last executing test programs: 3m24.71147102s ago: executing program 3 (id=109): r0 = open(&(0x7f0000002000)='./bus\x00', 0x103042, 0x0) ftruncate(r0, 0x2007fff) r1 = open(&(0x7f0000000400)='./bus\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/19, 0xfffffe47) ftruncate(r0, 0x0) 3m24.288091348s ago: executing program 3 (id=116): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x9e9d1000) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r1 = memfd_create(&(0x7f0000002a40)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad;\x92\n\x8d\xb6I\x1fQ\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\xa7Wd\xa4Eu\x8cs\xe0\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceYH\x8f\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xbf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xb6\x87\xa43\xdc50V-\x13F\xb6&\xcb\xa3\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xad\xcf`*8&\feeV\x17U=(\xff\xe5t\xe4\xe6\xd8\x8f\x81\xa02\xfed\xde\x03\xdbN98\xb1\x8b\xccg2_\xc4bA\xf1\xf8\xfb\xf8\xd0\xfb_\x1e\"\xedF\x17$\x9e\xd8\xae\xc1\xaf\xee%\x1c\xc6V\x17\x03\xa6&\xa86\xc3\xd5\x02\x10g\x02(EI\x8d\x19\xefJ\xc1x\x92\x8c\x05\xb9\xd2Y\xa0\x13|\x95\xce\x86in\xd4\xd0\xb4\x02?gl\x8f\x1e\xa0\xe5\xf9\xe5\xc9\x9eG\xa9\x14\xff\xe2p\xb4\xda\x1b\t\xc7t\xe3\xe8\xb2\xa5\\\xc6\f\r\xb4\xc1o\x9aS\xf2+\xf7\r04\xb3\xf8\xe38\v\xa4\xbdf', 0x1) mmap(&(0x7f00001d1000/0x3000)=nil, 0x3000, 0x1800006, 0x11, r1, 0xda61000) read$FUSE(r0, &(0x7f0000000640)={0x2020}, 0x2058) 3m24.156509285s ago: executing program 3 (id=118): setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108) 3m23.964618974s ago: executing program 3 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x1008002, &(0x7f0000000d00)={[{@grpjquota}]}, 0x3, 0x5ee, &(0x7f0000000280)="$eJzs3c1vVFUbAPDnTj9oKXk7kDcqLqSJMZAoLS1gGuMCtoY0+BE3urDSgkiBhtZo0YSS4MbEuDHGxJUL8b9QIltWunLhxpUhIWpYmjjmztxbOu1Mv2jnEu7vlwxz7zlze86lfeace+acOwGU1lD6TyVif0TMJhGDyeJSXndkmUON193/+5Mz6SOJWu31P5NIsrT89Un2PJAd3BcRP/+UxL6u1eXOLVy9MDkzM30l2x+Zvzg7Mrdw9fD5i5Pnps9NXxp7cWz8+LHj46NHtnRe11qknbrx/oeDn0289d03/ySj3/82kcSJeCV74fLz2C5DMVT/P0lWZw2Mb3dhBenK/k5qtVotT0u6i60TG5f//noi4skYjK548MsbjE9fLbRywI6qJY33bqCMEvEPJZX3A/Jr+5XXwZVCeiVAJ9w72RgAWB3/3Y2xweirjw3svp/E8mGdJCK2NjLXbE9E3Lk9cePs7YkbsUPjcEBri9cj4qlW8Z/U478afVGtx3+lKf7TfsHp7DlNf22L5a8cKhb/0DmN+O9bM/6jTfy/kz5fa8Twu1ssv/pg873+pvjv3+opAQAAAAAAQGndOhkRL7T6/L+yNP8nWsz/GYiIE9tQ/tCK/dWf/1fubkMxQAv3Tka83HL+byWf/VvtWraEtRo9ydnzM9NHIuJ/EXEoenal+6NrlHH4831ft8sbyub/5Y+0/DvZXMCsHne7dzUfMzU5P/kQpwxk7l2PeLrl/N9kqf1PWrT/6TvD7AbL2PfczdPt8taPf2Cn1L6NONiy/X9w14pk7ftzjNT7AyN5r2C1Zz7+4od25W81/t1iAh5e2v7vXjv+q8ny+/XMbb6MowvdtXZ5W+3/9yZv1O8q1JulfTQ5P39lNKI3OdWVpjalj22+zvA4yuMhj5c0/g89u/b4X6v+f39ELK742clfzWuKc0/8O/B7u/ro/0Nx0vif2lT7v/mNsZvVH9uVv7H2/1i9rT+UpRj/g4av8jDtbU5vEY7drbI6XV8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBxUImJPJJXhpe1KZXg4YiAi/h+7KzOX5+afP3v5g0tTaV79+/8r+Tf9Djb2k/z7/6vL9sdW7B+NiL0R8WVXf31/+MzlmamiTx4AAAAAAAAAAAAAAAAAAAAeEQNt1v+n/ugqunbAjusuugJAYVrE/y9F1APoPO0/lJf4h/IS/1Be4h/KS/xDea0d/2+Pd6wiQMdp/6G8xD8AAAAAADxW9h649WsSEYsv9dcfqd4sr6fQmgE7rVJ0BYDCuMUPlJepP1BervGBZJ38vrYHrXfkWmbPPMTBAAAAAAAAAAAAAFA6B/db/w9lZf0/lJf1/1Be+fr/AwXXA+g81/hArLOSv+X6/3WPAgAAAAAAAAAAAAC209zC1QuTMzPTV2y8+WhUo5MbtVrtWvpX8KjUZ/s3kmyGekcKzafCd/5Mezdygvlav4395OLekwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGb/BQAA//8wviV5") syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340), &(0x7f0000000380), 0x64, 0x1) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) 3m23.677241114s ago: executing program 3 (id=121): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x804810, &(0x7f0000000b80)={[{@init_itable}, {@usrjquota}, {@nobh}, {@resuid}]}, 0x26, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") chdir(&(0x7f0000000040)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x86400, 0x0) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000a40)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) 3m22.527988941s ago: executing program 3 (id=131): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000700)=ANY=[@ANYBLOB="fc000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001000000000000004400050000000000000000000000ffff7f000001000000003c"], 0xfc}}, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) 3m22.297890508s ago: executing program 32 (id=131): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000700)=ANY=[@ANYBLOB="fc000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001000000000000004400050000000000000000000000ffff7f000001000000003c"], 0xfc}}, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) 2m50.606389284s ago: executing program 2 (id=427): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x439, 0x0, 0x60000, {0x0, 0x0, 0x0, 0x0, 0x9801}}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x800) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m49.953649809s ago: executing program 2 (id=433): clock_nanosleep(0xb, 0x0, &(0x7f0000000000)={0x77359400}, 0xfffffffffffffffe) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) 2m49.65700079s ago: executing program 2 (id=434): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x34, &(0x7f0000000240)={&(0x7f0000000040)={0x1, 0x840, 0x800, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{0x3, 0x1, 0x1, 0x1}, 0x3, 0x2, 0x0, 0x0, "5e3dba8ae862e81c"}}, 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)={0x1, 0x944, 0x1, {0x0, 0xea60}, {}, {}, 0x1, @canfd={{0x0, 0x1, 0x1}, 0xaf, 0x3, 0x0, 0x0, "f1b68c3e70a5d4bb02ab9dd1826faf62d4bcfd6c350a928a417ccf61f72b6378965ff4776ad1e8e0b6d8bc529caeb5e8ff90381a02e9b1826bd45bc45cb236d7"}}, 0x80}, 0x1, 0x0, 0x0, 0x20000040}, 0x8050) 2m49.498634763s ago: executing program 2 (id=437): socket$inet(0x2, 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x200000, &(0x7f0000000100), 0x1, 0x50d, &(0x7f0000001bc0)="$eJzs3c9vI1cdAPDveGPHyaZNWnoABO3SFha0WifxtlHVA5QTQqgSokeQtiHxRlHsOIqd0oQ9pGckTkhU4gRH/gDOPSFx5ILgxqUckPgRgRokDkYzHqdO1t5NyQ+n8ecjzc5787z+vrfZeS/+JvYLYGzdioj9iChFxNsRMZtfT/Ij3uge6eM+Oni4cnjwcCWJTuetfyRZe3ot+v5O6mb+nOWI+N63In6YPBq3tbu3sVyv17bz+ny7sTXf2t27u95YXqut1Tar1aXFpYXX7r1aPbexvtAo5aUvfvj7/a/9OO3WTH6lfxznqTv04lGc1EREfOcigo3AjXw8pVF3hP9LISKejYgXs/t/Nm5kX00A4DrrdGajM9tfP5IcrwIA10Uhy4ElhUqeC5iJQqFS6ebwnovpQr3Zat950NzZXO3myuaiWHiwXq8t5LnCuSgmaX0xK39cr56o34uIZyLiZ5NTWb2y0qyvjvIbHwAYYzdPrP//nuyu/wDANVcedQcAgEtn/QeA8WP9B4DxY/0HgPHTXf+nRt0NAOASef0PAOPH+g8AY+W7b76ZHp3D/POvV9/Z3dlovnN3tdbaqDR2Viorze2tylqzuZZ9Zk/jSc9Xbza3Fl+JnXfnvr7Vas+3dvfuN5o7m+372ed6368Vs0ftX8LIAIBhnnnhgz8l6Yr8+lR2RN9eDsWR9gy4aIVRdwAYmRuj7gAwMnb7gvF1htf4xYifShHAp9rvsj8HbNF7THnQG4Q6nU7noroFXLjbn5P/h3HVl//3W8AwZuT/YXzJ/8P46nSS027yH6d9IABwtcnxA0N+/v9sfv51/sOBH6yefMT7F9krAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuNp6+/9W8r3AZ6JQqFQinoqIuSgmD9brtYWIeDoi/jhZnEzriyPuMwBwVoW/Jvn+X7dnX5451vT8zaNiKSJ+9Iu3fv7ucru9/YeIUvLPyd719vv59eonClw6rxEAAI/XW6ezc98L+Y8OHq70jsvsz9++GRHlbvzDg1IcHsWfiInsXI5iREz/K8nrXUlf7uIs9t+LiM8OGn8SM1kOpLvz6cn4aeynLjV+4Vj8QtbWPaf/Fp85h77AuPkgnX/eGHT/FeJWdh58/5ezGers8vkvfaqVw2wO/Dh+b/67MWT+u3XaGK/89tvd0tSjbe9FfH4iohf7sG/+6cVPhsR/+ZTx//yF518c1tb5ZcTtGBy/P9Z8u7E139rdu7veWF6rrdU2q9WlxaWF1+69Wp3PctTzw1eDv79+5+lhben4p4fELz9h/F8+5fh/9d+3v/+lx8T/6kuD4hfiucfET9fEr5wy/vL0b8rD2tL4q0PG/6Sv/51Txv/wL3uPbBsOAIxOa3dvY7ler20rKFz9Qvpf9gp0Y2DhG5cVqxSDm37yUveePtHU+97/E8YaNmOcR9YNuAqObvqI+M+oOwMAAAAAAAAAAAAAAAx0Ge9YGvUYAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuL7+FwAA//87osfs") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r1 = syz_open_dev$loop(&(0x7f00000002c0), 0x1a33, 0x40901) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) 2m48.982096769s ago: executing program 2 (id=442): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000280)={[{0x2b, 'cpuset'}]}, 0x8) 2m48.429082334s ago: executing program 2 (id=449): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\n'], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r1}, 0xc) 2m47.908712961s ago: executing program 33 (id=449): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\n'], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r1}, 0xc) 1m43.267680242s ago: executing program 1 (id=1002): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) prctl$PR_CAPBSET_DROP(0x18, 0x4) 1m42.929443911s ago: executing program 1 (id=1004): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x7ff, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x1, r1}) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) 1m42.828184442s ago: executing program 1 (id=1005): mknod$loop(&(0x7f00000006c0)='./file0\x00', 0x100, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file3\x00', 0xc1c0, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x30, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./file3\x00', 0x2) 1m42.723855284s ago: executing program 1 (id=1006): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000003200)='./file1\x00', 0x2204206, &(0x7f0000003240)=ANY=[], 0x4, 0x33f, &(0x7f0000000500)="$eJzs3EtrM1UYwPEn98vLm2QhioL0oBvdDG10LQZ5C2LA0jZiKwjTdqIhY1IyoRIR267cintXgovSZXcF9Qt04043btx1I7iwC3Vkbk1mkjRtTE3f9v+Ddk6ec57JXE7KM0Mn5+9/9Umzbml1vSvxrJKYiMiFSEniEoj5y7jbTsugA3n10R8/v7i2sflOpVp9sqrUcmX9tbJSqrDw/aef5/xhpxk5K314/nv5t7Nnz54//2f944alGpZqtbtKV1vtX7v6lmmonYbV1JRaMQ3dMlSjZRkdr7/t9dfN9u5uT+mtnccpf82tnmoaPdVtq26np/SP9EZLaZqmHucFk9SOVlf1ypTJ2zPeGMxAZkSs06noCRHJDfXUjv6XjQIAAHdKtP6POyX9VPW/FNz63xncr/+PX/qx++i9k4Jf/5+mR9X/r//irStU/2ed2v6K+j+/2zEsS+nR+v8buUH9P1wRPSz/qf7H3bCQHgrFQq+c+j/vf35dhx8cL7oN6n8AAAAAAAAAAAAAAAAAAAAAAJ4GF7ZdtG27GCyDn/4jBP5r3Evjzn9GRLLO2bc5//fZ2samZN0H95xzbH65V9ureUun92/bI4YsSlH+cudDEBPbDp48Uo6S/GDu+/n7e7WE21OpS0NMMWRJilKK5tv28tvVJ0vK4+dfPqaUH8wvS1GeGZ1fDuf775+WV14eyNekKD9tS1tM2XHndT//iyWl3nq3GsnPueMAAAAAALgPNHUpdP2eE+/6XdNG9zu/Y971eVZk3P0B7/p6ceT1ebL4QnLeew8AAAAAwMNg9T5r6qZpdK5o5GTymOkbyesNTkciqasGJwb28Lrbk3ZvZIiMG5OIHLHUmDV/e82jGmoE/0gR6sr6wekOb7D/MztfB4ORuEzOyiSjG7/gBNQN3/3Q35HLSHDbKD3mOMvK8HrioZlQCM2N1Mzm83Nff/fn7D4gb5wEM2Dy4MOByLiZObKRjc46t5G6rb83AAAAAOanX/QHkTcHu2Nz2SgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB6YW/lKv0hj3vsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3BX/BgAA//+vq/Iq") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x842, 0x22) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0) syz_clone3(&(0x7f0000000540)={0x901400, &(0x7f0000000040), 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) fsync(r0) 1m42.373064726s ago: executing program 1 (id=1009): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f00000006c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r0, 0xc03064b7, &(0x7f00000001c0)={r1, r2, r3, 0xffffffff, 0xb, 0xddffffff, 0x4, 0x0, 0x8, 0x7, 0x0, 0x40000}) 1m41.931511197s ago: executing program 1 (id=1012): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x40000, 0x20) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a0b0400000000000000000200000038000480340001800b0001006e756d67656e000024000280080002400000080008000140000000080800034000000000080004400000ff460900010073797a30000000000900020073797a320000000014000000110001"], 0x8c}}, 0x4044) close_range(r0, 0xffffffffffffffff, 0x0) 1m41.458772535s ago: executing program 34 (id=1012): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x40000, 0x20) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a0b0400000000000000000200000038000480340001800b0001006e756d67656e000024000280080002400000080008000140000000080800034000000000080004400000ff460900010073797a30000000000900020073797a320000000014000000110001"], 0x8c}}, 0x4044) close_range(r0, 0xffffffffffffffff, 0x0) 1m34.45858027s ago: executing program 4 (id=1059): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x26, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) open(0x0, 0x4c27e, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000a80)={0x1, 0x3, 0x1000, 0x3c, 0x0, 0x0, 0x0, 0x0}) 1m34.006520783s ago: executing program 4 (id=1062): syz_mount_image$minix(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0041e96a0f5e69f9a7f61c16124cb6d02711dffa581b9544ce66de31fff051ad15c004c6c6a100a59056ebb6bf9f1d33af"], 0x1, 0x156, &(0x7f0000000240)="$eJzs271OwlAYxvHnAALiF4o6GAcTB12kfEQSN70UApUQixpxgTjoFXgN3pkXoIObkxgawEQ+mkjsifb/W/o2T0/6djjtu1QAIutUezIySvZPdtPZx5yx3RKAkPQGx48egOiJv9vuAIAdr2fSs6SXt7ua4smx+aCf3w/zWGo8f5B2EoPcpLX4fb54kg6G601m4vrMKF+amB/uD++/rBWtak1ZrWtDuUFeH63fnmMSAgAgOozyQfnMC2I6b3puYWq+4OfFqXnSz0sBeXlqnvLzfO3Kq89qE8AEsTn3fzxg/ycC9j8Ae9qd7kXV89wbCgoKilFh+80E4Lc5t61rp93pHjVb1YbbcC9LhcJJ5bhcrJQcf7J3Zs/3AP6ur4++7U4AAAAAAAAAAAAAAMBPbWrLdgsAAAAAQhLG70S2nxEAAAAAAAAAAAAAAAAAgP/mMwAA//9E/CIc") munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 1m33.485103481s ago: executing program 4 (id=1066): io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000080), r0) write(0xffffffffffffffff, &(0x7f0000000014)="050001", 0x3) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {0x2}}, 0x1c}}, 0x0) 1m33.220532155s ago: executing program 4 (id=1068): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) 1m33.010275289s ago: executing program 4 (id=1071): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000180)='./bus\x00', 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB='errors=continue,checkpoint_merge,alloc_mode=default,active_logs=6,acl,fault_injection=00000000000000001262,acl,noacl,compress_cache,alloc_mode=default,noextent_cache,compress_cache,mode=lfs,\x00\x00\x00'], 0x1, 0x5505, &(0x7f0000002480)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") r0 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) ftruncate(r0, 