4_ext_check_inode:521: inode #13: comm syz.3.555: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 209.043582][ T7808] loop3: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 209.050647][ T7808] EXT4-fs error (device loop3): ext4_orphan_get:1402: comm syz.3.555: couldn't read orphan inode 13 (err -117) [ 209.059928][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 209.059961][ C1] EXT4-fs (loop3): last error at time 1785510584: ext4_ext_check_inode:521: inode 13 [ 209.121514][ T7808] loop3: lost filesystem error report for type 5 error -117 [ 209.145725][ T7808] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 209.291392][ T6664] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 209.402070][ T7808] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 209.523298][ T7836] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 209.664526][ T7836] EXT4-fs warning (device loop3): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 210.167344][ T5624] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 211.394670][ T7866] syz_tun: entered allmulticast mode [ 211.451574][ T7866] pim6reg: entered allmulticast mode [ 211.479622][ T7871] pim6reg: left allmulticast mode [ 211.507068][ T7871] syz_tun: left allmulticast mode [ 212.083357][ T30] audit: type=1326 audit(1785510587.706:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7883 comm="syz.5.566" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09a599e019 code=0x0 [ 212.811257][ T80] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 212.870811][ T80] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 213.339258][ T80] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 213.376057][ T80] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 213.751352][ T80] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 213.854297][ T80] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 213.969589][ T5645] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 213.985940][ T5645] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 213.996461][ T5645] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 214.008416][ T5645] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 214.026337][ T5645] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 214.326734][ T80] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 214.381537][ T80] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.485886][ T7928] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 214.586281][ T7928] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 214.982729][ T7884] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 215.245200][ T7941] loop3: detected capacity change from 0 to 512 [ 215.290872][ T7941] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 215.526126][ T7941] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 215.617402][ T7941] ext4 filesystem being mounted at /92/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 215.838688][ T80] bridge_slave_1: left allmulticast mode [ 215.872916][ T80] bridge_slave_1: left promiscuous mode [ 215.906764][ T80] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.966721][ T80] bridge_slave_0: left allmulticast mode [ 215.987625][ T80] bridge_slave_0: left promiscuous mode [ 216.018532][ T80] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.082620][ T5628] Bluetooth: hci4: command tx timeout [ 216.141407][ T5624] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.186889][ T5635] Bluetooth: hci3: command 0x0406 tx timeout [ 216.193365][ T5628] Bluetooth: hci0: command 0x0406 tx timeout [ 216.829953][ T80]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 216.870103][ T80]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 216.921498][ T80]  (unregistering): Released all slaves [ 217.096316][ T7982] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 218.014423][ T8002] capability: warning: `syz.6.593' uses deprecated v2 capabilities in a way that may be insecure [ 218.115851][ T8006] loop5: detected capacity change from 0 to 128 [ 218.165693][ T5644] Bluetooth: hci4: command tx timeout [ 218.169421][ T8009] loop7: detected capacity change from 0 to 64 [ 218.227161][ T8006] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 218.360173][ T8006] ext4 filesystem being mounted at /36/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 218.430828][ T8009] hfs: unable to locate alternate MDB [ 218.459383][ T8009] hfs: continuing without an alternate MDB [ 218.525886][ T80] hsr_slave_0: left promiscuous mode [ 218.660145][ T80] hsr_slave_1: left promiscuous mode [ 218.683492][ T80] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 218.711334][ T80] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 218.746528][ T80] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 218.794582][ T80] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.860448][ T80] veth1_macvtap: left promiscuous mode [ 218.890574][ T80] veth0_macvtap: left promiscuous mode [ 218.900917][ T8022] loop3: detected capacity change from 0 to 512 [ 218.903030][ T80] veth1_vlan: left promiscuous mode [ 218.931325][ T6664] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 218.935577][ T80] veth0_vlan: left promiscuous mode [ 219.082297][ T8022] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 219.419779][ T5624] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.622949][ T10] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 219.840413][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 219.879126][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.906689][ T10] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 219.960928][ T10] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 219.972505][ T30] audit: type=1800 audit(1785510595.596:66): pid=8042 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.604" name="midi1_first_group" dev="configfs" ino=16770 res=0 errno=0 [ 220.020640][ T5623] svc: failed to register nfsdv3 RPC service (errno 111). [ 220.041993][ T5623] svc: failed to register nfsaclv3 RPC service (errno 111). [ 220.052644][ T10] usb 6-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 220.068893][ T5623] failed to unregister tcp with rpcbind [ 220.080405][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.095037][ T5623] svc: failed to register nfsdv3 RPC service (errno 97). [ 220.114423][ T10] usb 6-1: Product: syz [ 220.121603][ T5623] svc: failed to register nfsaclv3 RPC service (errno 97). [ 220.130978][ T10] usb 6-1: Manufacturer: syz [ 220.148701][ T10] usb 6-1: SerialNumber: syz [ 220.155803][ T5623] failed to unregister tcp with rpcbind [ 220.243162][ T5644] Bluetooth: hci4: command tx timeout [ 220.449412][ T5645] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 220.464624][ T5645] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 220.477376][ T5645] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 220.490673][ T5645] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 220.502741][ T5645] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 220.629354][ T10] usb 6-1: 2:1 : no or invalid class specific endpoint descriptor [ 220.629735][ T80] team0 (unregistering): Port device team_slave_1 removed [ 220.678217][ T10] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 220.715315][ T10] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 220.779406][ T80] team0 (unregistering): Port device team_slave_0 removed [ 221.027020][ T10] usb 6-1: 2:1 : no or invalid class specific endpoint descriptor [ 221.068969][ T10] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 221.100232][ T10] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 221.243964][ T10] usb 6-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 221.613555][ T10] usb 6-1: USB disconnect, device number 3 [ 221.866376][ T5284] 8021q: adding VLAN 0 to HW filter on device eth9 [ 221.910103][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 222.335842][ T5644] Bluetooth: hci4: command tx timeout [ 222.456550][ T8083] netlink: 52 bytes leftover after parsing attributes in process `syz.7.616'. [ 222.562454][ T5644] Bluetooth: hci5: command tx timeout [ 222.577066][ T8088] netlink: 4 bytes leftover after parsing attributes in process `syz.7.616'. [ 222.836256][ T8061] loop3: detected capacity change from 0 to 32768 [ 222.889271][ T8061] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.609 (8061) [ 223.065963][ T8061] BTRFS info (device loop3): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 223.134354][ T8061] BTRFS info (device loop3): using blake2b checksum algorithm [ 223.332774][ T8061] BTRFS info (device loop3): enabling ssd optimizations [ 223.381540][ T8061] BTRFS info (device loop3): turning on async discard [ 223.412772][ T8061] BTRFS info (device loop3): enabling free space tree [ 223.440782][ T8061] BTRFS info (device loop3): use lzo compression, level 1 [ 223.511448][ T80] IPVS: stop unused estimator thread 0... [ 223.930056][ T8133] loop7: detected capacity change from 0 to 256 [ 224.302639][ T5758] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 224.513009][ T5624] BTRFS info (device loop3): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 224.559962][ T5758] usb 8-1: config 0 interface 0 has no altsetting 0 [ 224.608413][ T5758] usb 8-1: New USB device found, idVendor=056a, idProduct=00de, bcdDevice= 0.00 [ 224.673202][ T5644] Bluetooth: hci5: command tx timeout [ 224.687021][ T5758] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.716137][ T8138] loop6: detected capacity change from 0 to 65536 [ 224.786122][ T5758] usb 8-1: config 0 descriptor?? [ 224.839708][ T8138] XFS (loop6): Mounting V5 Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 224.921400][ T80] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 224.923694][ T8138] XFS (loop6): Ending clean mount [ 224.933069][ T80] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.966299][ T8138] XFS (loop6): Quotacheck needed: Please wait. [ 225.171325][ T8138] XFS (loop6): Quotacheck: Done. [ 225.226137][ T5284] 8021q: adding VLAN 0 to HW filter on device eth10 [ 225.276709][ T8157] netlink: 'syz.3.627': attribute type 11 has an invalid length. [ 225.305518][ T7915] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.322610][ T7915] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.344757][ T7915] bridge_slave_0: entered allmulticast mode [ 225.392077][ T5758] wacom 0003:056A:00DE.0005: ignoring exceeding usage max [ 225.420752][ T7915] bridge_slave_0: entered promiscuous mode [ 225.445944][ T5758] wacom 0003:056A:00DE.0005: ignoring exceeding usage max [ 225.478991][ T7915] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.495422][ T5758] wacom 0003:056A:00DE.0005: unknown main item tag 0x5 [ 225.508211][ T7915] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.532694][ T7915] bridge_slave_1: entered allmulticast mode [ 225.538722][ T5758] wacom 0003:056A:00DE.0005: collection stack underflow [ 225.544823][ T7915] bridge_slave_1: entered promiscuous mode [ 225.569212][ T5758] wacom 0003:056A:00DE.0005: item 0 1 0 12 parsing failed [ 225.625304][ T5758] wacom 0003:056A:00DE.0005: parse failed [ 225.653730][ T5758] wacom 0003:056A:00DE.0005: probe with driver wacom failed with error -22 [ 225.709836][ T5758] usb 8-1: USB disconnect, device number 3 [ 225.879451][ T6308] XFS (loop6): Unmounting Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 225.914057][ T80] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.956656][ T80] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.305248][ T7915] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 226.606108][ T80] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 226.664016][ T80] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.722918][ T5644] Bluetooth: hci5: command tx timeout [ 226.760055][ T7915] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 227.056975][ T7915] team0: Port device team_slave_0 added [ 227.118933][ T7915] team0: Port device team_slave_1 added [ 227.255438][ T8181] overlayfs: invalid redirect (./file0/file1/file0) [ 227.376213][ T7915] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 227.404655][ T7915] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.451031][ T7915] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 227.468314][ T7915] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.487825][ T7915] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.618601][ T7915] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 227.799999][ T80] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 227.838973][ T80] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.386615][ T7915] hsr_slave_0: entered promiscuous mode [ 228.431256][ T7915] hsr_slave_1: entered promiscuous mode [ 228.803833][ T5644] Bluetooth: hci5: command tx timeout [ 229.115517][ T5284] 8021q: adding VLAN 0 to HW filter on device eth11 [ 229.271068][ T80] bridge_slave_1: left allmulticast mode [ 229.280752][ T80] bridge_slave_1: left promiscuous mode [ 229.294082][ T80] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.296217][ T8227] loop3: detected capacity change from 0 to 16 [ 229.318532][ T80] bridge_slave_0: left allmulticast mode [ 229.332491][ T80] bridge_slave_0: left promiscuous mode [ 229.338354][ T80] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.386214][ T30] audit: type=1326 audit(1785510605.016:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8229 comm="syz.5.651" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09a599e019 code=0x0 [ 229.418543][ T8227] erofs (device loop3): mounted with root inode @ nid 36. [ 229.928895][ T80] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 229.959838][ T80] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 229.982199][ T80] bond0 (unregistering): Released all slaves [ 230.425472][ T5765] usb 8-1: new full-speed USB device number 4 using dummy_hcd [ 230.528179][ T8049] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.559026][ T8049] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.587904][ T8049] bridge_slave_0: entered allmulticast mode [ 230.612188][ T8049] bridge_slave_0: entered promiscuous mode [ 230.624728][ T5765] usb 8-1: not running at top speed; connect to a high speed hub [ 230.656148][ T5765] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 230.701850][ T5765] usb 8-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 230.742296][ T5765] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.790343][ T5765] garmin_gps 8-1:1.0: Garmin GPS usb/tty converter detected [ 230.802953][ T8049] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.827009][ T8049] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.836663][ T8049] bridge_slave_1: entered allmulticast mode [ 230.845900][ T5765] usb 8-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 230.873398][ T8049] bridge_slave_1: entered promiscuous mode [ 231.113135][ T10] usb 8-1: USB disconnect, device number 4 [ 231.128433][ T8258] netlink: 4 bytes leftover after parsing attributes in process `syz.3.661'. [ 231.785320][ T8269] loop5: detected capacity change from 0 to 512 [ 232.394533][ T8259] loop6: detected capacity change from 0 to 131072 [ 232.398075][ T8269] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 232.404602][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 232.441605][ T10] garmin_gps 8-1:1.0: device disconnected [ 232.454714][ T8259] F2FS-fs (loop6): invalid crc value [ 232.490217][ T8049] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 232.597679][ T8259] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 232.615726][ T8259] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 232.708183][ T80] hsr_slave_0: left promiscuous mode [ 232.749980][ T80] hsr_slave_1: left promiscuous mode [ 232.800657][ T80] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 232.853803][ T80] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 232.900412][ T80] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 232.924429][ T6664] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.939854][ T80] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 233.075484][ T80] veth1_macvtap: left promiscuous mode [ 233.111265][ T80] veth0_macvtap: left promiscuous mode [ 233.144944][ T80] veth1_vlan: left promiscuous mode [ 233.170989][ T80] veth0_vlan: left promiscuous mode [ 234.263413][ T80] team0 (unregistering): Port device team_slave_1 removed [ 234.359995][ T80] team0 (unregistering): Port device team_slave_0 removed [ 234.646684][ T8049] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 234.758447][ T5284] 8021q: adding VLAN 0 to HW filter on device eth12 [ 234.771223][ T8313] loop6: detected capacity change from 0 to 2048 [ 234.771973][ T8306] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.794262][ T8313] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024) [ 234.810436][ T8313] NILFS (loop6): mounting unchecked fs [ 234.860620][ T8313] NILFS (loop6): recovery complete [ 234.867892][ T5631] udevd[5631]: incorrect nilfs2 checksum on /dev/loop6 [ 234.882103][ T8314] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 234.883033][ T8049] team0: Port device team_slave_0 added [ 235.279306][ T8049] team0: Port device team_slave_1 added [ 235.441544][ T8049] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.461191][ T8049] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.520862][ T8049] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.664359][ T8325] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 235.694257][ T8049] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.709234][ T8049] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.800901][ T8049] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 235.948506][ T80] IPVS: stop unused estimator thread 0... [ 236.081151][ T8329] gadgetfs: bound to dummy_udc driver [ 236.315216][ T8049] hsr_slave_0: entered promiscuous mode [ 236.347174][ T24] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 236.368641][ T8049] hsr_slave_1: entered promiscuous mode [ 236.387170][ C1] gadgetfs: connected [ 236.404912][ T8049] debugfs: 'hsr0' already exists in 'hsr' [ 236.410855][ T24] gadgetfs: disconnected [ 236.424813][ T8049] Cannot create hsr debugfs directory [ 236.564443][ C1] gadgetfs: connected [ 236.573696][ T24] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 236.604537][ T24] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 236.624557][ T8327] loop3: detected capacity change from 0 to 40427 [ 236.649832][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.676858][ T8327] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 236.692768][ T8327] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 236.711603][ T8328] gadgetfs: suspended from state 3 [ 236.733523][ T8328] gadgetfs: disconnected [ 236.734442][ T24] usb 1-1: can't set config #1, error -71 [ 236.789654][ T8327] F2FS-fs (loop3): invalid crc value [ 236.834992][ T24] usb 1-1: USB disconnect, device number 2 [ 237.502184][ T8327] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 237.546546][ T8327] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 237.564522][ T8327] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 237.663517][ T30] audit: type=1800 audit(1785510613.286:68): pid=8327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.680" name="bus" dev="loop3" ino=10 res=0 errno=0 [ 237.765133][ T10] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 237.891621][ T5624] syz-executor: attempt to access beyond end of device [ 237.891621][ T5624] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 237.944849][ T5624] CPU: 1 UID: 0 PID: 5624 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 237.944909][ T5624] Tainted: [L]=SOFTLOCKUP [ 237.944926][ T5624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 237.944949][ T5624] Call Trace: [ 237.944960][ T5624] [ 237.944974][ T5624] dump_stack_lvl+0x100/0x190 [ 237.945022][ T5624] f2fs_stop_checkpoint+0x5e6/0xb30 [ 237.945087][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.945134][ T5624] ? errseq_set+0xe3/0x150 [ 237.945192][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.945246][ T5624] f2fs_write_end_bio+0xf53/0x1340 [ 237.945290][ T5624] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 237.945336][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.945392][ T5624] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 237.945431][ T5624] bio_endio+0x778/0x8e0 [ 237.945480][ T5624] submit_bio_noacct+0x64c/0x1ff0 [ 237.945551][ T5624] f2fs_submit_write_bio+0x133/0x330 [ 237.945616][ T5624] __submit_merged_bio+0x330/0x7b0 [ 237.945655][ T5624] ? rcu_is_watching+0x12/0xc0 [ 237.945722][ T5624] __submit_merged_write_cond+0x3fe/0x510 [ 237.945774][ T5624] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 237.945827][ T5624] ? __pfx___might_resched+0x10/0x10 [ 237.945869][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.945915][ T5624] ? folio_clear_dirty_for_io+0x178/0x960 [ 237.945985][ T5624] f2fs_write_cache_pages+0x20e9/0x2630 [ 237.946056][ T5624] ? find_held_lock+0x2b/0x80 [ 237.946114][ T5624] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 237.946161][ T5624] ? is_bpf_text_address+0x8a/0x1a0 [ 237.946214][ T5624] ? __lock_acquire+0x49f/0x1a40 [ 237.946349][ T5624] ? check_noncircular+0x97/0x160 [ 237.946390][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.946437][ T5624] ? rcu_is_watching+0x12/0xc0 [ 237.946498][ T5624] f2fs_write_data_pages+0x799/0x16d0 [ 237.946546][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.946593][ T5624] ? check_prev_add+0xfe/0xe60 [ 237.946643][ T5624] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 237.946716][ T5624] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 237.946770][ T5624] do_writepages+0x278/0x600 [ 237.946838][ T5624] ? __pfx_do_writepages+0x10/0x10 [ 237.946899][ T5624] ? do_raw_spin_unlock+0x145/0x1e0 [ 237.946952][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.946998][ T5624] ? _raw_spin_unlock+0x28/0x50 [ 237.947044][ T5624] filemap_writeback+0x22d/0x2e0 [ 237.947084][ T5624] ? __pfx_filemap_writeback+0x10/0x10 [ 237.947146][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.947244][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.947291][ T5624] ? find_held_lock+0x2b/0x80 [ 237.947347][ T5624] ? f2fs_sync_dirty_inodes+0x3a7/0x970 [ 237.947398][ T5624] ? f2fs_sync_dirty_inodes+0x3a7/0x970 [ 237.947446][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.947505][ T5624] f2fs_sync_dirty_inodes+0x46a/0x970 [ 237.947572][ T5624] block_operations+0x2a6/0xfc0 [ 237.947674][ T5624] ? __pfx_block_operations+0x10/0x10 [ 237.947804][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.947853][ T5624] ? ktime_get+0x22c/0x320 [ 237.947896][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.947943][ T5624] ? rcu_is_watching+0x12/0xc0 [ 237.948004][ T5624] f2fs_write_checkpoint+0x58b/0x53d0 [ 237.948058][ T5624] ? _raw_spin_unlock_irq+0x23/0x50 [ 237.948103][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948150][ T5624] ? _raw_spin_unlock_irq+0x2e/0x50 [ 237.948189][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948235][ T5624] ? __wait_for_common+0x1f3/0x4c0 [ 237.948283][ T5624] ? __pfx_schedule_timeout+0x10/0x10 [ 237.948328][ T5624] ? __pfx___wait_for_common+0x10/0x10 [ 237.948378][ T5624] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 237.948430][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948485][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948532][ T5624] ? rcu_is_watching+0x12/0xc0 [ 237.948585][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948631][ T5624] ? kthread_stop+0x280/0x630 [ 237.948700][ T5624] kill_f2fs_super+0x3f1/0x4a0 [ 237.948750][ T5624] ? __pfx_kill_f2fs_super+0x10/0x10 [ 237.948821][ T5624] ? lockdep_hardirqs_on+0x78/0x100 [ 237.948870][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948917][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.948980][ T5624] deactivate_locked_super+0xc1/0x1b0 [ 237.949029][ T5624] deactivate_super+0xe7/0x110 [ 237.949077][ T5624] cleanup_mnt+0x21f/0x450 [ 237.949135][ T5624] task_work_run+0x150/0x240 [ 237.949174][ T5624] ? __pfx_task_work_run+0x10/0x10 [ 237.949216][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.949271][ T5624] exit_to_user_mode_loop+0x1d8/0x6f0 [ 237.949316][ T5624] ? srso_alias_return_thunk+0x5/0xfbef5 [ 237.949362][ T5624] ? rcu_is_watching+0x12/0xc0 [ 237.949421][ T5624] do_syscall_64+0x666/0x870 [ 237.949476][ T5624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 237.949515][ T5624] RIP: 0033:0x7fefa5d9f257 [ 237.949545][ T5624] Code: a2 c7 05 9c 44 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 237.949584][ T5624] RSP: 002b:00007ffdedba8878 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 237.949620][ T5624] RAX: 0000000000000000 RBX: 00007fefa5e3445c RCX: 00007fefa5d9f257 [ 237.949645][ T5624] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdedba8930 [ 237.949668][ T5624] RBP: 00007ffdedba8930 R08: 00007ffdedba9930 R09: 00000000ffffffff [ 237.949698][ T5624] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdedba99c0 [ 237.949722][ T5624] R13: 00007fefa5e3445c R14: 000000000003a061 R15: 00007ffdedba9a00 [ 237.949772][ T5624] [ 237.994553][ T7915] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 238.001471][ T5624] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 238.521569][ T7915] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 238.659683][ T5284] 8021q: adding VLAN 0 to HW filter on device eth13 [ 238.698485][ T7915] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 238.735694][ T7915] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 238.771168][ T7915] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 238.825018][ T8381] overlayfs: invalid redirect (./file0/file1/file0) [ 238.847966][ T7915] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 238.879149][ T7915] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 238.924497][ T7915] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 239.575683][ T8049] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 239.589712][ T8049] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 239.604281][ T8049] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 239.617710][ T8049] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 239.631763][ T8049] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 239.652664][ T8049] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 239.690811][ T8049] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 239.738917][ T8049] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 239.859273][ T7915] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.964404][ T7915] 8021q: adding VLAN 0 to HW filter on device team0 [ 240.015487][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 240.022698][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 240.134665][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.141889][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 240.566824][ T8049] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.639625][ T8049] 8021q: adding VLAN 0 to HW filter on device team0 [ 240.695345][ T5758] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 240.702151][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 240.710066][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 240.810784][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.818023][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 240.884010][ T5758] usb 7-1: Using ep0 maxpacket: 8 [ 240.914727][ T8445] netlink: 52 bytes leftover after parsing attributes in process `syz.5.709'. [ 240.928882][ T5758] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 240.978186][ T5758] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 240.986549][ T8445] netlink: 4 bytes leftover after parsing attributes in process `syz.5.709'. [ 241.033586][ T5758] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 241.087909][ T5758] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 241.125952][ T5758] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 241.168958][ T5758] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 241.176392][ T5284] 8021q: adding VLAN 0 to HW filter on device eth14 [ 241.229979][ T5758] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.604669][ T5758] usb 7-1: usb_control_msg returned -32 [ 241.626849][ T5758] usbtmc 7-1:16.0: can't read capabilities [ 242.000840][ T8474] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(0) [ 242.698965][ T5766] usb 7-1: USB disconnect, device number 5 [ 242.840914][ T8493] configfs-gadget.g1 gadget.0: USB CDC Phonet function [ 242.883095][ T8493] configfs-gadget.g1 gadget.0: using dummy_udc, OUT ep2out-bulk, IN ep1in-bulk [ 243.184643][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 243.375159][ T10] usb 1-1: Dual-Role OTG device on HNP port [ 243.406433][ T10] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 243.441156][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.523032][ T10] gspca_main: spca501-2.14.0 probing 0000:0000 [ 243.532842][ T8508] netlink: 51 bytes leftover after parsing attributes in process `syz.6.726'. [ 243.560565][ T10] gspca_spca501: reg write: error -32 [ 243.580530][ T10] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 243.630945][ T10] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 243.987403][ T8503] loop5: detected capacity change from 0 to 131072 [ 244.004988][ T8503] F2FS-fs (loop5): Wrong CP boundary, start(512) end(1536) blocks(0) [ 244.013215][ T8503] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 244.026619][ T8503] F2FS-fs (loop5): invalid crc value [ 244.048270][ T5284] 8021q: adding VLAN 0 to HW filter on device eth15 [ 244.144493][ T8503] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 244.148391][ T7915] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 244.190390][ T8503] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 244.197582][ T8503] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 244.227514][ T8520] loop6: detected capacity change from 0 to 1024 [ 244.391650][ T8520] EXT4-fs (loop6): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 244.416017][ T8520] ext4 filesystem being mounted at /85/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 244.473048][ T8520] EXT4-fs error (device loop6): ext4_map_blocks:833: inode #15: comm syz.6.728: lblock 0 mapped to illegal pblock 0 (length 6) [ 244.525150][ T8528] netlink: 'syz.3.729': attribute type 1 has an invalid length. [ 244.537323][ T7915] veth0_vlan: entered promiscuous mode [ 244.547412][ T8520] EXT4-fs (loop6): Remounting filesystem read-only [ 244.759936][ T8528] 8021q: adding VLAN 0 to HW filter on device bond1 [ 244.896251][ T6308] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 244.927839][ T8531] bond1: (slave gretap1): making interface the new active one [ 244.957366][ T8531] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 245.044796][ T8049] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 245.060969][ T7915] veth1_vlan: entered promiscuous mode [ 245.277060][ T7915] veth0_macvtap: entered promiscuous mode [ 245.352256][ T7915] veth1_macvtap: entered promiscuous mode [ 245.449385][ T7915] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 245.500031][ T7915] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 245.743904][ T80] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.908233][ T1177] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.974564][ T1177] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.126392][ T1119] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.129457][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.213747][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.535442][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.592959][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.718606][ T5284] 8021q: adding VLAN 0 to HW filter on device eth16 [ 246.775638][ T8049] veth0_vlan: entered promiscuous mode [ 246.836155][ T8049] veth1_vlan: entered promiscuous mode [ 247.018475][ T8049] veth0_macvtap: entered promiscuous mode [ 247.064602][ T8049] veth1_macvtap: entered promiscuous mode [ 247.138254][ T8049] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 247.192424][ T29] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 247.197980][ T8049] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 247.357706][ T8583] netlink: 20 bytes leftover after parsing attributes in process `syz.3.743'. [ 247.394766][ T29] usb 7-1: not running at top speed; connect to a high speed hub [ 247.395742][ T48] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.423656][ T29] usb 7-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 247.469342][ T29] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.477372][ T48] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.526379][ T48] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.576009][ T29] usb 7-1: Product: syz [ 247.588349][ T29] usb 7-1: Manufacturer: syz [ 247.606021][ T48] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.611022][ T29] usb 7-1: SerialNumber: syz [ 247.692137][ T29] keyspan 7-1:1.0: Keyspan 4 port adapter converter detected [ 247.752358][ T29] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 247.794673][ T29] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 247.820468][ T29] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 247.877708][ T29] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 248.018112][ T8597] netlink: 'syz.7.744': attribute type 18 has an invalid length. [ 248.033534][ T8597] netlink: 4 bytes leftover after parsing attributes in process `syz.7.744'. [ 248.094709][ T8597] netlink: 'syz.7.744': attribute type 18 has an invalid length. [ 248.139857][ T8597] netlink: 4 bytes leftover after parsing attributes in process `syz.7.744'. [ 248.249678][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 248.297354][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 248.675937][ T8606] loop5: detected capacity change from 0 to 1024 [ 248.697399][ T5766] usb 7-1: USB disconnect, device number 6 [ 248.705797][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 248.720767][ T8608] gadgetfs: bound to dummy_udc driver [ 248.751033][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 248.851224][ T5766] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 248.931629][ T5766] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 248.997953][ T5766] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 249.023061][ T5773] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 249.046402][ C0] gadgetfs: connected [ 249.058919][ T5773] gadgetfs: disconnected [ 249.110046][ T5766] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 249.147926][ T5766] keyspan 7-1:1.0: device disconnected [ 249.232901][ C0] gadgetfs: connected [ 249.239720][ T5773] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 249.258562][ T5773] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 249.313491][ T5773] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.374383][ C0] gadgetfs: configuration #1 [ 249.485806][ T8611] gadgetfs: suspended from state 3 [ 249.503823][ T8611] gadgetfs: disconnected [ 249.512003][ T5766] usb 2-1: USB disconnect, device number 3 [ 249.824753][ T8630] loop5: detected capacity change from 0 to 2048 [ 249.957543][ T8630] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.166976][ T8639] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 250.306100][ T8639] EXT4-fs (loop5): Remounting filesystem read-only [ 250.395754][ T8639] EXT4-fs (loop5): error restoring inline_data for inode -- potential data loss! (inode 15, error -30) [ 250.628658][ T6664] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.769124][ T8649] loop7: detected capacity change from 0 to 2048 [ 250.824522][ T8649] NILFS (loop7): broken superblock, retrying with spare superblock (blocksize = 1024) [ 250.909962][ T8649] NILFS (loop7): mounting unchecked fs [ 250.997839][ T8649] NILFS (loop7): recovery complete [ 251.023952][ T6281] udevd[6281]: incorrect nilfs2 checksum on /dev/loop7 [ 251.041923][ T8653] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.061056][ T8660] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 251.701467][ T8672] loop1: detected capacity change from 0 to 128 [ 252.004382][ T5645] Bluetooth: hci2: command 0x0406 tx timeout [ 252.015864][ T8675] Process accounting resumed [ 253.258499][ T8715] 9pnet: p9_errstr2errno: server reported unknown error ÿÿÿ [ 254.007060][ T8742] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 254.072862][ T8745] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 255.044317][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.992999][ T5758] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 257.197425][ T5758] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.271572][ T5758] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 257.329195][ T5758] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 257.368579][ T5758] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.404352][ T5758] usb 8-1: Product: syz [ 257.419471][ T5758] usb 8-1: Manufacturer: syz [ 257.434179][ T5758] usb 8-1: SerialNumber: syz [ 257.449906][ T8828] loop3: detected capacity change from 0 to 2048 [ 257.481476][ T5758] cdc_mbim 8-1:1.0: skipping garbage [ 257.520446][ T8828] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 257.589252][ T8828] NILFS (loop3): mounting unchecked fs [ 257.597578][ T6281] udevd[6281]: incorrect nilfs2 checksum on /dev/loop3 [ 257.705871][ T8828] NILFS (loop3): recovery complete [ 257.711698][ T8814] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 257.749919][ T8833] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 258.371900][ T8814] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 258.403445][ T5758] cdc_mbim 8-1:1.0: setting tx_max = 16384 [ 258.454586][ T5758] cdc_mbim 8-1:1.0: cdc-wdm0: USB WDM device [ 258.556566][ T5758] wwan wwan0: port wwan0mbim0 attached [ 258.753672][ T5758] cdc_mbim 8-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.7-1, CDC MBIM, e2:06:7d:80:4b:a9 [ 258.829631][ T5758] usb 8-1: USB disconnect, device number 5 [ 258.869762][ T5758] cdc_mbim 8-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.7-1, CDC MBIM [ 259.099564][ T5758] wwan wwan0: port wwan0mbim0 disconnected [ 260.303340][ T5773] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 260.475085][ T30] audit: type=1800 audit(1785510636.106:69): pid=8887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.847" name="idVendor" dev="configfs" ino=21506 