0x2007ffc) sendfile(r0, r0, 0x0, 0x2000000000006) lseek(r0, 0x8, 0x4) 1m32.649752303s ago: executing program 4 (id=1074): set_mempolicy(0x4005, 0x0, 0x6) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000000)={{@my=0x1, 0xffffffff}, @any, 0x0, 0x0, 0x8000000, 0x0, 0x6}) 1m32.162170334s ago: executing program 35 (id=1074): set_mempolicy(0x4005, 0x0, 0x6) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000000)={{@my=0x1, 0xffffffff}, @any, 0x0, 0x0, 0x8000000, 0x0, 0x6}) 9.451065908s ago: executing program 5 (id=1726): syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000009002108ab12a390eb7c000000010902240100000000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000001bc0)=ANY=[], 0x15) r0 = dup(0xffffffffffffffff) write$FUSE_BMAP(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000600)=ANY=[@ANYBLOB="040e2407570cd717e2ef9c17ceda6aabf647ffeec54ee18558cd27c1420f9221"], 0x27) 6.303196508s ago: executing program 5 (id=1765): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000b98bc2c900000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000001}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x6, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000005880)={r1, 0x2000000, 0xe, 0x1e, &(0x7f0000001240)="14051b5ae730a16b38ec3c25a36f", 0x0, 0x201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa}, 0x50) 5.980141685s ago: executing program 5 (id=1767): setns(0xc9, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) r0 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x400261f2, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 5.778207967s ago: executing program 5 (id=1769): syz_mount_image$vfat(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x10000, 0xffffffffffffffff, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f0000000380)='./file0/../file0/../file0\x00', &(0x7f00000000c0)='./file0\x00') 5.667858369s ago: executing program 5 (id=1771): syz_usb_connect(0x6, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120141014813442024040001000010000904b8070259d1ca000905060200020d00060905820200020d320ca0dd6ca2e0f78c14008db45e3f86e911489248b400660ceb55"], 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000010000), 0x20080, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r0, 0x400454d1, &(0x7f00000000c0)={0x0, 0x0}) 5.282636709s ago: executing program 5 (id=1779): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) 5.019848563s ago: executing program 36 (id=1779): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) 3.692422828s ago: executing program 6 (id=1786): chdir(&(0x7f0000000000)='./cgroup\x00') r0 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r0, &(0x7f0000001fc0)=""/184, 0xd2) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 3.448089058s ago: executing program 6 (id=1787): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000002140)=0x20) ppoll(&(0x7f00000003c0)=[{r0, 0x20}], 0x1, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000f, 0x11, r0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000000c0)=0x4000) 2.980440764s ago: executing program 0 (id=1790): writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)}], 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000003240)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x1, @private1, 0x3}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000300)="14", 0x1}], 0x1}}], 0x1, 0x8040) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x7d, &(0x7f0000000840)=""/4127, &(0x7f0000000000)=0x101f) 2.928728595s ago: executing program 0 (id=1791): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000100), 0x2, 0x4fd, &(0x7f0000000b00)="$eJzs3ctvW1kZAPDv3jycyWQmGZgFoAHKMFBQVTtxZ6LRbBhWI4RGQsySRSckThTFiaPYGZrQRbpkj0QlVrDiHwCJBVJX7JFYwI5NWSDxqEANEgsjX19nnIcbq03sNv79pCufe47t75xa9xzrc3NPACPrWkQcRMRkRHwcEbN5fZIf8X77aD3v8aO7y4eP7i4n0Wx+9M8ka2/VRddrWl7O33MqIr7/QcQPkxNB/xhR39vfWKpWKzt5VamxuV2q7+3fXN9cWqusVbbK5cWFxfl3b71TvqCR/vqo9LvffvHhHw6++eNWt2byuu5xXKT20CeO4rSMR8R3LyPYEIzl45l8mhc/1Yu4SGlEfCYi3syu/9kYyz7N445/TN+K/NIGAF5QzeZsNGe7zwGAqy7NcmBJWsxzATORpsViO4f3ekyn1Vq9cWO1tru10s6VzcVEurpercznucK5mEhW18crC1m5c16tlE+c34qI1yLip4WXsvPicq26MswvPgAwwl4+sf7/p9Be/wGAK67r1/zCMPsBAAyO/80HAKPH+g8Ao8f6DwCjx/oPAKPH+g8Ao8f6DwAj5Xsfftg6mof5/a9XPtnb3ah9cnOlUt8obu4uF5drO9vFtVptLbtnz+Z571et1bYX3o7dO6VGpd4o1ff2b2/Wdrcat7P7et+uTAxkVADAk7z25Qd/TiLi4L2XsiO67vd/7lr9xmX3DrhM6bA7AAzN2LA7AAzN6d2+gFEhHw90bdF7r6t66lThpPt9vX2a7xsKPEeuf/4Z8v/AC03+H0bX0+X/fZeHq0D+H0ZXs5nY8x8ARowcP5Cc0979+/98s+ukv9//AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4EqayY4kLeZ7gc9EmhaLEa9ExFxMJKvr1cp8RLwaEX8qTBRa5wsRYd8gAHiRpX9L8v2/rs++NXOydbLw30L2GBE/+vlHP7uz1GjsLERMJv86qm/cz+vLw+g/AHCezjrdWcc7Hj+6u9w5Btmfv3+7vbloK+5hfrRbxmM8e5zKcg3T/07y87bW95WxC4h/cC8iPnfW+JMsNzKX73x6Mn4r9isDjZ8ei59mbe3H1r/FZy+gLzBqHrTmn/fPuv7SuJY9nn39T2Uz1LPrzH+Hp+a/9Gj+G+sx/13rN8bbv//OqcrmbLvtXsQXxiMOO2/eNf904ic94r/VZ/y/vPGlN3u1NX8RcT3OGn9yLFapsbldqu/t31zfXFqrrFW2yuXFhcX5d2+9Uy5lOepSJ1N92j/eu/Fqr/it8U/3iD91zvi/1uf4f/m/j3/wlSfE/8ZXz/78X39C/Naa+PU+4y9N/2aqV1sr/kqP8Z/3+d/oM/7Dv+6v9PlUAGAA6nv7G0vVamXnsgvp5YfICknEwQCG0y4UfvWTDwYV6xIL8Xx0Q+F5Kgx7ZgIu26cX/bB7AgAAAAAAAAAAAAAA9DKIPyca9hgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4uv4fAAD//2KH0wQ=") mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff) 2.502291213s ago: executing program 6 (id=1792): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, 0xa, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000084}, 0x20008044) 2.448041265s ago: executing program 0 (id=1793): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) 2.349290645s ago: executing program 6 (id=1794): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xfffffffffffffffd, 0x0, 0xfffd, 0x1, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x3], 0x25000, 0x2011c0}) ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100)) 2.059332135s ago: executing program 0 (id=1796): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file1\x00', 0x1a10c10, &(0x7f0000001e80)=ANY=[], 0xfc, 0x2b6, &(0x7f0000000480)="$eJzs3U9rK1UUAPAz+ddUFwniRhEc0IWr8urWTaM8QexKiaBuDL4+kKQUWghYwdpVP4FL8Wu4defabyC4Fdy1i8rIZGaaxCZttP+g/n6b3t57z52TOUOyyskXr+0On+0lcXz6W7TbSdS2YivOkuhGLSrfRSMAgMfjLMvizywimsX/ycqRjdrdZQUA3KXi87/w0LkAAPfj408/+7C3vf30ozRtxyudk3E/iYjdk3G/WO89j69iFDvxJDpxHpFdKMbvf7D9NBpprhtv7h6N++O583t/xPokfjM60V0cv5kWyvh+RP63GS9EGr3nzeqoTry8OP7tBfHRb8Vbb8zkvxGd+PXL2ItRPIs8dhr/7Waavpd9f/rN5/ll8vikFv21yb7SekRWv7eiAAAAAAAAAAAAAAAAAAAAAADw6G2kaVK075n078mnyv479fPJ+kZa6c735yniL/oFF/2Bsihb9Bxl8UPVX+dJmqZZuXEa34hXG35YAAAAAAAAAAAAAAAAAAAAAHIHXx8OB6PRzv6NB/XhYFR1A6i+1v9fD9yamXk9DoeD+vID11a/1my3gTzXKzdHoxG3cFuuH8TP63k+S/b8WOb7709emxb3kzK8KsytvoqX3r3IMC2Xqps8HCTXXatdFe6n2aVWrJxGkszNTGo72tnPJo/EeTZf0/aSm9m6hbuRP6OtFxcu/ZVl2WrnvPN7UaNyJpm02FgtjWY5WPq0tC/X4pflBy59y6jf9D0HAAAAAAAAAAAAAAAAAABYbP6L0/9wfGVo7c6SAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB7Nv39/2rQjoj5mUuDozL4qj3loBX7Bw/8EgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+DsAAP//tERGig==") syz_read_part_table(0x59d, &(0x7f0000000000)="$eJzs0r1Ls1cYB+CTwEsoVCIiONhBMLg0KsRBh2SwEtMsRsSKFGfBQQfBwUFSorMf/4DiF4iL2NlRjCAKcZKM4lxQXDKltD6FtnZpiyl9ua4lnHPf59w5/J7A/1o8/NRsNmMhhGbi75/+7jQ/XuyZHJ2aDiEW5kII+a++/LUSizp+u/U8WpeidTGRqe3fjL2ctt/23ldTh/GofhEP4YcQwuLjUfLfvo3P31nuKrm+sVzYXM0tPBTWnobm+/PdW/mlneGDbHmmKzsbfVgX8dbMT9VGju+apefdtoFP1Vojcx31pWMfM5//1p/z3+us1CuNib6TlcF0R/2yvB3l/ip/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgg53lrpLrG8uFzdXcwkNh7Wlovj/fvZVf2hk+yJZnurKz8be+i3hr5qdqI8d3zdLzbtvAp2qtkbmO+tKxd0e/+fFj/hIt9HX4Y/57nZV6pTHRd7IymO6oX5a3o9xf3+cPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPCX8uPFnsnRqekQYmEuhPDt/fe9v+w3E2/1WNR3Hv2Wov1iIlPbvxl7OW2/7b2vpg4nEyEkfnfv4uNR8otWPoR/5OcAAAD//2wlhu4=") connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty, 0xff}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x180) 2.03527255s ago: executing program 6 (id=1797): syz_mount_image$ext4(&(0x7f0000000740)='ext2\x00', &(0x7f0000000240)='./file0\x00', 0x10040, &(0x7f0000000200)={[{@bsdgroups}, {@grpid}, {@errors_remount}]}, 0xfe, 0x26f, &(0x7f00000002c0)="$eJzs3T9oJFUcB/Df7O4kbrJI1EYQ/4CIaCDETrCJjUJAQhARVIiIWEkixAS7rJWNhdYqAcEmiJ3RUmyCjSJYRU2Raw7uwhUXrrgr9tid3bvdZI+727/HzucDy7zJe2/emzDfNyEwswHk1lxELEVEMSLmIyKNiKS9wTPZZ665u1s+WIuo1d68kjTaZfuZVr/ZiKhGxMsRpVbd9v67x9cOX3/+y630uR/23ymP6vzanRwfvXH63coXPy+/tP3XP5dWkliKSrOu/TwGKenys1IS8egwBntAJKVxz4B7sfrZT//Wc/9YRDzbyH8ahWZkv9qc+j2NF7+9U9+vL//9xCjnCgxerZbW74HVGpA7hYioRFJYiIisXCgsLGR/w/9XnCl8vLH56fxHG1vrH457pQIGJY3k6LVfp3+ZPZP/i8Us/8DkqkQcvbW693+9fFoc92yAoWn/b/uT2aae//n3d14I+YfckX/IL/mH/JJ/mAA9Zlf+Ib/6yf9DQ5oTMBru/zDB0lah2rVa/iG/5B8m1PfdnjrtJP+QX+35BwDypTY97ieQgXEZ9/oDAAAAAAAAAAAAAAAAAACct1s+WGt9RjXmH99EnLwaEaVu4xcb30fcetv4zNWk3uyWqaxbX957us8D9OnHgT19Xe6p18MXBjV+b/58ajjH/bxzt/OXM327uLMeUa03XiyVzl9/SfP6690jd6lPP+hzgPt09q2Ar7w92vHPurE33vGXDyN+q68/i93Wn0I83thm689y0rneVNpfsdyjT673eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABG5mYAAAD//+kGbTk=") symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') creat(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) 1.373789386s ago: executing program 0 (id=1800): r0 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') read$FUSE(r1, &(0x7f00000005c0)={0x2020}, 0x2020) 1.371997527s ago: executing program 6 (id=1801): r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x33, 0xffff5257, 0xae2e, 0x100, 0x7, 0x4eba, 0x400, 0x3, 0xffff7fff}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r2, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916c, 0x14}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) 1.06774097s ago: executing program 0 (id=1803): r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000002c0)={0x8400001e}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c000000000000000000000014", @ANYRES8=0x0, @ANYRES32=r0], 0x30}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00011100ffffffffffffff81"], 0x30}}, 0x0) 653.985995ms ago: executing program 7 (id=1807): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) keyctl$KEYCTL_PKEY_QUERY(0x18, r1, 0x0, &(0x7f0000000900)='blake2s-224-generic\x00', 0x0) 529.171651ms ago: executing program 7 (id=1808): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x8, 0x7fffffff}]}) unshare(0x400) close_range(r1, 0xffffffffffffffff, 0x0) copy_file_range(r0, 0x0, r0, 0x0, 0x863, 0x0) 424.094083ms ago: executing program 7 (id=1809): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) listen(r0, 0x6) connect$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x80, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x5}, 0x0, 0x2}, 0xe) 303.960128ms ago: executing program 7 (id=1810): r0 = open(&(0x7f0000001080)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r0, 0x400, 0x0) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x40) fcntl$setlease(r1, 0x400, 0x0) fcntl$setlease(r1, 0x400, 0x0) 246.465439ms ago: executing program 7 (id=1811): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000140)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000240)={&(0x7f0000000080)=[0x0, 0x0], &(0x7f0000000100), 0x2, r1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000340)=[0x346], &(0x7f0000000380)=[r2], &(0x7f00000001c0), 0x0, 0x2}) 0s ago: executing program 7 (id=1812): syz_mount_image$reiserfs(&(0x7f0000000140), &(0x7f0000001140)='./file6\x00', 0x98, &(0x7f0000000280), 0x1, 0x10ef, &(0x7f0000001180)="$eJzs2DGLE0EYBuB3dg/kqshcvx5oYSHHHfEPXKGQxsLaLljZmUrJz/HnyFX2R3pTBOyVTQwJEhDJYuB4Hlh252Vmvp1yvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDvLPlekosmqdusSVKSrrubLJJ02/zx17ZJydv3k9mrj+PXs8209FmT0q9aj+vN01rHdVxv6suL22d19unzh3avZEmX+9V8ev5mOehR+trtoDsCAADAw/DzaKMT1wcAAAD+ZrBGAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAA6vajSVKSrrubLJJ0p/0tAAAA4EglTd6NDuWbNsDOi3wblZRHu+RH6edc58uB9QAAAMC/KXv38ec5z5O9/DJnubrajH+/srxN2iTXf+xzv5pP18/lfFr+5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgF/swLEAAAAAgDB/6zQ6NgAAAAAAAAAAAAAAAGCqAAAA//9TGNII") mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0/file1\x00', 0x1000000, 0x0, 0x0, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000500)='./file0/file1\x00', &(0x7f0000000540), 0x0, 0x0, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) kernel console output (not intermixed with test programs): S (device loop6): found reiserfs format "3.6" with non-standard journal [ 211.808112][ T9457] REISERFS (device loop6): using ordered data mode [ 211.814763][ T9457] reiserfs: using flush barriers [ 211.828931][ T9457] REISERFS (device loop6): journal params: device loop6, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 211.846816][ T2913] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.847278][ T9457] REISERFS (device loop6): checking transaction log (loop6) [ 211.853991][ T2913] bridge0: port 2(bridge_slave_1) entered forwarding state [ 212.051425][ T7293] ocfs2: Unmounting device (7,5) on (node local) [ 212.233671][ T9457] REISERFS (device loop6): Using tea hash to sort names [ 212.251552][ T9457] REISERFS (device loop6): Created .reiserfs_priv - reserved for xattr storage. [ 212.262809][ T9451] loop0: detected capacity change from 0 to 40427 [ 212.305719][ T9451] F2FS-fs (loop0): invalid crc value [ 212.343253][ T9451] F2FS-fs (loop0): Found nat_bits in checkpoint [ 212.426887][ T9340] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 212.530070][ T9451] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 212.740309][ T9451] syz.0.1106: attempt