res=0 errno=0 [ 260.553143][ T5773] usb 6-1: unable to get BOS descriptor or descriptor too short [ 260.567938][ T5773] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 260.589479][ T5773] usb 6-1: can't read configurations, error -71 [ 260.918207][ T8898] loop8: detected capacity change from 0 to 2048 [ 260.986587][ T8898] NILFS (loop8): broken superblock, retrying with spare superblock (blocksize = 1024) [ 261.012715][ T8878] loop1: detected capacity change from 0 to 32768 [ 261.057162][ T8898] NILFS (loop8): mounting unchecked fs [ 261.084453][ T8878] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.831 (8878) [ 261.185914][ T8898] NILFS (loop8): recovery complete [ 261.233064][ T5631] udevd[5631]: incorrect nilfs2 checksum on /dev/loop8 [ 261.269705][ T8900] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 261.951713][ T8878] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 262.023756][ T8878] BTRFS info (device loop1): using blake2b checksum algorithm [ 262.088568][ T8895] loop3: detected capacity change from 0 to 131072 [ 262.096967][ T8895] F2FS-fs (loop3): Wrong CP boundary, start(512) end(1536) blocks(0) [ 262.105102][ T8895] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 262.130765][ T8895] F2FS-fs (loop3): invalid crc value [ 262.339552][ T8895] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 262.366765][ T8895] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 262.373938][ T8895] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 262.415725][ T8878] BTRFS info (device loop1): enabling ssd optimizations [ 262.427391][ T5828] usb 1-1: USB disconnect, device number 3 [ 262.446931][ T8878] BTRFS info (device loop1): turning on async discard [ 262.457170][ T8878] BTRFS info (device loop1): enabling free space tree [ 262.478250][ T8878] BTRFS info (device loop1): use lzo compression, level 1 [ 262.744612][ T8932] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 263.051839][ T8934] configfs-gadget.g1 gadget.0: USB CDC Phonet function [ 263.082886][ T8934] configfs-gadget.g1 gadget.0: using dummy_udc, OUT ep2out-bulk, IN ep1in-bulk [ 263.136405][ T8940] loop5: detected capacity change from 0 to 4096 [ 263.367074][ T5758] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 263.486743][ T8942] loop7: detected capacity change from 0 to 1024 [ 263.539112][ T8942] EXT4-fs (loop7): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 263.566574][ T5758] usb 1-1: Dual-Role OTG device on HNP port [ 263.586891][ T8942] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=8841e018, mo2=0000] [ 263.600050][ T7915] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 263.649022][ T5758] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 263.746506][ T5758] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.801375][ T8942] EXT4-fs error (device loop7): ext4_map_blocks:791: inode #3: block 2: comm syz.7.849: lblock 2 mapped to illegal pblock 2 (length 1) [ 263.856042][ T5758] gspca_main: spca501-2.14.0 probing 0000:0000 [ 263.867766][ T8942] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 263.873389][ C1] EXT4-fs (loop7): error count since last fsck: 1 [ 263.888882][ C1] EXT4-fs (loop7): initial error at time 1785510639: ext4_map_blocks:791: inode 3: block 2 [ 263.899078][ C1] EXT4-fs (loop7): last error at time 1785510639: ext4_map_blocks:791: inode 3: block 2 [ 263.954266][ T5758] gspca_spca501: reg write: error -32 [ 263.959702][ T5758] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 263.965690][ T8942] Quota error (device loop7): qtree_write_dquot: dquota write failed [ 263.990074][ T5758] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 264.046592][ T8942] EXT4-fs error (device loop7): ext4_map_blocks:791: inode #3: block 48: comm syz.7.849: lblock 0 mapped to illegal pblock 48 (length 1) [ 264.120805][ T8942] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 264.127506][ T8942] Quota error (device loop7): v2_write_file_info: Can't write info structure [ 264.258785][ T8942] EXT4-fs error (device loop7): ext4_acquire_dquot:7039: comm syz.7.849: Failed to acquire dquot type 0 [ 264.340191][ T8942] loop7: lost filesystem error report for type 5 error -117 [ 264.373148][ T8942] EXT4-fs error (device loop7) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 264.483356][ T8942] loop7: lost filesystem error report for type 5 error -117 [ 264.498877][ T8942] EXT4-fs error (device loop7): ext4_evict_inode:267: inode #11: comm syz.7.849: mark_inode_dirty error [ 264.586513][ T8942] loop7: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 264.593186][ T8942] EXT4-fs warning (device loop7): ext4_evict_inode:269: couldn't mark inode dirty (err -117) [ 264.684749][ T8942] EXT4-fs (loop7): 1 orphan inode deleted [ 264.705267][ T48] EXT4-fs error (device loop7): ext4_map_blocks:791: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 264.744684][ T8942] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 264.811102][ T48] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 264.897499][ T48] Quota error (device loop7): remove_tree: Can't read quota data block 1 [ 264.983723][ T48] EXT4-fs error (device loop7): ext4_release_dquot:7075: comm kworker/u8:3: Failed to release dquot type 0 [ 265.006126][ T8962] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000. [ 265.240396][ T6842] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.310817][ T6842] EXT4-fs error (device loop7): __ext4_get_inode_loc:4885: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 265.326320][ T6842] loop7: lost filesystem error report for type 5 error -117 [ 265.329514][ T6842] EXT4-fs error (device loop7) in ext4_reserve_inode_write:6435: Corrupt filesystem [ 265.347685][ T6842] loop7: lost filesystem error report for type 5 error -117 [ 265.348017][ T6842] EXT4-fs error (device loop7): ext4_quota_off:7325: inode #3: comm syz-executor: mark_inode_dirty error [ 265.368868][ T6842] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 265.615183][ T5637] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 265.712825][ T5758] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 265.850172][ T5637] usb 2-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 265.882898][ T5637] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.892436][ T5758] usb 6-1: Using ep0 maxpacket: 8 [ 265.900870][ T5637] usb 2-1: Product: syz [ 265.915944][ T5637] usb 2-1: Manufacturer: syz [ 265.926833][ T5637] usb 2-1: SerialNumber: syz [ 265.946467][ T5758] usb 6-1: config 0 has no interfaces? [ 265.972450][ T5758] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 266.000081][ T5758] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.020252][ T8986] 9p: Unknown uid 00000000004294967295 [ 266.030011][ T5758] usb 6-1: config 0 descriptor?? [ 266.403814][ T5765] usb 6-1: USB disconnect, device number 6 [ 266.449278][ T8995] pim6reg1: entered promiscuous mode [ 266.472242][ T8995] pim6reg1: entered allmulticast mode [ 266.675968][ T5828] libceph: connect (1)[c::]:6789 error -101 [ 266.685073][ T5828] libceph: mon0 (1)[c::]:6789 connect error [ 266.731662][ T5828] libceph: connect (1)[c::]:6789 error -101 [ 266.741999][ T9003] ceph: No mds server is up or the cluster is laggy [ 266.753320][ T5828] libceph: mon0 (1)[c::]:6789 connect error [ 267.198779][ T5637] usb 2-1: usb_control_msg returned -71 [ 267.231216][ T5637] usbtmc 2-1:1.0: can't read capabilities [ 267.237291][ T30] audit: type=1800 audit(1785510642.866:70): pid=9014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.876" name="protocol" dev="configfs" ino=21713 res=0 errno=0 [ 267.358988][ T5637] usb 2-1: USB disconnect, device number 4 [ 267.366818][ T5644] Bluetooth: hci1: command 0x0406 tx timeout [ 267.998647][ T9029] loop5: detected capacity change from 0 to 2048 [ 268.087450][ T9029] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 268.128157][ T30] audit: type=1800 audit(1785510643.756:71): pid=9031 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.884" name="pattern" dev="configfs" ino=20927 res=0 errno=0 [ 268.267613][ T30] audit: type=1800 audit(1785510643.896:72): pid=9034 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.882" name="file2" dev="loop5" ino=1347 res=0 errno=0 [ 268.745010][ T5828] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 268.941543][ T5828] usb 7-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 268.976683][ T5828] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.246851][ C1] Unknown status report in ack skb [ 269.351396][ T5828] qmi_wwan 7-1:1.0: cdc-wdm0: USB WDM device [ 269.443352][ T5828] wwan wwan0: port wwan0qmi0 attached [ 269.448361][ T9063] binder: 9061:9063 ioctl c0306201 2000000001c0 returned -14 [ 269.612222][ T5828] qmi_wwan 7-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.6-1, WWAN/QMI device, 6a:b3:7f:17:95:7b [ 270.427370][ T9090] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 271.587615][ T5758] usb 7-1: USB disconnect, device number 7 [ 271.620780][ T5758] qmi_wwan 7-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.6-1, WWAN/QMI device [ 271.849437][ T5758] wwan wwan0: port wwan0qmi0 disconnected [ 271.880514][ T9126] netlink: 4 bytes leftover after parsing attributes in process `syz.3.910'. [ 272.446492][ T9138] loop3: detected capacity change from 0 to 512 [ 272.468821][ T9101] loop1: detected capacity change from 0 to 32768 [ 272.572842][ T9138] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 272.606198][ T9138] ext4 filesystem being mounted at /172/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 272.940423][ T9138] EXT4-fs error (device loop3): ext4_get_first_dir_block:3537: inode #12: comm syz.3.915: Directory block failed checksum [ 273.105688][ T30] audit: type=1326 audit(1785510648.726:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9152 comm="syz.8.921" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f85ac99e019 code=0x0 [ 273.137878][ T9153] loop6: detected capacity change from 0 to 512 [ 273.187304][ T9153] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 273.214186][ T30] audit: type=1800 audit(1785510648.766:74): pid=9151 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.906" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 273.247693][ T5624] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.395216][ T9153] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 273.465928][ T9153] ext4 filesystem being mounted at /115/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 273.942075][ T6308] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 274.549009][ T9191] netlink: 8 bytes leftover after parsing attributes in process `syz.5.931'. [ 274.616620][ T9191] netlink: 12 bytes leftover after parsing attributes in process `syz.5.931'. [ 274.693957][ T9191] netlink: 'syz.5.931': attribute type 6 has an invalid length. [ 274.758571][ T9196] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xc138fd12 [ 274.802226][ T9191] netlink: 8 bytes leftover after parsing attributes in process `syz.5.931'. [ 274.818205][ T48] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 274.840034][ T9191] netlink: 12 bytes leftover after parsing attributes in process `syz.5.931'. [ 274.856083][ T48] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 274.884593][ T9199] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 274.890103][ T9191] netlink: 'syz.5.931': attribute type 6 has an invalid length. [ 274.910954][ T48] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 274.946341][ T48] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 275.572848][ T5828] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 275.787368][ T5828] usb 4-1: unable to get BOS descriptor or descriptor too short [ 275.829281][ T5828] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 275.858174][ T5828] usb 4-1: can't read configurations, error -71 [ 275.912536][ T5758] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 276.052468][ T9241] loop7: detected capacity change from 0 to 512 [ 276.074877][ T5758] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 276.113482][ T5758] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 276.150523][ T9241] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 276.183624][ T5758] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 276.212974][ T9241] ext4 filesystem being mounted at /98/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 276.223915][ T5758] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.251875][ T5758] usb 9-1: Product: syz [ 276.273551][ T5758] usb 9-1: Manufacturer: syz [ 276.290353][ T5758] usb 9-1: SerialNumber: syz [ 276.446499][ T30] audit: type=1804 audit(3932994300.072:75): pid=9251 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.948" name="/newroot/98/file1/bus" dev="loop7" ino=18 res=1 errno=0 [ 276.731085][ T6842] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.182679][ T5765] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 277.373338][ T5765] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 277.447682][ T5765] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 277.503787][ T5765] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 277.526244][ T9283] loop7: detected capacity change from 0 to 128 [ 277.555052][ T5765] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.599999][ T9283] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 277.614884][ T5765] usb 7-1: config 0 descriptor?? [ 277.659676][ T9283] hpfs: filesystem error: improperly stopped [ 277.693216][ T9283] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 277.717204][ T9283] hpfs: You really don't want any checks? You are crazy... [ 277.736492][ T9283] hpfs: Code page index out of array [ 277.763450][ T9283] hpfs: code page support is disabled [ 277.774984][ T9283] hpfs: hpfs_map_4sectors(): unaligned read [ 277.788180][ T9283] hpfs: hpfs_map_4sectors(): unaligned read [ 277.800784][ T9283] hpfs: filesystem error: unable to find root dir [ 277.828366][ T9283] hpfs filesystem being remounted at /100/file1 supports timestamps until 2106-02-07 (0xffffffff) [ 277.924438][ T5828] usb 9-1: USB disconnect, device number 2 [ 278.501277][ T5765] hid-led 0003:27B8:01ED.0006: probe with driver hid-led failed with error -71 [ 278.520549][ T5765] usb 7-1: USB disconnect, device number 8 [ 278.740763][ T9304] netlink: 1355 bytes leftover after parsing attributes in process `syz.5.965'. [ 279.113560][ T9312] loop8: detected capacity change from 0 to 1024 [ 279.169493][ T9312] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: none. [ 279.265730][ T8049] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 279.373061][ T5758] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 279.442567][ T5644] Bluetooth: hci0: command 0xfc11 tx timeout [ 279.442633][ T5645] Bluetooth: hci0: Entering manufacturer mode failed (-110) [ 279.497465][ T9325] loop3: detected capacity change from 0 to 128 [ 279.550818][ T5758] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 279.554931][ T9325] vfat filesystem being mounted at /182/bus supports timestamps until 2107-12-31 (0x10391447e) [ 279.565112][ T5758] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 96, setting to 64 [ 279.606076][ T5758] usb 7-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 279.622995][ T5355] usb 1-1: USB disconnect, device number 4 [ 279.637781][ T5758] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 279.647684][ T5758] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 279.670125][ T5758] usb 7-1: SerialNumber: syz [ 279.709764][ T9314] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 279.763193][ T5758] hub 7-1:1.0: bad descriptor, ignoring hub [ 279.772197][ T5758] hub 7-1:1.0: probe with driver hub failed with error -5 [ 279.858246][ T9325] loop3: detected capacity change from 128 to 0 [ 279.998967][ T9314] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 280.110312][ T13] FAT-fs (loop3): bread failed in fat_clusters_flush [ 280.138460][ T5624] Buffer I/O error on dev loop3, logical block 23, lost sync page write [ 280.168078][ T5624] FAT-fs (loop3): unable to read boot sector to mark fs as dirty [ 280.539981][ T5758] cdc_ether 7-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.6-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 280.765216][ T5284] ================================================================== [ 280.773318][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0 [ 280.780120][ T5284] Read of size 1 at addr ffff888051bf21e0 by task dhcpcd/5284 [ 280.787596][ T5284] [ 280.789947][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G L syzkaller #0 PREEMPT(full) [ 280.790003][ T5284] Tainted: [L]=SOFTLOCKUP [ 280.790017][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 280.790041][ T5284] Call Trace: [ 280.790053][ T5284] [ 280.790066][ T5284] dump_stack_lvl+0x100/0x190 [ 280.790112][ T5284] print_report+0x13d/0x4b0 [ 280.790174][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.790221][ T5284] ? __virt_addr_valid+0x239/0x430 [ 280.790269][ T5284] ? strlen+0x85/0xa0 [ 280.790321][ T5284] kasan_report+0xdf/0x1c0 [ 280.790362][ T5284] ? strlen+0x85/0xa0 [ 280.790420][ T5284] strlen+0x85/0xa0 [ 280.790472][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 280.790545][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 280.790610][ T5284] ? xas_load+0x44/0x5c0 [ 280.790660][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.790707][ T5284] ? xa_find+0x19f/0x3d0 [ 280.790754][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.790803][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.790848][ T5284] ? xa_find+0x1d6/0x3d0 [ 280.790908][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 280.790978][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 280.791034][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791079][ T5284] ? stack_trace_save+0x8e/0xc0 [ 280.791146][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 280.791204][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791248][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791292][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 280.791351][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791396][ T5284] ? find_held_lock+0x2b/0x80 [ 280.791498][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 280.791560][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791604][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 280.791642][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 280.791680][ T5284] ? __alloc_skb+0x185/0x710 [ 280.791732][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791778][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 280.791814][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791860][ T5284] ? __asan_memset+0x23/0x50 [ 280.791918][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.791964][ T5284] ? __alloc_skb+0x4e9/0x710 [ 280.792009][ T5284] ? __alloc_skb+0x5b7/0x710 [ 280.792053][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 280.792102][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 280.792169][ T5284] rtnl_dumpit+0x97/0x1f0 [ 280.792209][ T5284] netlink_dump+0x532/0xd00 [ 280.792249][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 280.792284][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 280.792354][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.792400][ T5284] ? kfree_skbmem+0x19f/0x210 [ 280.792439][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 280.792479][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 280.792515][ T5284] ? __might_fault+0xc5/0x140 [ 280.792571][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.792617][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 280.792659][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.792705][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 280.792744][ T5284] sock_recvmsg+0x1d5/0x220 [ 280.792806][ T5284] ____sys_recvmsg+0x21e/0x670 [ 280.792847][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 280.792920][ T5284] ? rcu_is_watching+0x12/0xc0 [ 280.792975][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.793022][ T5284] ? kfree+0x1e5/0x6c0 [ 280.793072][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 280.793112][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 280.793155][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 280.793196][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.793241][ T5284] ? rcu_is_watching+0x12/0xc0 [ 280.793313][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 280.793366][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 280.793428][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 280.793479][ T5284] do_syscall_64+0x115/0x870 [ 280.793530][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.793570][ T5284] RIP: 0033:0x7fd8f625f407 [ 280.793599][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 280.793638][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 280.793674][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 280.793700][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 280.793725][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 280.793750][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 280.793775][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 280.793815][ T5284] [ 280.793828][ T5284] [ 281.252233][ T5284] Allocated by task 8934: [ 281.256556][ T5284] kasan_save_stack+0x30/0x50 [ 281.261267][ T5284] kasan_save_track+0x14/0x30 [ 281.265970][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 281.270615][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 281.277064][ T5284] kvasprintf+0xbc/0x150 [ 281.281338][ T5284] kvasprintf_const+0x66/0x1a0 [ 281.286161][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 281.291480][ T5284] dev_set_name+0xc7/0x100 [ 281.295900][ T5284] usb_add_gadget+0x520/0x920 [ 281.300583][ T5284] usb_add_gadget_udc+0x26/0x70 [ 281.305443][ T5284] dummy_udc_probe+0x69e/0x960 [ 281.310210][ T5284] platform_probe+0x106/0x1d0 [ 281.314890][ T5284] really_probe+0x241/0xa60 [ 281.319412][ T5284] __driver_probe_device+0x20e/0x450 [ 281.324718][ T5284] device_driver_attach+0xd1/0x220 [ 281.329880][ T5284] bind_store+0xf4/0x190 [ 281.334136][ T5284] drv_attr_store+0x74/0xb0 [ 281.338732][ T5284] sysfs_kf_write+0xf2/0x150 [ 281.343336][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 281.348641][ T5284] vfs_write+0x6ac/0x1050 [ 281.352987][ T5284] ksys_write+0x12a/0x250 [ 281.357333][ T5284] do_syscall_64+0x115/0x870 [ 281.361941][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.367864][ T5284] [ 281.370181][ T5284] Freed by task 9327: [ 281.374153][ T5284] kasan_save_stack+0x30/0x50 [ 281.378866][ T5284] kasan_save_track+0x14/0x30 [ 281.383571][ T5284] kasan_save_free_info+0x3b/0x70 [ 281.388702][ T5284] __kasan_slab_free+0x5f/0x80 [ 281.393555][ T5284] kfree+0x22b/0x6c0 [ 281.397512][ T5284] kfree_const+0x5a/0x70 [ 281.401774][ T5284] kobject_put+0x218/0x640 [ 281.406212][ T5284] put_device+0x1f/0x30 [ 281.410372][ T5284] platform_remove+0x5f/0x80 [ 281.414968][ T5284] device_remove+0xcb/0x180 [ 281.419488][ T5284] device_release_driver_internal+0x44e/0x620 [ 281.425578][ T5284] unbind_store+0xf8/0x110 [ 281.430028][ T5284] drv_attr_store+0x74/0xb0 [ 281.434560][ T5284] sysfs_kf_write+0xf2/0x150 [ 281.439225][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 281.444520][ T5284] vfs_write+0x6ac/0x1050 [ 281.448867][ T5284] ksys_write+0x12a/0x250 [ 281.453209][ T5284] do_syscall_64+0x115/0x870 [ 281.457816][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.463715][ T5284] [ 281.466029][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 281.466029][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 281.479912][ T5284] The buggy address is located 0 bytes inside of [ 281.479912][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 281.493465][ T5284] [ 281.495787][ T5284] The buggy address belongs to the physical page: [ 281.502187][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888051bf26a0 pfn:0x51bf2 [ 281.512343][ T5284] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 281.520424][ T5284] page_type: f5(slab) [ 281.524438][ T5284] raw: 00fff00000000200 ffff88813fe21640 ffffea0000d4e7d0 ffffea0001ef0490 [ 281.533033][ T5284] raw: ffff888051bf26a0 000000080080007d 00000000f5000000 0000000000000000 [ 281.541613][ T5284] page dumped because: kasan: bad access detected [ 281.548037][ T5284] page_owner tracks the page as allocated [ 281.553744][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 281.574698][ T5284] post_alloc_hook+0xfd/0x120 [ 281.579403][ T5284] get_page_from_freelist+0xf48/0x3530 [ 281.584885][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 281.590803][ T5284] new_slab+0xa2/0x640 [ 281.594895][ T5284] refill_objects+0xe3/0x410 [ 281.599518][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 281.605172][ T5284] __kmalloc_noprof+0x66d/0x820 [ 281.610055][ T5284] do_replace_table+0x4b8/0x760 [ 281.614936][ T5284] xt_replace_table+0x2e/0x130 [ 281.619723][ T5284] __do_replace+0x1cf/0x990 [ 281.624238][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 281.629015][ T5284] nf_setsockopt+0x8d/0xf0 [ 281.633446][ T5284] ipv6_setsockopt+0x135/0x170 [ 281.638227][ T5284] tcp_setsockopt+0xa7/0x100 [ 281.642873][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 281.647836][ T5284] __sys_setsockopt+0x195/0x220 [ 281.652786][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 281.659102][ T5284] __free_frozen_pages+0x79f/0x1090 [ 281.664315][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 281.669883][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 281.674823][ T5284] __get_vm_area_node+0x1ca/0x330 [ 281.679942][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 281.685849][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 281.690971][ T5284] xt_counters_alloc+0x4c/0x70 [ 281.695752][ T5284] __do_replace+0x97/0x990 [ 281.700210][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 281.705011][ T5284] nf_setsockopt+0x8d/0xf0 [ 281.709441][ T5284] ipv6_setsockopt+0x135/0x170 [ 281.714246][ T5284] tcp_setsockopt+0xa7/0x100 [ 281.718865][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 281.723832][ T5284] __sys_setsockopt+0x195/0x220 [ 281.728703][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 281.733833][ T5284] do_syscall_64+0x115/0x870 [ 281.738449][ T5284] [ 281.740768][ T5284] Memory state around the buggy address: [ 281.746392][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 281.754458][ T5284] ffff888051bf2100: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 281.762636][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 281.770696][ T5284] ^ [ 281.777884][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 281.785947][ T5284] ffff888051bf2280: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 281.794004][ T5284] ================================================================== [ 281.806734][ T5758] usb 7-1: USB disconnect, device number 9 [ 281.816623][ T5758] cdc_ether 7-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.6-1, CDC Ethernet Device [ 281.879239][ T5284] Disabling lock debugging due to kernel taint [ 281.885557][ T5284] ================================================================== [ 281.893749][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 281.900552][ T5284] Read of size 1 at addr ffff888051bf21e1 by task dhcpcd/5284 [ 281.908028][ T5284] [ 281.910354][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 281.910409][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 281.910424][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 281.910445][ T5284] Call Trace: [ 281.910458][ T5284] [ 281.910471][ T5284] dump_stack_lvl+0x100/0x190 [ 281.910513][ T5284] print_report+0x13d/0x4b0 [ 281.910565][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.910609][ T5284] ? __virt_addr_valid+0x239/0x430 [ 281.910659][ T5284] ? strlen+0x93/0xa0 [ 281.910705][ T5284] kasan_report+0xdf/0x1c0 [ 281.910743][ T5284] ? strlen+0x93/0xa0 [ 281.910796][ T5284] strlen+0x93/0xa0 [ 281.910844][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 281.910912][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 281.910971][ T5284] ? xas_load+0x44/0x5c0 [ 281.911018][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911063][ T5284] ? xa_find+0x19f/0x3d0 [ 281.911109][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911156][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911198][ T5284] ? xa_find+0x1d6/0x3d0 [ 281.911254][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 281.911320][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 281.911374][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911417][ T5284] ? stack_trace_save+0x8e/0xc0 [ 281.911474][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 281.911530][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911573][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911621][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 281.911677][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911719][ T5284] ? find_held_lock+0x2b/0x80 [ 281.911809][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 281.911868][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.911911][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 281.911946][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 281.911979][ T5284] ? __alloc_skb+0x185/0x710 [ 281.912026][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.912069][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 281.912100][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.912143][ T5284] ? __asan_memset+0x23/0x50 [ 281.912190][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.912233][ T5284] ? __alloc_skb+0x4e9/0x710 [ 281.912274][ T5284] ? __alloc_skb+0x5b7/0x710 [ 281.912319][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 281.912368][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 281.912428][ T5284] rtnl_dumpit+0x97/0x1f0 [ 281.912466][ T5284] netlink_dump+0x532/0xd00 [ 281.912503][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 281.912535][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 281.912599][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.912650][ T5284] ? kfree_skbmem+0x19f/0x210 [ 281.912685][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 281.912721][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 281.912754][ T5284] ? __might_fault+0xc5/0x140 [ 281.912805][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.912848][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 281.912886][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.912928][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 281.912964][ T5284] sock_recvmsg+0x1d5/0x220 [ 281.913022][ T5284] ____sys_recvmsg+0x21e/0x670 [ 281.913059][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 281.913124][ T5284] ? rcu_is_watching+0x12/0xc0 [ 281.913175][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.913218][ T5284] ? kfree+0x1e5/0x6c0 [ 281.913264][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 281.913300][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 281.913334][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 281.913372][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.913414][ T5284] ? rcu_is_watching+0x12/0xc0 [ 281.913479][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 281.913529][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 281.913588][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 281.913639][ T5284] do_syscall_64+0x115/0x870 [ 281.913687][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.913723][ T5284] RIP: 0033:0x7fd8f625f407 [ 281.913751][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 281.913786][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 281.913821][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 281.913846][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 281.913868][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 281.913890][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 281.913913][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 281.913948][ T5284] [ 281.913960][ T5284] [ 282.373366][ T5284] Allocated by task 8934: [ 282.377686][ T5284] kasan_save_stack+0x30/0x50 [ 282.382399][ T5284] kasan_save_track+0x14/0x30 [ 282.387099][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 282.391716][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 282.398162][ T5284] kvasprintf+0xbc/0x150 [ 282.402430][ T5284] kvasprintf_const+0x66/0x1a0 [ 282.407222][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 282.412566][ T5284] dev_set_name+0xc7/0x100 [ 282.416990][ T5284] usb_add_gadget+0x520/0x920 [ 282.421701][ T5284] usb_add_gadget_udc+0x26/0x70 [ 282.426561][ T5284] dummy_udc_probe+0x69e/0x960 [ 282.431329][ T5284] platform_probe+0x106/0x1d0 [ 282.436011][ T5284] really_probe+0x241/0xa60 [ 282.440553][ T5284] __driver_probe_device+0x20e/0x450 [ 282.445862][ T5284] device_driver_attach+0xd1/0x220 [ 282.450994][ T5284] bind_store+0xf4/0x190 [ 282.455244][ T5284] drv_attr_store+0x74/0xb0 [ 282.459752][ T5284] sysfs_kf_write+0xf2/0x150 [ 282.464351][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 282.469648][ T5284] vfs_write+0x6ac/0x1050 [ 282.473990][ T5284] ksys_write+0x12a/0x250 [ 282.478332][ T5284] do_syscall_64+0x115/0x870 [ 282.482937][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.488840][ T5284] [ 282.491157][ T5284] Freed by task 9327: [ 282.495130][ T5284] kasan_save_stack+0x30/0x50 [ 282.499833][ T5284] kasan_save_track+0x14/0x30 [ 282.504534][ T5284] kasan_save_free_info+0x3b/0x70 [ 282.509582][ T5284] __kasan_slab_free+0x5f/0x80 [ 282.514347][ T5284] kfree+0x22b/0x6c0 [ 282.518252][ T5284] kfree_const+0x5a/0x70 [ 282.522511][ T5284] kobject_put+0x218/0x640 [ 282.526953][ T5284] put_device+0x1f/0x30 [ 282.531113][ T5284] platform_remove+0x5f/0x80 [ 282.535715][ T5284] device_remove+0xcb/0x180 [ 282.540244][ T5284] device_release_driver_internal+0x44e/0x620 [ 282.546331][ T5284] unbind_store+0xf8/0x110 [ 282.550754][ T5284] drv_attr_store+0x74/0xb0 [ 282.555265][ T5284] sysfs_kf_write+0xf2/0x150 [ 282.559893][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 282.565183][ T5284] vfs_write+0x6ac/0x1050 [ 282.569525][ T5284] ksys_write+0x12a/0x250 [ 282.573867][ T5284] do_syscall_64+0x115/0x870 [ 282.578470][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.584375][ T5284] [ 282.586685][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 282.586685][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 282.600563][ T5284] The buggy address is located 1 bytes inside of [ 282.600563][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 282.614106][ T5284] [ 282.616435][ T5284] The buggy address belongs to the physical page: [ 282.622852][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888051bf2500 pfn:0x51bf2 [ 282.632919][ T5284] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 282.640983][ T5284] page_type: f5(slab) [ 282.644963][ T5284] raw: 00fff00000000200 ffff88813fe21640 ffffea0000d4e7d0 ffffea0001ef0490 [ 282.653577][ T5284] raw: ffff888051bf2500 000000080080007c 00000000f5000000 0000000000000000 [ 282.662157][ T5284] page dumped because: kasan: bad access detected [ 282.668564][ T5284] page_owner tracks the page as allocated [ 282.674270][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 282.695226][ T5284] post_alloc_hook+0xfd/0x120 [ 282.699934][ T5284] get_page_from_freelist+0xf48/0x3530 [ 282.705502][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 282.711421][ T5284] new_slab+0xa2/0x640 [ 282.715509][ T5284] refill_objects+0xe3/0x410 [ 282.720119][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 282.725772][ T5284] __kmalloc_noprof+0x66d/0x820 [ 282.730681][ T5284] do_replace_table+0x4b8/0x760 [ 282.735564][ T5284] xt_replace_table+0x2e/0x130 [ 282.740350][ T5284] __do_replace+0x1cf/0x990 [ 282.744865][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 282.749658][ T5284] nf_setsockopt+0x8d/0xf0 [ 282.754087][ T5284] ipv6_setsockopt+0x135/0x170 [ 282.758881][ T5284] tcp_setsockopt+0xa7/0x100 [ 282.763507][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 282.768559][ T5284] __sys_setsockopt+0x195/0x220 [ 282.773427][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 282.779746][ T5284] __free_frozen_pages+0x79f/0x1090 [ 282.784958][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 282.790526][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 282.795378][ T5284] __get_vm_area_node+0x1ca/0x330 [ 282.800408][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 282.806310][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 282.811427][ T5284] xt_counters_alloc+0x4c/0x70 [ 282.816201][ T5284] __do_replace+0x97/0x990 [ 282.820627][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 282.825515][ T5284] nf_setsockopt+0x8d/0xf0 [ 282.829948][ T5284] ipv6_setsockopt+0x135/0x170 [ 282.834724][ T5284] tcp_setsockopt+0xa7/0x100 [ 282.839340][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 282.844299][ T5284] __sys_setsockopt+0x195/0x220 [ 282.849162][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 282.854286][ T5284] do_syscall_64+0x115/0x870 [ 282.858892][ T5284] [ 282.861206][ T5284] Memory state around the buggy address: [ 282.866850][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 282.874912][ T5284] ffff888051bf2100: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 282.882976][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 282.891040][ T5284] ^ [ 282.898230][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 282.906468][ T5284] ffff888051bf2280: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 282.914525][ T5284] ================================================================== [ 283.020447][ T5284] ================================================================== [ 283.028552][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 283.035371][ T5284] Read of size 1 at addr ffff888051bf21e2 by task dhcpcd/5284 [ 283.042861][ T5284] [ 283.045188][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 283.045241][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 283.045255][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 283.045277][ T5284] Call Trace: [ 283.045288][ T5284] [ 283.045301][ T5284] dump_stack_lvl+0x100/0x190 [ 283.045341][ T5284] print_report+0x13d/0x4b0 [ 283.045393][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.045435][ T5284] ? __virt_addr_valid+0x239/0x430 [ 283.045478][ T5284] ? strlen+0x93/0xa0 [ 283.045525][ T5284] kasan_report+0xdf/0x1c0 [ 283.045563][ T5284] ? strlen+0x93/0xa0 [ 283.045615][ T5284] strlen+0x93/0xa0 [ 283.045663][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 283.045729][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 283.045788][ T5284] ? xas_load+0x44/0x5c0 [ 283.045836][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.045879][ T5284] ? xa_find+0x19f/0x3d0 [ 283.045925][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.045971][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046013][ T5284] ? xa_find+0x1d6/0x3d0 [ 283.046073][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 283.046142][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 283.046196][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046238][ T5284] ? stack_trace_save+0x8e/0xc0 [ 283.046294][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 283.046350][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046393][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046435][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 283.046490][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046532][ T5284] ? find_held_lock+0x2b/0x80 [ 283.046621][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 283.046680][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046722][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 283.046757][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 283.046789][ T5284] ? __alloc_skb+0x185/0x710 [ 283.046836][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046878][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 283.046910][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.046951][ T5284] ? __asan_memset+0x23/0x50 [ 283.046998][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.047040][ T5284] ? __alloc_skb+0x4e9/0x710 [ 283.047081][ T5284] ? __alloc_skb+0x5b7/0x710 [ 283.047128][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 283.047174][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 283.047227][ T5284] rtnl_dumpit+0x97/0x1f0 [ 283.047264][ T5284] netlink_dump+0x532/0xd00 [ 283.047300][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 283.047332][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 283.047395][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.047437][ T5284] ? kfree_skbmem+0x19f/0x210 [ 283.047472][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 283.047507][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 283.047540][ T5284] ? __might_fault+0xc5/0x140 [ 283.047591][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.047632][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 283.047669][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.047711][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 283.047759][ T5284] sock_recvmsg+0x1d5/0x220 [ 283.047817][ T5284] ____sys_recvmsg+0x21e/0x670 [ 283.047853][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 283.047918][ T5284] ? rcu_is_watching+0x12/0xc0 [ 283.047968][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.048010][ T5284] ? kfree+0x1e5/0x6c0 [ 283.048055][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 283.048154][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 283.048188][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 283.048225][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.048267][ T5284] ? rcu_is_watching+0x12/0xc0 [ 283.048331][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 283.048381][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 283.048439][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.048485][ T5284] do_syscall_64+0x115/0x870 [ 283.048533][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.048569][ T5284] RIP: 0033:0x7fd8f625f407 [ 283.048596][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 283.048631][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 283.048664][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 283.048688][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 283.048710][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 283.048732][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 283.048754][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 283.048789][ T5284] [ 283.048801][ T5284] [ 283.508037][ T5284] Allocated by task 8934: [ 283.512358][ T5284] kasan_save_stack+0x30/0x50 [ 283.517069][ T5284] kasan_save_track+0x14/0x30 [ 283.521774][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 283.526388][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 283.532868][ T5284] kvasprintf+0xbc/0x150 [ 283.537713][ T5284] kvasprintf_const+0x66/0x1a0 [ 283.542501][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 283.547815][ T5284] dev_set_name+0xc7/0x100 [ 283.552245][ T5284] usb_add_gadget+0x520/0x920 [ 283.556933][ T5284] usb_add_gadget_udc+0x26/0x70 [ 283.561799][ T5284] dummy_udc_probe+0x69e/0x960 [ 283.566578][ T5284] platform_probe+0x106/0x1d0 [ 283.571281][ T5284] really_probe+0x241/0xa60 [ 283.575799][ T5284] __driver_probe_device+0x20e/0x450 [ 283.581105][ T5284] device_driver_attach+0xd1/0x220 [ 283.586244][ T5284] bind_store+0xf4/0x190 [ 283.590507][ T5284] drv_attr_store+0x74/0xb0 [ 283.595025][ T5284] sysfs_kf_write+0xf2/0x150 [ 283.599626][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 283.604914][ T5284] vfs_write+0x6ac/0x1050 [ 283.609266][ T5284] ksys_write+0x12a/0x250 [ 283.613609][ T5284] do_syscall_64+0x115/0x870 [ 283.618225][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.624212][ T5284] [ 283.626526][ T5284] Freed by task 9327: [ 283.630532][ T5284] kasan_save_stack+0x30/0x50 [ 283.635238][ T5284] kasan_save_track+0x14/0x30 [ 283.640025][ T5284] kasan_save_free_info+0x3b/0x70 [ 283.645062][ T5284] __kasan_slab_free+0x5f/0x80 [ 283.649832][ T5284] kfree+0x22b/0x6c0 [ 283.653742][ T5284] kfree_const+0x5a/0x70 [ 283.658013][ T5284] kobject_put+0x218/0x640 [ 283.662455][ T5284] put_device+0x1f/0x30 [ 283.666614][ T5284] platform_remove+0x5f/0x80 [ 283.671224][ T5284] device_remove+0xcb/0x180 [ 283.675764][ T5284] device_release_driver_internal+0x44e/0x620 [ 283.681857][ T5284] unbind_store+0xf8/0x110 [ 283.686288][ T5284] drv_attr_store+0x74/0xb0 [ 283.690793][ T5284] sysfs_kf_write+0xf2/0x150 [ 283.695394][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 283.700715][ T5284] vfs_write+0x6ac/0x1050 [ 283.705063][ T5284] ksys_write+0x12a/0x250 [ 283.709508][ T5284] do_syscall_64+0x115/0x870 [ 283.714125][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.720029][ T5284] [ 283.722343][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 283.722343][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 283.736312][ T5284] The buggy address is located 2 bytes inside of [ 283.736312][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 283.749942][ T5284] [ 283.752257][ T5284] The buggy address belongs to the physical page: [ 283.758657][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888051bf2500 pfn:0x51bf2 [ 283.768724][ T5284] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 283.776792][ T5284] page_type: f5(slab) [ 283.780778][ T5284] raw: 00fff00000000200 ffff88813fe21640 ffffea0000d4e7d0 ffffea0001ef0490 [ 283.789394][ T5284] raw: ffff888051bf2500 000000080080007c 00000000f5000000 0000000000000000 [ 283.797971][ T5284] page dumped because: kasan: bad access detected [ 283.804375][ T5284] page_owner tracks the page as allocated [ 283.810256][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 283.831202][ T5284] post_alloc_hook+0xfd/0x120 [ 283.835926][ T5284] get_page_from_freelist+0xf48/0x3530 [ 283.841405][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 283.847322][ T5284] new_slab+0xa2/0x640 [ 283.851406][ T5284] refill_objects+0xe3/0x410 [ 283.856010][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 283.861575][ T5284] __kmalloc_noprof+0x66d/0x820 [ 283.866601][ T5284] do_replace_table+0x4b8/0x760 [ 283.871496][ T5284] xt_replace_table+0x2e/0x130 [ 283.876283][ T5284] __do_replace+0x1cf/0x990 [ 283.880802][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 283.885602][ T5284] nf_setsockopt+0x8d/0xf0 [ 283.890032][ T5284] ipv6_setsockopt+0x135/0x170 [ 283.894811][ T5284] tcp_setsockopt+0xa7/0x100 [ 283.899428][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 283.904426][ T5284] __sys_setsockopt+0x195/0x220 [ 283.909293][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 283.915614][ T5284] __free_frozen_pages+0x79f/0x1090 [ 283.920853][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 283.926421][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 283.931277][ T5284] __get_vm_area_node+0x1ca/0x330 [ 283.936305][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 283.942210][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 283.947327][ T5284] xt_counters_alloc+0x4c/0x70 [ 283.952104][ T5284] __do_replace+0x97/0x990 [ 283.956543][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 283.961322][ T5284] nf_setsockopt+0x8d/0xf0 [ 283.965754][ T5284] ipv6_setsockopt+0x135/0x170 [ 283.970535][ T5284] tcp_setsockopt+0xa7/0x100 [ 283.975149][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 283.980142][ T5284] __sys_setsockopt+0x195/0x220 [ 283.985002][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 283.990128][ T5284] do_syscall_64+0x115/0x870 [ 283.994734][ T5284] [ 283.997047][ T5284] Memory state around the buggy address: [ 284.002696][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 284.010761][ T5284] ffff888051bf2100: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 284.018822][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 284.026922][ T5284] ^ [ 284.034144][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 284.042203][ T5284] ffff888051bf2280: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 284.050257][ T5284] ================================================================== [ 284.121589][ T5284] ================================================================== [ 284.129696][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 284.136501][ T5284] Read of size 1 at addr ffff888051bf21e3 by task dhcpcd/5284 [ 284.143968][ T5284] [ 284.146301][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 284.146362][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 284.146378][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 284.146400][ T5284] Call Trace: [ 284.146412][ T5284] [ 284.146425][ T5284] dump_stack_lvl+0x100/0x190 [ 284.146469][ T5284] print_report+0x13d/0x4b0 [ 284.146524][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.146569][ T5284] ? __virt_addr_valid+0x239/0x430 [ 284.146615][ T5284] ? strlen+0x93/0xa0 [ 284.146666][ T5284] kasan_report+0xdf/0x1c0 [ 284.146706][ T5284] ? strlen+0x93/0xa0 [ 284.146762][ T5284] strlen+0x93/0xa0 [ 284.146812][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 284.146883][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 284.146946][ T5284] ? xas_load+0x44/0x5c0 [ 284.146997][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147044][ T5284] ? xa_find+0x19f/0x3d0 [ 284.147093][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147151][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147195][ T5284] ? xa_find+0x1d6/0x3d0 [ 284.147255][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 284.147324][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 284.147382][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147428][ T5284] ? stack_trace_save+0x8e/0xc0 [ 284.147488][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 284.147547][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147593][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147637][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 284.147696][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147758][ T5284] ? find_held_lock+0x2b/0x80 [ 284.147855][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 284.147919][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.147965][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 284.148004][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 284.148039][ T5284] ? __alloc_skb+0x185/0x710 [ 284.148089][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.148143][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 284.148177][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.148222][ T5284] ? __asan_memset+0x23/0x50 [ 284.148273][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.148318][ T5284] ? __alloc_skb+0x4e9/0x710 [ 284.148363][ T5284] ? __alloc_skb+0x5b7/0x710 [ 284.148409][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 284.148459][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 284.148518][ T5284] rtnl_dumpit+0x97/0x1f0 [ 284.148557][ T5284] netlink_dump+0x532/0xd00 [ 284.148597][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 284.148631][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 284.148700][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.148746][ T5284] ? kfree_skbmem+0x19f/0x210 [ 284.148784][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 284.148822][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 284.148858][ T5284] ? __might_fault+0xc5/0x140 [ 284.148914][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.148961][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 284.149001][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.149048][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 284.149086][ T5284] sock_recvmsg+0x1d5/0x220 [ 284.149158][ T5284] ____sys_recvmsg+0x21e/0x670 [ 284.149197][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 284.149268][ T5284] ? rcu_is_watching+0x12/0xc0 [ 284.149322][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.149369][ T5284] ? kfree+0x1e5/0x6c0 [ 284.149418][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 284.149457][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 284.149493][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 284.149533][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.149578][ T5284] ? rcu_is_watching+0x12/0xc0 [ 284.149647][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 284.149699][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 284.149762][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.149811][ T5284] do_syscall_64+0x115/0x870 [ 284.149862][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.149901][ T5284] RIP: 0033:0x7fd8f625f407 [ 284.149929][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 284.149967][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 284.150001][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 284.150028][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 284.150052][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 284.150076][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 284.150100][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 284.150143][ T5284] [ 284.150156][ T5284] [ 284.610271][ T5284] Allocated by task 8934: [ 284.614594][ T5284] kasan_save_stack+0x30/0x50 [ 284.619306][ T5284] kasan_save_track+0x14/0x30 [ 284.624034][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 284.628649][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 284.635091][ T5284] kvasprintf+0xbc/0x150 [ 284.639362][ T5284] kvasprintf_const+0x66/0x1a0 [ 284.644185][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 284.649530][ T5284] dev_set_name+0xc7/0x100 [ 284.653955][ T5284] usb_add_gadget+0x520/0x920 [ 284.658651][ T5284] usb_add_gadget_udc+0x26/0x70 [ 284.663513][ T5284] dummy_udc_probe+0x69e/0x960 [ 284.668281][ T5284] platform_probe+0x106/0x1d0 [ 284.672989][ T5284] really_probe+0x241/0xa60 [ 284.677512][ T5284] __driver_probe_device+0x20e/0x450 [ 284.682821][ T5284] device_driver_attach+0xd1/0x220 [ 284.687952][ T5284] bind_store+0xf4/0x190 [ 284.692204][ T5284] drv_attr_store+0x74/0xb0 [ 284.696723][ T5284] sysfs_kf_write+0xf2/0x150 [ 284.701363][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 284.706660][ T5284] vfs_write+0x6ac/0x1050 [ 284.711004][ T5284] ksys_write+0x12a/0x250 [ 284.715388][ T5284] do_syscall_64+0x115/0x870 [ 284.719998][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.725905][ T5284] [ 284.728219][ T5284] Freed by task 9327: [ 284.732186][ T5284] kasan_save_stack+0x30/0x50 [ 284.736897][ T5284] kasan_save_track+0x14/0x30 [ 284.741614][ T5284] kasan_save_free_info+0x3b/0x70 [ 284.746653][ T5284] __kasan_slab_free+0x5f/0x80 [ 284.751421][ T5284] kfree+0x22b/0x6c0 [ 284.755350][ T5284] kfree_const+0x5a/0x70 [ 284.759613][ T5284] kobject_put+0x218/0x640 [ 284.764054][ T5284] put_device+0x1f/0x30 [ 284.768224][ T5284] platform_remove+0x5f/0x80 [ 284.772908][ T5284] device_remove+0xcb/0x180 [ 284.777428][ T5284] device_release_driver_internal+0x44e/0x620 [ 284.783520][ T5284] unbind_store+0xf8/0x110 [ 284.787943][ T5284] drv_attr_store+0x74/0xb0 [ 284.792445][ T5284] sysfs_kf_write+0xf2/0x150 [ 284.797064][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 284.802357][ T5284] vfs_write+0x6ac/0x1050 [ 284.806708][ C1] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 284.806701][ T5284] ksys_write+0x12a/0x250 [ 284.819663][ T5284] do_syscall_64+0x115/0x870 [ 284.824277][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.830181][ T5284] [ 284.832493][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 284.832493][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 284.846380][ T5284] The buggy address is located 3 bytes inside of [ 284.846380][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 284.859962][ T5284] [ 284.862284][ T5284] The buggy address belongs to the physical page: [ 284.868687][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888051bf20c0 pfn:0x51bf2 [ 284.878753][ T5284] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 284.886825][ T5284] page_type: f5(slab) [ 284.890808][ T5284] raw: 00fff00000000200 ffff88813fe21640 ffffea0000d4e7d0 ffffea0001ef0490 [ 284.899488][ T5284] raw: ffff888051bf20c0 000000080080007a 00000000f5000000 0000000000000000 [ 284.908160][ T5284] page dumped because: kasan: bad access detected [ 284.914567][ T5284] page_owner tracks the page as allocated [ 284.920273][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 284.941228][ T5284] post_alloc_hook+0xfd/0x120 [ 284.945932][ T5284] get_page_from_freelist+0xf48/0x3530 [ 284.951422][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 284.957338][ T5284] new_slab+0xa2/0x640 [ 284.961438][ T5284] refill_objects+0xe3/0x410 [ 284.966068][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 284.971642][ T5284] __kmalloc_noprof+0x66d/0x820 [ 284.976515][ T5284] do_replace_table+0x4b8/0x760 [ 284.981387][ T5284] xt_replace_table+0x2e/0x130 [ 284.986170][ T5284] __do_replace+0x1cf/0x990 [ 284.990686][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 284.995462][ T5284] nf_setsockopt+0x8d/0xf0 [ 284.999893][ T5284] ipv6_setsockopt+0x135/0x170 [ 285.004671][ T5284] tcp_setsockopt+0xa7/0x100 [ 285.009290][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 285.014253][ T5284] __sys_setsockopt+0x195/0x220 [ 285.019124][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 285.025528][ T5284] __free_frozen_pages+0x79f/0x1090 [ 285.030742][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 285.036314][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 285.041165][ T5284] __get_vm_area_node+0x1ca/0x330 [ 285.046198][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 285.052100][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 285.057224][ T5284] xt_counters_alloc+0x4c/0x70 [ 285.061999][ T5284] __do_replace+0x97/0x990 [ 285.066426][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 285.071211][ T5284] nf_setsockopt+0x8d/0xf0 [ 285.075646][ T5284] ipv6_setsockopt+0x135/0x170 [ 285.080428][ T5284] tcp_setsockopt+0xa7/0x100 [ 285.085042][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 285.090022][ T5284] __sys_setsockopt+0x195/0x220 [ 285.094885][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 285.100011][ T5284] do_syscall_64+0x115/0x870 [ 285.104615][ T5284] [ 285.106926][ T5284] Memory state around the buggy address: [ 285.112579][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 285.120656][ T5284] ffff888051bf2100: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 285.128759][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 285.137435][ T5284] ^ [ 285.144650][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 285.152711][ T5284] ffff888051bf2280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 285.160800][ T5284] ================================================================== [ 285.176215][ T5284] ================================================================== [ 285.184298][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 285.191138][ T5284] Read of size 1 at addr ffff888051bf21e4 by task dhcpcd/5284 [ 285.198606][ T5284] [ 285.200930][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 285.200984][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 285.200998][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 285.201019][ T5284] Call Trace: [ 285.201031][ T5284] [ 285.201043][ T5284] dump_stack_lvl+0x100/0x190 [ 285.201084][ T5284] print_report+0x13d/0x4b0 [ 285.201135][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.201183][ T5284] ? __virt_addr_valid+0x239/0x430 [ 285.201226][ T5284] ? strlen+0x93/0xa0 [ 285.201273][ T5284] kasan_report+0xdf/0x1c0 [ 285.201311][ T5284] ? strlen+0x93/0xa0 [ 285.201363][ T5284] strlen+0x93/0xa0 [ 285.201410][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 285.201476][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 285.201535][ T5284] ? xas_load+0x44/0x5c0 [ 285.201582][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.201627][ T5284] ? xa_find+0x19f/0x3d0 [ 285.201672][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.201718][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.201760][ T5284] ? xa_find+0x1d6/0x3d0 [ 285.201816][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 285.201885][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 285.201938][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.201981][ T5284] ? stack_trace_save+0x8e/0xc0 [ 285.202036][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 285.202092][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202135][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202180][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 285.202237][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202279][ T5284] ? find_held_lock+0x2b/0x80 [ 285.202374][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 285.202434][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202476][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 285.202511][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 285.202544][ T5284] ? __alloc_skb+0x185/0x710 [ 285.202591][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202633][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 285.202664][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202707][ T5284] ? __asan_memset+0x23/0x50 [ 285.202753][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.202795][ T5284] ? __alloc_skb+0x4e9/0x710 [ 285.202837][ T5284] ? __alloc_skb+0x5b7/0x710 [ 285.202878][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 285.202924][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 285.202978][ T5284] rtnl_dumpit+0x97/0x1f0 [ 285.203014][ T5284] netlink_dump+0x532/0xd00 [ 285.203051][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 285.203083][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 285.203146][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.203194][ T5284] ? kfree_skbmem+0x19f/0x210 [ 285.203228][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 285.203264][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 285.203297][ T5284] ? __might_fault+0xc5/0x140 [ 285.203348][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.203390][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 285.203427][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.203469][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 285.203504][ T5284] sock_recvmsg+0x1d5/0x220 [ 285.203562][ T5284] ____sys_recvmsg+0x21e/0x670 [ 285.203598][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 285.203663][ T5284] ? rcu_is_watching+0x12/0xc0 [ 285.203713][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.203755][ T5284] ? kfree+0x1e5/0x6c0 [ 285.203801][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 285.203837][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 285.203871][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 285.203908][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.203950][ T5284] ? rcu_is_watching+0x12/0xc0 [ 285.204015][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 285.204064][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 285.204122][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 285.204168][ T5284] do_syscall_64+0x115/0x870 [ 285.204221][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.204257][ T5284] RIP: 0033:0x7fd8f625f407 [ 285.204284][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 285.204319][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 285.204351][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 285.204376][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 285.204398][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 285.204420][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 285.204442][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 285.204477][ T5284] [ 285.204489][ T5284] [ 285.664416][ T5284] Allocated by task 8934: [ 285.668770][ T5284] kasan_save_stack+0x30/0x50 [ 285.673497][ T5284] kasan_save_track+0x14/0x30 [ 285.678200][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 285.682814][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 285.689253][ T5284] kvasprintf+0xbc/0x150 [ 285.693540][ T5284] kvasprintf_const+0x66/0x1a0 [ 285.698329][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 285.703656][ T5284] dev_set_name+0xc7/0x100 [ 285.708091][ T5284] usb_add_gadget+0x520/0x920 [ 285.712778][ T5284] usb_add_gadget_udc+0x26/0x70 [ 285.717638][ T5284] dummy_udc_probe+0x69e/0x960 [ 285.722408][ T5284] platform_probe+0x106/0x1d0 [ 285.727097][ T5284] really_probe+0x241/0xa60 [ 285.731651][ T5284] __driver_probe_device+0x20e/0x450 [ 285.736963][ T5284] device_driver_attach+0xd1/0x220 [ 285.742096][ T5284] bind_store+0xf4/0x190 [ 285.746344][ T5284] drv_attr_store+0x74/0xb0 [ 285.750852][ T5284] sysfs_kf_write+0xf2/0x150 [ 285.755476][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 285.760767][ T5284] vfs_write+0x6ac/0x1050 [ 285.765132][ T5284] ksys_write+0x12a/0x250 [ 285.769480][ T5284] do_syscall_64+0x115/0x870 [ 285.774089][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.779994][ T5284] [ 285.782308][ T5284] Freed by task 9327: [ 285.786282][ T5284] kasan_save_stack+0x30/0x50 [ 285.790984][ T5284] kasan_save_track+0x14/0x30 [ 285.795685][ T5284] kasan_save_free_info+0x3b/0x70 [ 285.800748][ T5284] __kasan_slab_free+0x5f/0x80 [ 285.805520][ T5284] kfree+0x22b/0x6c0 [ 285.809429][ T5284] kfree_const+0x5a/0x70 [ 285.813718][ T5284] kobject_put+0x218/0x640 [ 285.818158][ T5284] put_device+0x1f/0x30 [ 285.822403][ T5284] platform_remove+0x5f/0x80 [ 285.827085][ T5284] device_remove+0xcb/0x180 [ 285.831603][ T5284] device_release_driver_internal+0x44e/0x620 [ 285.837754][ T5284] unbind_store+0xf8/0x110 [ 285.842190][ T5284] drv_attr_store+0x74/0xb0 [ 285.846698][ T5284] sysfs_kf_write+0xf2/0x150 [ 285.851300][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 285.856594][ T5284] vfs_write+0x6ac/0x1050 [ 285.860949][ T5284] ksys_write+0x12a/0x250 [ 285.865297][ T5284] do_syscall_64+0x115/0x870 [ 285.869910][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.875814][ T5284] [ 285.878140][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 285.878140][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 285.892021][ T5284] The buggy address is located 4 bytes inside of [ 285.892021][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 285.905569][ T5284] [ 285.907887][ T5284] The buggy address belongs to the physical page: [ 285.914572][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888051bf20c0 pfn:0x51bf2 [ 285.924653][ T5284] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 285.932722][ T5284] page_type: f5(slab) [ 285.936710][ T5284] raw: 00fff00000000200 ffff88813fe21640 ffffea0000d4e7d0 ffffea0001ef0490 [ 285.945299][ T5284] raw: ffff888051bf20c0 000000080080007a 00000000f5000000 0000000000000000 [ 285.953876][ T5284] page dumped because: kasan: bad access detected [ 285.960280][ T5284] page_owner tracks the page as allocated [ 285.965993][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 285.986970][ T5284] post_alloc_hook+0xfd/0x120 [ 285.991676][ T5284] get_page_from_freelist+0xf48/0x3530 [ 285.997199][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 286.003150][ T5284] new_slab+0xa2/0x640 [ 286.007237][ T5284] refill_objects+0xe3/0x410 [ 286.011843][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 286.017427][ T5284] __kmalloc_noprof+0x66d/0x820 [ 286.022325][ T5284] do_replace_table+0x4b8/0x760 [ 286.027203][ T5284] xt_replace_table+0x2e/0x130 [ 286.031988][ T5284] __do_replace+0x1cf/0x990 [ 286.036515][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 286.041317][ T5284] nf_setsockopt+0x8d/0xf0 [ 286.045748][ T5284] ipv6_setsockopt+0x135/0x170 [ 286.050527][ T5284] tcp_setsockopt+0xa7/0x100 [ 286.055140][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 286.060103][ T5284] __sys_setsockopt+0x195/0x220 [ 286.064990][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 286.071308][ T5284] __free_frozen_pages+0x79f/0x1090 [ 286.076530][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 286.082273][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 286.087237][ T5284] __get_vm_area_node+0x1ca/0x330 [ 286.092265][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 286.098431][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 286.103573][ T5284] xt_counters_alloc+0x4c/0x70 [ 286.108348][ T5284] __do_replace+0x97/0x990 [ 286.112774][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 286.117549][ T5284] nf_setsockopt+0x8d/0xf0 [ 286.121974][ T5284] ipv6_setsockopt+0x135/0x170 [ 286.126750][ T5284] tcp_setsockopt+0xa7/0x100 [ 286.131388][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 286.136351][ T5284] __sys_setsockopt+0x195/0x220 [ 286.141218][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 286.146347][ T5284] do_syscall_64+0x115/0x870 [ 286.150955][ T5284] [ 286.153293][ T5284] Memory state around the buggy address: [ 286.158913][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 286.166971][ T5284] ffff888051bf2100: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 286.175055][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 286.183129][ T5284] ^ [ 286.190691][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 286.198774][ T5284] ffff888051bf2280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 286.206829][ T5284] ================================================================== [ 286.228645][ T5284] ================================================================== [ 286.236759][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 286.243571][ T5284] Read of size 1 at addr ffff888051bf21e5 by task dhcpcd/5284 [ 286.251038][ T5284] [ 286.253367][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 286.253428][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 286.253444][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 286.253467][ T5284] Call Trace: [ 286.253479][ T5284] [ 286.253492][ T5284] dump_stack_lvl+0x100/0x190 [ 286.253536][ T5284] print_report+0x13d/0x4b0 [ 286.253592][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.253638][ T5284] ? __virt_addr_valid+0x239/0x430 [ 286.253685][ T5284] ? strlen+0x93/0xa0 [ 286.253735][ T5284] kasan_report+0xdf/0x1c0 [ 286.253776][ T5284] ? strlen+0x93/0xa0 [ 286.253832][ T5284] strlen+0x93/0xa0 [ 286.253883][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 286.253955][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 286.254018][ T5284] ? xas_load+0x44/0x5c0 [ 286.254069][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254118][ T5284] ? xa_find+0x19f/0x3d0 [ 286.254172][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254222][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254267][ T5284] ? xa_find+0x1d6/0x3d0 [ 286.254328][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 286.254396][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 286.254453][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254498][ T5284] ? stack_trace_save+0x8e/0xc0 [ 286.254559][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 286.254618][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254663][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254708][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 286.254767][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.254813][ T5284] ? find_held_lock+0x2b/0x80 [ 286.254908][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 286.254971][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.255017][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 286.255055][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 286.255090][ T5284] ? __alloc_skb+0x185/0x710 [ 286.255146][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.255191][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 286.255226][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.255271][ T5284] ? __asan_memset+0x23/0x50 [ 286.255322][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.255367][ T5284] ? __alloc_skb+0x4e9/0x710 [ 286.255412][ T5284] ? __alloc_skb+0x5b7/0x710 [ 286.255458][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 286.255507][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 286.255565][ T5284] rtnl_dumpit+0x97/0x1f0 [ 286.255606][ T5284] netlink_dump+0x532/0xd00 [ 286.255646][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 286.255680][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 286.255748][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.255794][ T5284] ? kfree_skbmem+0x19f/0x210 [ 286.255831][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 286.255870][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 286.255905][ T5284] ? __might_fault+0xc5/0x140 [ 286.255961][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.256006][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 286.256046][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.256092][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 286.256131][ T5284] sock_recvmsg+0x1d5/0x220 [ 286.256199][ T5284] ____sys_recvmsg+0x21e/0x670 [ 286.256238][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 286.256306][ T5284] ? rcu_is_watching+0x12/0xc0 [ 286.256360][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.256405][ T5284] ? kfree+0x1e5/0x6c0 [ 286.256455][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 286.256492][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 286.256529][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 286.256569][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.256614][ T5284] ? rcu_is_watching+0x12/0xc0 [ 286.256684][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 286.256737][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 286.256800][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 286.256849][ T5284] do_syscall_64+0x115/0x870 [ 286.256901][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.256940][ T5284] RIP: 0033:0x7fd8f625f407 [ 286.256969][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 286.257008][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 286.257044][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 286.257070][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 286.257094][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 286.257118][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 286.257148][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 286.257186][ T5284] [ 286.257199][ T5284] [ 286.717677][ T5284] Allocated by task 8934: [ 286.722005][ T5284] kasan_save_stack+0x30/0x50 [ 286.726709][ T5284] kasan_save_track+0x14/0x30 [ 286.731443][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 286.736063][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 286.742523][ T5284] kvasprintf+0xbc/0x150 [ 286.746802][ T5284] kvasprintf_const+0x66/0x1a0 [ 286.751617][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 286.756932][ T5284] dev_set_name+0xc7/0x100 [ 286.761353][ T5284] usb_add_gadget+0x520/0x920 [ 286.766036][ T5284] usb_add_gadget_udc+0x26/0x70 [ 286.770902][ T5284] dummy_udc_probe+0x69e/0x960 [ 286.775673][ T5284] platform_probe+0x106/0x1d0 [ 286.780358][ T5284] really_probe+0x241/0xa60 [ 286.784879][ T5284] __driver_probe_device+0x20e/0x450 [ 286.790182][ T5284] device_driver_attach+0xd1/0x220 [ 286.795317][ T5284] bind_store+0xf4/0x190 [ 286.799566][ T5284] drv_attr_store+0x74/0xb0 [ 286.804069][ T5284] sysfs_kf_write+0xf2/0x150 [ 286.808673][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 286.813961][ T5284] vfs_write+0x6ac/0x1050 [ 286.818302][ T5284] ksys_write+0x12a/0x250 [ 286.822642][ T5284] do_syscall_64+0x115/0x870 [ 286.827244][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.833148][ T5284] [ 286.835458][ T5284] Freed by task 9327: [ 286.839429][ T5284] kasan_save_stack+0x30/0x50 [ 286.844148][ T5284] kasan_save_track+0x14/0x30 [ 286.848854][ T5284] kasan_save_free_info+0x3b/0x70 [ 286.853918][ T5284] __kasan_slab_free+0x5f/0x80 [ 286.858688][ T5284] kfree+0x22b/0x6c0 [ 286.862597][ T5284] kfree_const+0x5a/0x70 [ 286.866892][ T5284] kobject_put+0x218/0x640 [ 286.871335][ T5284] put_device+0x1f/0x30 [ 286.875495][ T5284] platform_remove+0x5f/0x80 [ 286.880178][ T5284] device_remove+0xcb/0x180 [ 286.884698][ T5284] device_release_driver_internal+0x44e/0x620 [ 286.890881][ T5284] unbind_store+0xf8/0x110 [ 286.895311][ T5284] drv_attr_store+0x74/0xb0 [ 286.899818][ T5284] sysfs_kf_write+0xf2/0x150 [ 286.904422][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 286.909718][ T5284] vfs_write+0x6ac/0x1050 [ 286.914065][ T5284] ksys_write+0x12a/0x250 [ 286.918423][ T5284] do_syscall_64+0x115/0x870 [ 286.923026][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.929272][ T5284] [ 286.931583][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 286.931583][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 286.945549][ T5284] The buggy address is located 5 bytes inside of [ 286.945549][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 286.959101][ T5284] [ 286.961442][ T5284] The buggy address belongs to the physical page: [ 286.967880][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51bf2 [ 286.976647][ T5284] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 286.983760][ T5284] page_type: f5(slab) [ 286.987832][ T5284] raw: 00fff00000000000 ffff88813fe21640 dead000000000100 dead000000000122 [ 286.996420][ T5284] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000 [ 287.004998][ T5284] page dumped because: kasan: bad access detected [ 287.011398][ T5284] page_owner tracks the page as allocated [ 287.017192][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 287.038142][ T5284] post_alloc_hook+0xfd/0x120 [ 287.042842][ T5284] get_page_from_freelist+0xf48/0x3530 [ 287.048409][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 287.054324][ T5284] new_slab+0xa2/0x640 [ 287.058406][ T5284] refill_objects+0xe3/0x410 [ 287.063013][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 287.068578][ T5284] __kmalloc_noprof+0x66d/0x820 [ 287.073457][ T5284] do_replace_table+0x4b8/0x760 [ 287.078330][ T5284] xt_replace_table+0x2e/0x130 [ 287.083113][ T5284] __do_replace+0x1cf/0x990 [ 287.087631][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 287.092405][ T5284] nf_setsockopt+0x8d/0xf0 [ 287.096831][ T5284] ipv6_setsockopt+0x135/0x170 [ 287.101603][ T5284] tcp_setsockopt+0xa7/0x100 [ 287.106215][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 287.111175][ T5284] __sys_setsockopt+0x195/0x220 [ 287.116041][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 287.122367][ T5284] __free_frozen_pages+0x79f/0x1090 [ 287.127579][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 287.133146][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 287.137999][ T5284] __get_vm_area_node+0x1ca/0x330 [ 287.143025][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 287.148926][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 287.154043][ T5284] xt_counters_alloc+0x4c/0x70 [ 287.158817][ T5284] __do_replace+0x97/0x990 [ 287.163242][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 287.168019][ T5284] nf_setsockopt+0x8d/0xf0 [ 287.172449][ T5284] ipv6_setsockopt+0x135/0x170 [ 287.177235][ T5284] tcp_setsockopt+0xa7/0x100 [ 287.181872][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 287.186847][ T5284] __sys_setsockopt+0x195/0x220 [ 287.191712][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 287.196853][ T5284] do_syscall_64+0x115/0x870 [ 287.201478][ T5284] [ 287.203830][ T5284] Memory state around the buggy address: [ 287.209455][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 287.217513][ T5284] ffff888051bf2100: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 287.225574][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 287.233646][ T5284] ^ [ 287.240835][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 287.248894][ T5284] ffff888051bf2280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 287.256948][ T5284] ================================================================== [ 287.305101][ T5284] ================================================================== [ 287.313220][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 287.320026][ T5284] Read of size 1 at addr ffff888051bf21e6 by task dhcpcd/5284 [ 287.327586][ T5284] [ 287.329922][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 287.329979][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 287.329995][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 287.330020][ T5284] Call Trace: [ 287.330032][ T5284] [ 287.330045][ T5284] dump_stack_lvl+0x100/0x190 [ 287.330096][ T5284] print_report+0x13d/0x4b0 [ 287.330152][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.330198][ T5284] ? __virt_addr_valid+0x239/0x430 [ 287.330245][ T5284] ? strlen+0x93/0xa0 [ 287.330295][ T5284] kasan_report+0xdf/0x1c0 [ 287.330336][ T5284] ? strlen+0x93/0xa0 [ 287.330392][ T5284] strlen+0x93/0xa0 [ 287.330444][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 287.330517][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 287.330580][ T5284] ? xas_load+0x44/0x5c0 [ 287.330633][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.330682][ T5284] ? xa_find+0x19f/0x3d0 [ 287.330731][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.330781][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.330828][ T5284] ? xa_find+0x1d6/0x3d0 [ 287.330889][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 287.330960][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 287.331019][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331070][ T5284] ? stack_trace_save+0x8e/0xc0 [ 287.331135][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 287.331198][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331244][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331290][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 287.331350][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331396][ T5284] ? find_held_lock+0x2b/0x80 [ 287.331493][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 287.331558][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331603][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 287.331642][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 287.331678][ T5284] ? __alloc_skb+0x185/0x710 [ 287.331735][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331784][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 287.331822][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331868][ T5284] ? __asan_memset+0x23/0x50 [ 287.331920][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.331966][ T5284] ? __alloc_skb+0x4e9/0x710 [ 287.332010][ T5284] ? __alloc_skb+0x5b7/0x710 [ 287.332062][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 287.332112][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 287.332170][ T5284] rtnl_dumpit+0x97/0x1f0 [ 287.332211][ T5284] netlink_dump+0x532/0xd00 [ 287.332251][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 287.332287][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 287.332356][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.332402][ T5284] ? kfree_skbmem+0x19f/0x210 [ 287.332440][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 287.332479][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 287.332514][ T5284] ? __might_fault+0xc5/0x140 [ 287.332570][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.332616][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 287.332655][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.332701][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 287.332741][ T5284] sock_recvmsg+0x1d5/0x220 [ 287.332804][ T5284] ____sys_recvmsg+0x21e/0x670 [ 287.332844][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 287.332914][ T5284] ? rcu_is_watching+0x12/0xc0 [ 287.332968][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.333015][ T5284] ? kfree+0x1e5/0x6c0 [ 287.333072][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 287.333112][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 287.333149][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 287.333190][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.333236][ T5284] ? rcu_is_watching+0x12/0xc0 [ 287.333306][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 287.333360][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 287.333424][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.333474][ T5284] do_syscall_64+0x115/0x870 [ 287.333525][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.333564][ T5284] RIP: 0033:0x7fd8f625f407 [ 287.333594][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 287.333631][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 287.333668][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 287.333695][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 287.333719][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 287.333743][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 287.333767][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 287.333806][ T5284] [ 287.333819][ T5284] [ 287.793577][ T5284] Allocated by task 8934: [ 287.797908][ T5284] kasan_save_stack+0x30/0x50 [ 287.802703][ T5284] kasan_save_track+0x14/0x30 [ 287.807407][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 287.812026][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 287.818477][ T5284] kvasprintf+0xbc/0x150 [ 287.822752][ T5284] kvasprintf_const+0x66/0x1a0 [ 287.827809][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 287.833126][ T5284] dev_set_name+0xc7/0x100 [ 287.837550][ T5284] usb_add_gadget+0x520/0x920 [ 287.842235][ T5284] usb_add_gadget_udc+0x26/0x70 [ 287.847095][ T5284] dummy_udc_probe+0x69e/0x960 [ 287.851866][ T5284] platform_probe+0x106/0x1d0 [ 287.856554][ T5284] really_probe+0x241/0xa60 [ 287.861248][ T5284] __driver_probe_device+0x20e/0x450 [ 287.866552][ T5284] device_driver_attach+0xd1/0x220 [ 287.871683][ T5284] bind_store+0xf4/0x190 [ 287.876018][ T5284] drv_attr_store+0x74/0xb0 [ 287.880560][ T5284] sysfs_kf_write+0xf2/0x150 [ 287.885180][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 287.890477][ T5284] vfs_write+0x6ac/0x1050 [ 287.894825][ T5284] ksys_write+0x12a/0x250 [ 287.899172][ T5284] do_syscall_64+0x115/0x870 [ 287.903785][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.909708][ T5284] [ 287.912023][ T5284] Freed by task 9327: [ 287.915994][ T5284] kasan_save_stack+0x30/0x50 [ 287.920699][ T5284] kasan_save_track+0x14/0x30 [ 287.925402][ T5284] kasan_save_free_info+0x3b/0x70 [ 287.930467][ T5284] __kasan_slab_free+0x5f/0x80 [ 287.935234][ T5284] kfree+0x22b/0x6c0 [ 287.939159][ T5284] kfree_const+0x5a/0x70 [ 287.943421][ T5284] kobject_put+0x218/0x640 [ 287.947862][ T5284] put_device+0x1f/0x30 [ 287.952117][ T5284] platform_remove+0x5f/0x80 [ 287.957152][ T5284] device_remove+0xcb/0x180 [ 287.961676][ T5284] device_release_driver_internal+0x44e/0x620 [ 287.968036][ T5284] unbind_store+0xf8/0x110 [ 287.972462][ T5284] drv_attr_store+0x74/0xb0 [ 287.976969][ T5284] sysfs_kf_write+0xf2/0x150 [ 287.981578][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 287.986877][ T5284] vfs_write+0x6ac/0x1050 [ 287.991227][ T5284] ksys_write+0x12a/0x250 [ 287.995571][ T5284] do_syscall_64+0x115/0x870 [ 288.000184][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.006107][ T5284] [ 288.008423][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 288.008423][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 288.022306][ T5284] The buggy address is located 6 bytes inside of [ 288.022306][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 288.035852][ T5284] [ 288.038170][ T5284] The buggy address belongs to the physical page: [ 288.044570][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51bf2 [ 288.053337][ T5284] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 288.060445][ T5284] page_type: f5(slab) [ 288.064428][ T5284] raw: 00fff00000000000 ffff88813fe21640 dead000000000100 dead000000000122 [ 288.073015][ T5284] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000 [ 288.081634][ T5284] page dumped because: kasan: bad access detected [ 288.088217][ T5284] page_owner tracks the page as allocated [ 288.093922][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 288.114882][ T5284] post_alloc_hook+0xfd/0x120 [ 288.119590][ T5284] get_page_from_freelist+0xf48/0x3530 [ 288.125093][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 288.131020][ T5284] new_slab+0xa2/0x640 [ 288.135107][ T5284] refill_objects+0xe3/0x410 [ 288.139717][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 288.145283][ T5284] __kmalloc_noprof+0x66d/0x820 [ 288.150168][ T5284] do_replace_table+0x4b8/0x760 [ 288.155063][ T5284] xt_replace_table+0x2e/0x130 [ 288.159852][ T5284] __do_replace+0x1cf/0x990 [ 288.164370][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 288.169150][ T5284] nf_setsockopt+0x8d/0xf0 [ 288.173581][ T5284] ipv6_setsockopt+0x135/0x170 [ 288.178366][ T5284] tcp_setsockopt+0xa7/0x100 [ 288.182981][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 288.187943][ T5284] __sys_setsockopt+0x195/0x220 [ 288.192813][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 288.199147][ T5284] __free_frozen_pages+0x79f/0x1090 [ 288.204362][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 288.209932][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 288.214786][ T5284] __get_vm_area_node+0x1ca/0x330 [ 288.219821][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 288.225730][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 288.230855][ T5284] xt_counters_alloc+0x4c/0x70 [ 288.235635][ T5284] __do_replace+0x97/0x990 [ 288.240068][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 288.244850][ T5284] nf_setsockopt+0x8d/0xf0 [ 288.249285][ T5284] ipv6_setsockopt+0x135/0x170 [ 288.254094][ T5284] tcp_setsockopt+0xa7/0x100 [ 288.258714][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 288.263676][ T5284] __sys_setsockopt+0x195/0x220 [ 288.268551][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 288.273685][ T5284] do_syscall_64+0x115/0x870 [ 288.278299][ T5284] [ 288.280611][ T5284] Memory state around the buggy address: [ 288.286235][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 288.294387][ T5284] ffff888051bf2100: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 288.302465][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 288.310517][ T5284] ^ [ 288.317701][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 288.325761][ T5284] ffff888051bf2280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 288.333816][ T5284] ================================================================== [ 288.355552][ T5284] ================================================================== [ 288.363649][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 288.370491][ T5284] Read of size 1 at addr ffff888051bf21e7 by task dhcpcd/5284 [ 288.377981][ T5284] [ 288.380299][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 288.380342][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 288.380354][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 288.380371][ T5284] Call Trace: [ 288.380381][ T5284] [ 288.380391][ T5284] dump_stack_lvl+0x100/0x190 [ 288.380424][ T5284] print_report+0x13d/0x4b0 [ 288.380465][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.380499][ T5284] ? __virt_addr_valid+0x239/0x430 [ 288.380534][ T5284] ? strlen+0x93/0xa0 [ 288.380571][ T5284] kasan_report+0xdf/0x1c0 [ 288.380601][ T5284] ? strlen+0x93/0xa0 [ 288.380647][ T5284] strlen+0x93/0xa0 [ 288.380686][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 288.380739][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 288.380785][ T5284] ? xas_load+0x44/0x5c0 [ 288.380823][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.380858][ T5284] ? xa_find+0x19f/0x3d0 [ 288.380895][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.380931][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.380965][ T5284] ? xa_find+0x1d6/0x3d0 [ 288.381010][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 288.381078][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 288.381129][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381163][ T5284] ? stack_trace_save+0x8e/0xc0 [ 288.381208][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 288.381253][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381287][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381320][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 288.381365][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381398][ T5284] ? find_held_lock+0x2b/0x80 [ 288.381470][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 288.381516][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381549][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 288.381578][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 288.381604][ T5284] ? __alloc_skb+0x185/0x710 [ 288.381647][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381681][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 288.381707][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381741][ T5284] ? __asan_memset+0x23/0x50 [ 288.381778][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.381812][ T5284] ? __alloc_skb+0x4e9/0x710 [ 288.381844][ T5284] ? __alloc_skb+0x5b7/0x710 [ 288.381879][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 288.381915][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 288.381958][ T5284] rtnl_dumpit+0x97/0x1f0 [ 288.381988][ T5284] netlink_dump+0x532/0xd00 [ 288.382017][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 288.382043][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 288.382093][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.382130][ T5284] ? kfree_skbmem+0x19f/0x210 [ 288.382170][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 288.382207][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 288.382233][ T5284] ? __might_fault+0xc5/0x140 [ 288.382274][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.382318][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 288.382357][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.382402][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 288.382430][ T5284] sock_recvmsg+0x1d5/0x220 [ 288.382476][ T5284] ____sys_recvmsg+0x21e/0x670 [ 288.382506][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 288.382558][ T5284] ? rcu_is_watching+0x12/0xc0 [ 288.382598][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.382638][ T5284] ? kfree+0x1e5/0x6c0 [ 288.382675][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 288.382704][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 288.382732][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 288.382762][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.382796][ T5284] ? rcu_is_watching+0x12/0xc0 [ 288.382847][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 288.382887][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 288.382934][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 288.382971][ T5284] do_syscall_64+0x115/0x870 [ 288.383010][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.383039][ T5284] RIP: 0033:0x7fd8f625f407 [ 288.383061][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 288.383088][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 288.383116][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 288.383136][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 288.383154][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 288.383172][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 288.383189][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 288.383217][ T5284] [ 288.383227][ T5284] [ 288.843223][ T5284] Allocated by task 8934: [ 288.847542][ T5284] kasan_save_stack+0x30/0x50 [ 288.852266][ T5284] kasan_save_track+0x14/0x30 [ 288.856980][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 288.861592][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 288.868037][ T5284] kvasprintf+0xbc/0x150 [ 288.872306][ T5284] kvasprintf_const+0x66/0x1a0 [ 288.877095][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 288.882434][ T5284] dev_set_name+0xc7/0x100 [ 288.886855][ T5284] usb_add_gadget+0x520/0x920 [ 288.891737][ T5284] usb_add_gadget_udc+0x26/0x70 [ 288.896596][ T5284] dummy_udc_probe+0x69e/0x960 [ 288.901362][ T5284] platform_probe+0x106/0x1d0 [ 288.906068][ T5284] really_probe+0x241/0xa60 [ 288.910589][ T5284] __driver_probe_device+0x20e/0x450 [ 288.915890][ T5284] device_driver_attach+0xd1/0x220 [ 288.921018][ T5284] bind_store+0xf4/0x190 [ 288.925263][ T5284] drv_attr_store+0x74/0xb0 [ 288.929765][ T5284] sysfs_kf_write+0xf2/0x150 [ 288.934365][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 288.939663][ T5284] vfs_write+0x6ac/0x1050 [ 288.944027][ T5284] ksys_write+0x12a/0x250 [ 288.948371][ T5284] do_syscall_64+0x115/0x870 [ 288.952975][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.958876][ T5284] [ 288.961189][ T5284] Freed by task 9327: [ 288.965207][ T5284] kasan_save_stack+0x30/0x50 [ 288.969913][ T5284] kasan_save_track+0x14/0x30 [ 288.974614][ T5284] kasan_save_free_info+0x3b/0x70 [ 288.979649][ T5284] __kasan_slab_free+0x5f/0x80 [ 288.984413][ T5284] kfree+0x22b/0x6c0 [ 288.988321][ T5284] kfree_const+0x5a/0x70 [ 288.992589][ T5284] kobject_put+0x218/0x640 [ 288.997028][ T5284] put_device+0x1f/0x30 [ 289.001210][ T5284] platform_remove+0x5f/0x80 [ 289.005805][ T5284] device_remove+0xcb/0x180 [ 289.010320][ T5284] device_release_driver_internal+0x44e/0x620 [ 289.016409][ T5284] unbind_store+0xf8/0x110 [ 289.020835][ T5284] drv_attr_store+0x74/0xb0 [ 289.025335][ T5284] sysfs_kf_write+0xf2/0x150 [ 289.029934][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 289.035355][ T5284] vfs_write+0x6ac/0x1050 [ 289.039719][ T5284] ksys_write+0x12a/0x250 [ 289.044067][ T5284] do_syscall_64+0x115/0x870 [ 289.048679][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.054580][ T5284] [ 289.056897][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 289.056897][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 289.070777][ T5284] The buggy address is located 7 bytes inside of [ 289.070777][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 289.084321][ T5284] [ 289.086637][ T5284] The buggy address belongs to the physical page: [ 289.093037][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51bf2 [ 289.101812][ T5284] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 289.109023][ T5284] page_type: f5(slab) [ 289.113015][ T5284] raw: 00fff00000000000 ffff88813fe21640 dead000000000100 dead000000000122 [ 289.121688][ T5284] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000 [ 289.130272][ T5284] page dumped because: kasan: bad access detected [ 289.136703][ T5284] page_owner tracks the page as allocated [ 289.142408][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 289.163357][ T5284] post_alloc_hook+0xfd/0x120 [ 289.168062][ T5284] get_page_from_freelist+0xf48/0x3530 [ 289.173545][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 289.179458][ T5284] new_slab+0xa2/0x640 [ 289.183539][ T5284] refill_objects+0xe3/0x410 [ 289.188144][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 289.193709][ T5284] __kmalloc_noprof+0x66d/0x820 [ 289.198587][ T5284] do_replace_table+0x4b8/0x760 [ 289.203456][ T5284] xt_replace_table+0x2e/0x130 [ 289.208241][ T5284] __do_replace+0x1cf/0x990 [ 289.212783][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 289.217562][ T5284] nf_setsockopt+0x8d/0xf0 [ 289.221989][ T5284] ipv6_setsockopt+0x135/0x170 [ 289.226768][ T5284] tcp_setsockopt+0xa7/0x100 [ 289.231382][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 289.236343][ T5284] __sys_setsockopt+0x195/0x220 [ 289.241207][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 289.247557][ T5284] __free_frozen_pages+0x79f/0x1090 [ 289.252772][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 289.258347][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 289.263200][ T5284] __get_vm_area_node+0x1ca/0x330 [ 289.268316][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 289.274218][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 289.279339][ T5284] xt_counters_alloc+0x4c/0x70 [ 289.284122][ T5284] __do_replace+0x97/0x990 [ 289.288588][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 289.293367][ T5284] nf_setsockopt+0x8d/0xf0 [ 289.297794][ T5284] ipv6_setsockopt+0x135/0x170 [ 289.302657][ T5284] tcp_setsockopt+0xa7/0x100 [ 289.307271][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 289.312578][ T5284] __sys_setsockopt+0x195/0x220 [ 289.317451][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 289.322583][ T5284] do_syscall_64+0x115/0x870 [ 289.327191][ T5284] [ 289.329499][ T5284] Memory state around the buggy address: [ 289.335141][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 289.343205][ T5284] ffff888051bf2100: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 289.351270][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 289.359344][ T5284] ^ [ 289.366551][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 289.374614][ T5284] ffff888051bf2280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 289.382671][ T5284] ================================================================== [ 289.397069][ T5284] ================================================================== [ 289.405144][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 289.411937][ T5284] Read of size 1 at addr ffff888051bf21e8 by task dhcpcd/5284 [ 289.419387][ T5284] [ 289.421727][ T5284] CPU: 1 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 289.421788][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 289.421805][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 289.421828][ T5284] Call Trace: [ 289.421841][ T5284] [ 289.421854][ T5284] dump_stack_lvl+0x100/0x190 [ 289.421899][ T5284] print_report+0x13d/0x4b0 [ 289.421955][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.422003][ T5284] ? __virt_addr_valid+0x239/0x430 [ 289.422052][ T5284] ? strlen+0x93/0xa0 [ 289.422104][ T5284] kasan_report+0xdf/0x1c0 [ 289.422147][ T5284] ? strlen+0x93/0xa0 [ 289.422205][ T5284] strlen+0x93/0xa0 [ 289.422258][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 289.422331][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 289.422395][ T5284] ? xas_load+0x44/0x5c0 [ 289.422446][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.422496][ T5284] ? xa_find+0x19f/0x3d0 [ 289.422545][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.422598][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.422645][ T5284] ? xa_find+0x1d6/0x3d0 [ 289.422716][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 289.422787][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 289.422847][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.422895][ T5284] ? stack_trace_save+0x8e/0xc0 [ 289.422959][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 289.423021][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423069][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423117][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 289.423179][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423226][ T5284] ? find_held_lock+0x2b/0x80 [ 289.423326][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 289.423393][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423440][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 289.423480][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 289.423517][ T5284] ? __alloc_skb+0x185/0x710 [ 289.423570][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423617][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 289.423653][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423707][ T5284] ? __asan_memset+0x23/0x50 [ 289.423759][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.423806][ T5284] ? __alloc_skb+0x4e9/0x710 [ 289.423852][ T5284] ? __alloc_skb+0x5b7/0x710 [ 289.423899][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 289.423950][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 289.424009][ T5284] rtnl_dumpit+0x97/0x1f0 [ 289.424049][ T5284] netlink_dump+0x532/0xd00 [ 289.424090][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 289.424125][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 289.424194][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.424240][ T5284] ? kfree_skbmem+0x19f/0x210 [ 289.424278][ T5284] netlink_recvmsg+0x7dc/0xa90 [ 289.424319][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 289.424355][ T5284] ? __might_fault+0xc5/0x140 [ 289.424411][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.424457][ T5284] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 289.424498][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.424546][ T5284] ? __pfx_netlink_recvmsg+0x10/0x10 [ 289.424587][ T5284] sock_recvmsg+0x1d5/0x220 [ 289.424650][ T5284] ____sys_recvmsg+0x21e/0x670 [ 289.424697][ T5284] ? __pfx_____sys_recvmsg+0x10/0x10 [ 289.424769][ T5284] ? rcu_is_watching+0x12/0xc0 [ 289.424825][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.424872][ T5284] ? kfree+0x1e5/0x6c0 [ 289.424923][ T5284] ___sys_recvmsg+0x16a/0x1a0 [ 289.424963][ T5284] ? __pfx____sys_recvmsg+0x10/0x10 [ 289.425000][ T5284] ? apparmor_socket_sendmsg+0x15b/0x270 [ 289.425042][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.425089][ T5284] ? rcu_is_watching+0x12/0xc0 [ 289.425160][ T5284] __x64_sys_recvmsg+0x19a/0x260 [ 289.425215][ T5284] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 289.425280][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.425332][ T5284] do_syscall_64+0x115/0x870 [ 289.425385][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.425425][ T5284] RIP: 0033:0x7fd8f625f407 [ 289.425455][ T5284] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 289.425493][ T5284] RSP: 002b:00007ffd0311f780 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 289.425531][ T5284] RAX: ffffffffffffffda RBX: 00007fd8f61d5780 RCX: 00007fd8f625f407 [ 289.425557][ T5284] RDX: 0000000000000000 RSI: 00007ffd0311f810 RDI: 000000000000002e [ 289.425582][ T5284] RBP: 00007ffd0311f7f4 R08: 0000000000000000 R09: 0000000000000000 [ 289.425606][ T5284] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001f40 [ 289.425630][ T5284] R13: 00007ffd0311f800 R14: 00007ffd0311f8f0 R15: 0000000000000000 [ 289.425675][ T5284] [ 289.425689][ T5284] [ 289.885787][ T5284] Allocated by task 8934: [ 289.890150][ T5284] kasan_save_stack+0x30/0x50 [ 289.894864][ T5284] kasan_save_track+0x14/0x30 [ 289.899576][ T5284] __kasan_kmalloc+0xaa/0xb0 [ 289.904188][ T5284] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 289.910627][ T5284] kvasprintf+0xbc/0x150 [ 289.914884][ T5284] kvasprintf_const+0x66/0x1a0 [ 289.919669][ T5284] kobject_set_name_vargs+0x5a/0x140 [ 289.924970][ T5284] dev_set_name+0xc7/0x100 [ 289.929383][ T5284] usb_add_gadget+0x520/0x920 [ 289.934059][ T5284] usb_add_gadget_udc+0x26/0x70 [ 289.938916][ T5284] dummy_udc_probe+0x69e/0x960 [ 289.943675][ T5284] platform_probe+0x106/0x1d0 [ 289.948353][ T5284] really_probe+0x241/0xa60 [ 289.952872][ T5284] __driver_probe_device+0x20e/0x450 [ 289.958273][ T5284] device_driver_attach+0xd1/0x220 [ 289.963392][ T5284] bind_store+0xf4/0x190 [ 289.967722][ T5284] drv_attr_store+0x74/0xb0 [ 289.972228][ T5284] sysfs_kf_write+0xf2/0x150 [ 289.976835][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 289.982133][ T5284] vfs_write+0x6ac/0x1050 [ 289.986468][ T5284] ksys_write+0x12a/0x250 [ 289.990861][ T5284] do_syscall_64+0x115/0x870 [ 289.995462][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 290.001372][ T5284] [ 290.003693][ T5284] Freed by task 9327: [ 290.007660][ T5284] kasan_save_stack+0x30/0x50 [ 290.012375][ T5284] kasan_save_track+0x14/0x30 [ 290.017109][ T5284] kasan_save_free_info+0x3b/0x70 [ 290.022163][ T5284] __kasan_slab_free+0x5f/0x80 [ 290.026922][ T5284] kfree+0x22b/0x6c0 [ 290.030822][ T5284] kfree_const+0x5a/0x70 [ 290.035095][ T5284] kobject_put+0x218/0x640 [ 290.039522][ T5284] put_device+0x1f/0x30 [ 290.043674][ T5284] platform_remove+0x5f/0x80 [ 290.048284][ T5284] device_remove+0xcb/0x180 [ 290.052831][ T5284] device_release_driver_internal+0x44e/0x620 [ 290.058917][ T5284] unbind_store+0xf8/0x110 [ 290.063370][ T5284] drv_attr_store+0x74/0xb0 [ 290.067868][ T5284] sysfs_kf_write+0xf2/0x150 [ 290.072473][ T5284] kernfs_fop_write_iter+0x3e0/0x5f0 [ 290.077753][ T5284] vfs_write+0x6ac/0x1050 [ 290.082085][ T5284] ksys_write+0x12a/0x250 [ 290.086593][ T5284] do_syscall_64+0x115/0x870 [ 290.091194][ T5284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 290.097083][ T5284] [ 290.099407][ T5284] The buggy address belongs to the object at ffff888051bf21e0 [ 290.099407][ T5284] which belongs to the cache kmalloc-16 of size 16 [ 290.113320][ T5284] The buggy address is located 8 bytes inside of [ 290.113320][ T5284] freed 16-byte region [ffff888051bf21e0, ffff888051bf21f0) [ 290.126896][ T5284] [ 290.129225][ T5284] The buggy address belongs to the physical page: [ 290.135654][ T5284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51bf2 [ 290.144419][ T5284] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 290.151550][ T5284] page_type: f5(slab) [ 290.155537][ T5284] raw: 00fff00000000000 ffff88813fe21640 dead000000000100 dead000000000122 [ 290.164164][ T5284] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000 [ 290.172762][ T5284] page dumped because: kasan: bad access detected [ 290.179166][ T5284] page_owner tracks the page as allocated [ 290.184868][ T5284] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7915, tgid 7915 (syz-executor), ts 252430943337, free_ts 252430862347 [ 290.205825][ T5284] post_alloc_hook+0xfd/0x120 [ 290.210545][ T5284] get_page_from_freelist+0xf48/0x3530 [ 290.216057][ T5284] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 290.221997][ T5284] new_slab+0xa2/0x640 [ 290.226111][ T5284] refill_objects+0xe3/0x410 [ 290.230710][ T5284] __pcs_replace_empty_main+0x376/0x680 [ 290.236281][ T5284] __kmalloc_noprof+0x66d/0x820 [ 290.241156][ T5284] do_replace_table+0x4b8/0x760 [ 290.246024][ T5284] xt_replace_table+0x2e/0x130 [ 290.250806][ T5284] __do_replace+0x1cf/0x990 [ 290.255320][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 290.260109][ T5284] nf_setsockopt+0x8d/0xf0 [ 290.264542][ T5284] ipv6_setsockopt+0x135/0x170 [ 290.269318][ T5284] tcp_setsockopt+0xa7/0x100 [ 290.273943][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 290.278949][ T5284] __sys_setsockopt+0x195/0x220 [ 290.283831][ T5284] page last free pid 7915 tgid 7915 stack trace: [ 290.290164][ T5284] __free_frozen_pages+0x79f/0x1090 [ 290.295374][ T5284] __kasan_populate_vmalloc+0x164/0x210 [ 290.300931][ T5284] alloc_vmap_area+0x95d/0x2bb0 [ 290.305781][ T5284] __get_vm_area_node+0x1ca/0x330 [ 290.310816][ T5284] __vmalloc_node_range_noprof+0x228/0x1630 [ 290.316728][ T5284] __vmalloc_node_noprof+0xad/0xf0 [ 290.321865][ T5284] xt_counters_alloc+0x4c/0x70 [ 290.326640][ T5284] __do_replace+0x97/0x990 [ 290.331077][ T5284] do_ip6t_set_ctl+0xa5f/0xd00 [ 290.335848][ T5284] nf_setsockopt+0x8d/0xf0 [ 290.340276][ T5284] ipv6_setsockopt+0x135/0x170 [ 290.345052][ T5284] tcp_setsockopt+0xa7/0x100 [ 290.349727][ T5284] do_sock_setsockopt+0xf3/0x1d0 [ 290.354674][ T5284] __sys_setsockopt+0x195/0x220 [ 290.359534][ T5284] __x64_sys_setsockopt+0xbd/0x160 [ 290.364676][ T5284] do_syscall_64+0x115/0x870 [ 290.369273][ T5284] [ 290.371593][ T5284] Memory state around the buggy address: [ 290.377213][ T5284] ffff888051bf2080: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 290.385269][ T5284] ffff888051bf2100: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 290.393320][ T5284] >ffff888051bf2180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 290.401366][ T5284] ^ [ 290.408813][ T5284] ffff888051bf2200: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 290.416875][ T5284] ffff888051bf2280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 290.424924][ T5284] ================================================================== [ 290.489681][ T5284] ================================================================== [ 290.497776][ T5284] BUG: KASAN: slab-use-after-free in strlen+0x93/0xa0 [ 290.504568][ T5284] Read of size 1 at addr ffff888051bf21e9 by task dhcpcd/5284 [ 290.512043][ T5284] [ 290.514377][ T5284] CPU: 1 UID: 0 PID: 5284 Comm: dhcpcd Tainted: G B L syzkaller #0 PREEMPT(full) [ 290.514432][ T5284] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 290.514446][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 290.514468][ T5284] Call Trace: [ 290.514479][ T5284] [ 290.514491][ T5284] dump_stack_lvl+0x100/0x190 [ 290.514532][ T5284] print_report+0x13d/0x4b0 [ 290.514583][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.514626][ T5284] ? __virt_addr_valid+0x239/0x430 [ 290.514670][ T5284] ? strlen+0x93/0xa0 [ 290.514716][ T5284] kasan_report+0xdf/0x1c0 [ 290.514754][ T5284] ? strlen+0x93/0xa0 [ 290.514806][ T5284] strlen+0x93/0xa0 [ 290.514854][ T5284] rtnl_fill_ifinfo.isra.0+0x1d81/0x5560 [ 290.514920][ T5284] ? __pfx_rtnl_fill_ifinfo.isra.0+0x10/0x10 [ 290.514979][ T5284] ? xas_load+0x44/0x5c0 [ 290.515027][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515070][ T5284] ? xa_find+0x19f/0x3d0 [ 290.515116][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515167][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515208][ T5284] ? xa_find+0x1d6/0x3d0 [ 290.515264][ T5284] rtnl_dump_ifinfo+0xcd8/0x14b0 [ 290.515329][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 290.515383][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515425][ T5284] ? stack_trace_save+0x8e/0xc0 [ 290.515482][ T5284] ? __pfx_stack_trace_save+0x10/0x10 [ 290.515537][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515580][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515622][ T5284] ? stack_depot_save_flags+0x27/0x9d0 [ 290.515677][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515719][ T5284] ? find_held_lock+0x2b/0x80 [ 290.515808][ T5284] ? __kmalloc_node_track_caller_noprof+0x34f/0x830 [ 290.515867][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.515909][ T5284] ? trace_kmem_cache_alloc+0xdd/0x100 [ 290.515944][ T5284] ? __kasan_slab_alloc+0x89/0x90 [ 290.515976][ T5284] ? __alloc_skb+0x185/0x710 [ 290.516023][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.516065][ T5284] ? kmalloc_reserve+0xf9/0x350 [ 290.516097][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.516143][ T5284] ? __asan_memset+0x23/0x50 [ 290.516191][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.516233][ T5284] ? __alloc_skb+0x4e9/0x710 [ 290.516273][ T5284] ? __alloc_skb+0x5b7/0x710 [ 290.516315][ T5284] ? __pfx___alloc_skb+0x10/0x10 [ 290.516360][ T5284] ? __pfx_rtnl_dump_ifinfo+0x10/0x10 [ 290.516414][ T5284] rtnl_dumpit+0x97/0x1f0 [ 290.516451][ T5284] netlink_dump+0x532/0xd00 [ 290.516487][ T5284] ? __pfx_netlink_dump+0x10/0x10 [ 290.516518][ T5284] ? kasan_quarantine_put+0x104/0x240 [ 290.516581][ T5284] ? srso_alias_return_thunk+0x5/0xfbef5 [ 290.516623][ T5284] ? kfree_skbmem+0x19f/0x210 [ 290.516659][ T5284] netlink_recvmsg+0x7dc/0xa90