to access beyond end of device [ 212.740309][ T9451] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 212.911972][ T5780] syz-executor: attempt to access beyond end of device [ 212.911972][ T5780] loop0: rw=2049, sector=45104, nr_sectors = 16 limit=40427 [ 212.971093][ T5780] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 212.999168][ T5780] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 213.316510][ T9340] veth0_vlan: entered promiscuous mode [ 213.362062][ T9340] veth1_vlan: entered promiscuous mode [ 213.495848][ T9340] veth0_macvtap: entered promiscuous mode [ 213.523091][ T9340] veth1_macvtap: entered promiscuous mode [ 213.608967][ T9340] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 213.627017][ T9340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 213.640808][ T9340] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 213.657405][ T9340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 213.693708][ T9340] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 213.738593][ T9340] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 213.748365][ T5775] Bluetooth: hci3: command tx timeout [ 213.756446][ T9340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 213.785484][ T9340] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 213.810213][ T9340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 213.836972][ T9340] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 213.864038][ T9340] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 213.877130][ T9340] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 213.887446][ T9340] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 213.896588][ T9340] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.067797][ T3437] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 214.094064][ T3437] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 214.154705][ T3458] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 214.173415][ T3458] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 214.330031][ T9529] CIFS: Attempting to mount //127.0.0.1/share [ 214.350287][ T9340] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 214.535870][ T9536] loop7: detected capacity change from 0 to 2048 [ 214.585165][ T9536] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 214.618036][ T8] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 214.654929][ T9536] EXT4-fs error (device loop7): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 214.702477][ T9536] EXT4-fs (loop7): Delayed block allocation failed for inode 16 at logical offset 16 with max blocks 17 with error 28 [ 214.747583][ T9536] EXT4-fs (loop7): This should not happen!! Data will be lost [ 214.747583][ T9536] [ 214.789732][ T9536] EXT4-fs (loop7): Total free blocks count 0 [ 214.798643][ T9536] EXT4-fs (loop7): Free/Dirty block details [ 214.804594][ T9536] EXT4-fs (loop7): free_blocks=4096 [ 214.831244][ T9536] EXT4-fs (loop7): dirty_blocks=32 [ 214.836708][ T9536] EXT4-fs (loop7): Block reservation details [ 214.844496][ T8] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.861624][ T9536] EXT4-fs (loop7): i_reserved_data_blocks=2 [ 214.868950][ T8] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 214.883188][ T8] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 214.917073][ T8] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 214.937005][ T8] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 214.955792][ T8] usb 6-1: Product: syz [ 214.960996][ T8] usb 6-1: Manufacturer: syz [ 214.987431][ T9531] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 215.003127][ T9340] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 215.015286][ T8] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 215.030098][ T9553] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 215.043727][ T8] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 215.184428][ T9529] CIFS: VFS: cifs_mount failed w/return code = -112 [ 215.237427][ T9559] loop0: detected capacity change from 0 to 256 [ 215.285878][ T9559] exfat: Deprecated parameter 'utf8' [ 215.306426][ T9559] exfat: Deprecated parameter 'utf8' [ 215.330146][ T790] usb 6-1: USB disconnect, device number 10 [ 215.389641][ T790] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 215.401577][ T9559] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 215.428953][ T9564] capability: warning: `syz.6.1122' uses deprecated v2 capabilities in a way that may be insecure [ 215.465956][ T790] garmin_gps 6-1:1.0: device disconnected [ 216.364503][ T9574] loop7: detected capacity change from 0 to 40427 [ 216.387039][ T9574] F2FS-fs (loop7): build fault injection attr: rate: 690, type: 0x7ffff [ 216.416160][ T9574] F2FS-fs (loop7): Image doesn't support compression [ 216.437804][ T9574] F2FS-fs (loop7): invalid crc value [ 216.479422][ T9574] F2FS-fs (loop7): Found nat_bits in checkpoint [ 216.518280][ T8] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 216.631780][ T9574] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 216.722026][ T9574] syz.7.1126: attempt to access beyond end of device [ 216.722026][ T9574] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 216.738065][ T8] usb 7-1: Using ep0 maxpacket: 32 [ 216.753999][ T8] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.762081][ T9574] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 216.794976][ T8] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 216.838223][ T8] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 216.860255][ T8] usb 7-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 216.881020][ T8] usb 7-1: Product: syz [ 216.885251][ T8] usb 7-1: Manufacturer: syz [ 216.926570][ T8] hub 7-1:4.0: USB hub found [ 216.955782][ T9614] FAULT_INJECTION: forcing a failure. [ 216.955782][ T9614] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.975637][ T9614] CPU: 0 PID: 9614 Comm: syz.5.1136 Not tainted syzkaller #0 [ 216.983084][ T9614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 216.993176][ T9614] Call Trace: [ 216.996480][ T9614] [ 216.999438][ T9614] dump_stack_lvl+0x18c/0x250 [ 217.004175][ T9614] ? show_regs_print_info+0x20/0x20 [ 217.009416][ T9614] ? load_image+0x420/0x420 [ 217.013965][ T9614] ? __might_fault+0xaa/0x120 [ 217.018680][ T9614] ? __lock_acquire+0x7d80/0x7d80 [ 217.023746][ T9614] ? __virt_addr_valid+0x10c/0x380 [ 217.028897][ T9614] should_fail_ex+0x394/0x4c0 [ 217.033628][ T9614] _copy_from_user+0x2f/0xe0 [ 217.038253][ T9614] strndup_user+0xb7/0x150 [ 217.042729][ T9614] __se_sys_mount+0x9f/0x3d0 [ 217.047361][ T9614] ? __x64_sys_mount+0xc0/0xc0 [ 217.052163][ T9614] ? lockdep_hardirqs_on+0x98/0x150 [ 217.057395][ T9614] ? __x64_sys_mount+0x20/0xc0 [ 217.062195][ T9614] do_syscall_64+0x55/0xb0 [ 217.066645][ T9614] ? clear_bhb_loop+0x40/0x90 [ 217.071357][ T9614] ? clear_bhb_loop+0x40/0x90 [ 217.076076][ T9614] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 217.082004][ T9614] RIP: 0033:0x7fce01f9e159 [ 217.086444][ T9614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.106081][ T9614] RSP: 002b:00007fce02dc4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 217.114535][ T9614] RAX: ffffffffffffffda RBX: 00007fce02225fa0 RCX: 00007fce01f9e159 [ 217.122545][ T9614] RDX: 0000200000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 217.130555][ T9614] RBP: 00007fce0203506b R08: 0000000000000000 R09: 0000000000000000 [ 217.138553][ T9614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 217.146548][ T9614] R13: 00007fce02226038 R14: 00007fce02225fa0 R15: 00007ffe9425cdc8 [ 217.154556][ T9614] [ 217.157691][ C0] vkms_vblank_simulate: vblank timer overrun [ 217.190318][ T8] hub 7-1:4.0: config failed, can't read hub descriptor (err -22) [ 217.252827][ T8] usb 7-1: USB disconnect, device number 3 [ 217.838174][ T8] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 217.874102][ T9622] loop5: detected capacity change from 0 to 32768 [ 217.906694][ T9622] XFS (loop5): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 217.964292][ T9622] XFS (loop5): Ending clean mount [ 218.019655][ T7293] XFS (loop5): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 218.026554][ T8695] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 218.069174][ T5784] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 218.082932][ T8] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 218.104234][ T8] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 218.119583][ T8] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 218.134569][ T8] usb 7-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 218.159202][ T8] usb 7-1: Product: syz [ 218.163433][ T8] usb 7-1: Manufacturer: syz [ 218.210771][ T8] hub 7-1:4.0: USB hub found [ 218.236895][ T8695] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 218.260068][ T8695] usb 1-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 218.271961][ T5784] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 218.288254][ T5784] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 218.297219][ T8695] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 218.318403][ T5784] usb 8-1: config 1 has no interface number 0 [ 218.324633][ T5784] usb 8-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 218.338069][ T8695] usb 1-1: Manufacturer: syz [ 218.359499][ T8695] usb 1-1: config 0 descriptor?? [ 218.371962][ T8695] usb 1-1: Found UVC 0.00 device (18ec:3288) [ 218.379070][ T5784] usb 8-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 218.412534][ T8695] usb 1-1: No valid video chain found. [ 218.418427][ T5784] usb 8-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 218.427810][ T8] hub 7-1:4.0: 1 port detected [ 218.461666][ T5784] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 218.472244][ T5784] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.497960][ T5784] usb 8-1: Product: syz [ 218.502246][ T5784] usb 8-1: Manufacturer: syz [ 218.506926][ T5784] usb 8-1: SerialNumber: syz [ 218.533539][ T9636] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 218.578891][ T8695] usb 1-1: USB disconnect, device number 14 [ 218.823607][ T8] hub 7-1:4.0: set hub depth failed [ 218.841798][ T8] usb 7-1: USB disconnect, device number 4 [ 218.958464][ T9636] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 219.518784][ T5764] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 219.581314][ T5784] cdc_ncm 8-1:1.1: bind() failure [ 219.607497][ T5784] usb 8-1: USB disconnect, device number 2 [ 219.724727][ T5764] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.753037][ T5764] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 219.763566][ T5764] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 219.777543][ T5764] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 219.788674][ T5764] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.803844][ T5764] usb 1-1: config 0 descriptor?? [ 219.849411][ T9696] loop5: detected capacity change from 0 to 164 [ 220.201521][ T9706] loop5: detected capacity change from 0 to 1024 [ 220.218537][ T9706] EXT4-fs: Ignoring removed oldalloc option [ 220.224525][ T9706] EXT4-fs: Ignoring removed oldalloc option [ 220.254434][ T5764] plantronics 0003:047F:FFFF.000C: No inputs registered, leaving [ 220.285005][ T9706] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 220.307150][ T5764] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 220.329226][ T9706] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 220.412212][ T9706] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.615941][ T789] usb 1-1: USB disconnect, device number 15 [ 220.802525][ T9716] loop7: detected capacity change from 0 to 32768 [ 221.075299][ T7293] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.139434][ T789] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 221.254215][ T9736] loop0: detected capacity change from 0 to 256 [ 221.255300][ T9736] exfat: Deprecated parameter 'utf8' [ 221.326439][ T9736] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 221.353230][ T789] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 221.353266][ T789] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 221.353289][ T789] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 221.353332][ T789] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 221.353354][ T789] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.355761][ T789] usb 7-1: config 0 descriptor?? [ 221.655781][ T9746] loop7: detected capacity change from 0 to 2048 [ 221.677832][ T9746] UDF-fs: error (device loop7): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 221.685426][ T9746] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 221.778451][ T789] plantronics 0003:047F:FFFF.000D: No inputs registered, leaving [ 221.802831][ T789] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 222.016570][ T9755] loop8: detected capacity change from 0 to 8 [ 222.046547][ T9750] loop0: detected capacity change from 0 to 8192 [ 222.056650][ T9755] Dev loop8: unable to read RDB block 8 [ 222.075292][ T9755] loop8: unable to read partition table [ 222.109766][ T9755] loop8: partition table beyond EOD, truncated [ 222.163211][ T9755] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 222.551089][ T9759] loop5: detected capacity change from 0 to 32768 [ 222.569824][ T9759] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop5 scanned by syz.5.1163 (9759) [ 222.601999][ T9759] BTRFS info (device loop5): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 222.612419][ T9759] BTRFS info (device loop5): using xxhash64 (xxhash64-generic) checksum algorithm [ 222.621782][ T9759] BTRFS info (device loop5): force zlib compression, level 3 [ 222.629287][ T9759] BTRFS info (device loop5): force clearing of disk cache [ 222.636471][ T9759] BTRFS info (device loop5): allowing degraded mounts [ 222.643431][ T9759] BTRFS info (device loop5): using free space tree [ 222.736959][ T9759] BTRFS info (device loop5): enabling ssd optimizations [ 222.745221][ T9759] BTRFS info (device loop5): auto enabling async discard [ 222.755695][ T9759] BTRFS info (device loop5): rebuilding free space tree [ 222.870178][ T9759] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2) [ 222.981589][ T7293] BTRFS info (device loop5): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 223.120179][ T5812] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 223.333781][ T5812] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.354002][ T5812] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 223.395966][ T5812] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 223.409422][ T9762] loop0: detected capacity change from 0 to 32768 [ 223.445264][ T5812] usb 8-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 223.464931][ T5812] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 223.473770][ T5812] usb 8-1: Product: syz [ 223.480554][ T5812] usb 8-1: Manufacturer: syz [ 223.517857][ T9782] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 223.538292][ T9762] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 223.548919][ T5812] garmin_gps 8-1:1.0: Garmin GPS usb/tty converter detected [ 223.609618][ T5812] usb 8-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 223.723447][ T9762] XFS (loop0): Ending clean mount [ 223.763799][ T5784] usb 8-1: USB disconnect, device number 3 [ 223.803557][ T5784] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 223.821817][ T28] audit: type=1800 audit(1790866500.443:58): pid=9762 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1164" name="file1" dev="loop0" ino=4422 res=0 errno=0 [ 223.826319][ T5784] garmin_gps 8-1:1.0: device disconnected [ 223.880965][ T9802] loop5: detected capacity change from 0 to 1024 [ 223.911994][ T9802] EXT4-fs: Ignoring removed orlov option [ 223.944581][ T9802] EXT4-fs: test_dummy_encryption requires encrypt feature [ 224.121108][ T790] usb 7-1: USB disconnect, device number 5 [ 224.200962][ T5780] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 224.577387][ T9823] loop5: detected capacity change from 0 to 256 [ 225.328973][ T9837] loop5: detected capacity change from 0 to 32768 [ 225.356328][ T9837] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.1179 (9837) [ 225.398497][ T9837] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 225.416535][ T9837] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 225.426373][ T9837] BTRFS info (device loop5): metadata ratio 220 [ 225.448507][ T9837] BTRFS info (device loop5): setting nodatasum [ 225.454769][ T9837] BTRFS info (device loop5): metadata ratio 4 [ 225.469886][ T9837] BTRFS info (device loop5): enabling ssd optimizations [ 225.478631][ T9837] BTRFS info (device loop5): allowing degraded mounts [ 225.488725][ T9837] BTRFS info (device loop5): using free space tree [ 225.640659][ T9837] BTRFS info (device loop5): auto enabling async discard [ 225.739254][ T9878] sock: sock_set_timeout: `syz.6.1189' (pid 9878) tries to set negative timeout [ 225.845616][ T7293] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 225.879470][ T8694] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 226.105987][ T8694] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 226.138499][ T8694] usb 1-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 226.179032][ T8694] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.229354][ T8694] keyspan 1-1:1.0: Keyspan 2 port adapter converter detected [ 226.253081][ T8694] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 81 [ 226.282357][ T8694] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 1 [ 226.305228][ T8694] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 84 [ 226.338262][ T8694] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 2 [ 226.384777][ T8694] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 226.432921][ T8694] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 88 [ 226.479859][ T8694] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 6 [ 226.492810][ T9896] loop6: detected capacity change from 0 to 1024 [ 226.528706][ T8694] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 226.749278][ T9903] FAULT_INJECTION: forcing a failure. [ 226.749278][ T9903] name failslab, interval 1, probability 0, space 0, times 0 [ 226.778020][ T9903] CPU: 0 PID: 9903 Comm: syz.5.1198 Not tainted syzkaller #0 [ 226.785450][ T9903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 226.795517][ T9903] Call Trace: [ 226.798813][ T9903] [ 226.801760][ T9903] dump_stack_lvl+0x18c/0x250 [ 226.806463][ T9903] ? show_regs_print_info+0x20/0x20 [ 226.811689][ T9903] ? load_image+0x420/0x420 [ 226.816229][ T8706] usb 1-1: USB disconnect, device number 16 [ 226.816244][ T9903] ? __might_sleep+0xe0/0xe0 [ 226.825217][ T8706] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 226.826716][ T9903] ? __lock_acquire+0x7d80/0x7d80 [ 226.826752][ T9903] should_fail_ex+0x394/0x4c0 [ 226.845869][ T9903] should_failslab+0x9/0x20 [ 226.850412][ T9903] slab_pre_alloc_hook+0x59/0x300 [ 226.855477][ T9903] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 226.861229][ T9903] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 226.866985][ T9903] __kmem_cache_alloc_node+0x53/0x250 [ 226.872402][ T9903] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 226.878153][ T9903] __kmalloc+0xa7/0x240 [ 226.878434][ T8706] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 226.882329][ T9903] tomoyo_realpath_from_path+0xe6/0x5c0 [ 226.882355][ T9903] ? __kmalloc+0xe5/0x240 [ 226.882392][ T9903] tomoyo_mount_permission+0x3e7/0x9d0 [ 226.907127][ T9903] ? tomoyo_mount_permission+0x2b3/0x9d0 [ 226.912809][ T9903] ? kasan_set_track+0x4e/0x70 [ 226.917493][ T8706] keyspan 1-1:1.0: device disconnected [ 226.917586][ T9903] ? tomoyo_get_name+0x570/0x570 [ 226.927997][ T9903] ? user_path_at_empty+0x4c/0x60 [ 226.933064][ T9903] ? kasan_quarantine_put+0xd8/0x220 [ 226.938371][ T9903] ? lockdep_hardirqs_on+0x98/0x150 [ 226.943592][ T9903] security_sb_mount+0x87/0xc0 [ 226.948373][ T9903] path_mount+0xbc/0xfa0 [ 226.952642][ T9903] ? kmem_cache_free+0xf8/0x290 [ 226.957519][ T9903] __se_sys_mount+0x2e7/0x3d0 [ 226.962231][ T9903] ? __x64_sys_mount+0xc0/0xc0 [ 226.967030][ T9903] ? lockdep_hardirqs_on+0x98/0x150 [ 226.972240][ T9903] ? __x64_sys_mount+0x20/0xc0 [ 226.977021][ T9903] do_syscall_64+0x55/0xb0 [ 226.981468][ T9903] ? clear_bhb_loop+0x40/0x90 [ 226.986147][ T9903] ? clear_bhb_loop+0x40/0x90 [ 226.990829][ T9903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 226.996735][ T9903] RIP: 0033:0x7fce01f9e159 [ 227.001150][ T9903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 227.020764][ T9903] RSP: 002b:00007fce02dc4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 227.029186][ T9903] RAX: ffffffffffffffda RBX: 00007fce02225fa0 RCX: 00007fce01f9e159 [ 227.037158][ T9903] RDX: 0000200000000040 RSI: 0000200000000080 RDI: 0000000000000000 [ 227.045135][ T9903] RBP: 00007fce0203506b R08: 0000000000000000 R09: 0000000000000000 [ 227.053119][ T9903] R10: 0000000002200892 R11: 0000000000000246 R12: 0000000000000000 [ 227.061108][ T9903] R13: 00007fce02226038 R14: 00007fce02225fa0 R15: 00007ffe9425cdc8 [ 227.069097][ T9903] [ 227.098571][ T9903] ERROR: Out of memory at tomoyo_realpath_from_path. [ 227.107042][ T9896] hfsplus: xattr searching failed [ 227.672463][ T9929] netlink: 'syz.6.1205': attribute type 3 has an invalid length. [ 227.675588][ T9930] loop0: detected capacity change from 0 to 128 [ 227.698007][ T9929] netlink: 'syz.6.1205': attribute type 7 has an invalid length. [ 227.716175][ T9929] netlink: 198368 bytes leftover after parsing attributes in process `syz.6.1205'. [ 227.753644][ T9930] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 227.789809][ T9930] hpfs: filesystem error: improperly stopped [ 227.795876][ T9930] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 227.836113][ T9930] hpfs: You really don't want any checks? You are crazy... [ 227.867782][ T9933] loop5: detected capacity change from 0 to 164 [ 227.878288][ T9930] hpfs: Code page directory magic doesn't match (magic = 7b3184b5) [ 227.886859][ T9930] hpfs: code page support is disabled [ 227.909156][ T9930] hpfs: hpfs_map_4sectors(): unaligned read [ 227.915229][ T9930] hpfs: hpfs_map_4sectors(): unaligned read [ 227.975238][ T9930] hpfs: filesystem error: unable to find root dir [ 228.019752][ T9911] loop7: detected capacity change from 0 to 40427 [ 228.048536][ T9911] F2FS-fs (loop7): Insane cp_payload (553648128 >= 504) [ 228.086519][ T9911] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 228.131002][ T9911] F2FS-fs (loop7): invalid crc value [ 228.136374][ T9911] F2FS-fs (loop7): Ignore s_resuid=0, s_resgid=65535 w/o reserve_root [ 228.147357][ T28] audit: type=1326 audit(1790866504.763:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9935 comm="syz.6.1208" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2de6f9e159 code=0x0 [ 228.212763][ T9911] F2FS-fs (loop7): Found nat_bits in checkpoint [ 228.315200][ T9911] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 228.375629][ T9911] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 228.535248][ T9911] syz.7.1200: attempt to access beyond end of device [ 228.535248][ T9911] loop7: rw=2049, sector=53248, nr_sectors = 8 limit=40427 [ 228.570802][ T28] audit: type=1800 audit(1790866505.193:60): pid=9911 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1200" name="file1" dev="loop7" ino=10 res=0 errno=0 [ 228.653181][ T9340] syz-executor: attempt to access beyond end of device [ 228.653181][ T9340] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 228.676897][ T9340] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 228.698188][ T9958] loop0: detected capacity change from 0 to 1764 [ 228.806934][ T9959] loop5: detected capacity change from 0 to 4096 [ 229.531751][ T9980] loop0: detected capacity change from 0 to 512 [ 229.609610][ T9980] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a802c01c, mo2=0002] [ 229.634368][ T9978] loop5: detected capacity change from 0 to 8192 [ 229.658746][ T9980] System zones: 0-2, 18-18, 34-35 [ 229.705418][ T9980] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 229.798385][ T9980] ext4 filesystem being mounted at /315/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 229.981414][ T5780] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.158059][ T9999] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1227'. [ 230.181302][ T9999] veth0_macvtap: left promiscuous mode [ 230.205044][ T9999] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1227'. [ 230.489087][T10013] MTD: Couldn't look up './file0': -15 [ 230.536642][T10017] netlink: 48 bytes leftover after parsing attributes in process `syz.7.1232'. [ 230.627761][T10020] input: syz0 as /devices/virtual/input/input21 [ 230.658049][ T8703] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 230.746515][T10024] Bluetooth: hci4: Frame reassembly failed (-84) [ 230.787526][ T7639] Bluetooth: hci4: Frame reassembly failed (-84) [ 230.882620][ T8703] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 230.895871][ T8703] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 230.905874][ T8703] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 230.915670][ T8703] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 230.925763][ T8703] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 230.935548][ T8703] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 230.946336][ T8703] usb 6-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 230.962679][ T8703] usb 6-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 230.983738][ T8703] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.996034][ T8703] usb 6-1: Product: syz [ 231.000823][ T8703] usb 6-1: Manufacturer: syz [ 231.008293][ T8703] usb 6-1: SerialNumber: syz [ 231.017576][T10007] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 231.038144][T10007] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 231.058462][T10007] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 231.083966][ T8703] keyspan 6-1:1.0: Keyspan 1 port adapter converter detected [ 231.119761][ T8703] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 231.143651][ T8703] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 82 [ 231.158012][ T8703] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 231.172360][ T8703] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 231.535123][ T790] usb 6-1: USB disconnect, device number 11 [ 231.553496][ T790] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 231.566649][ T790] keyspan 6-1:1.0: device disconnected [ 231.688310][T10061] syzkaller1: entered promiscuous mode [ 231.693850][T10061] syzkaller1: entered allmulticast mode [ 232.406516][T10091] loop5: detected capacity change from 0 to 1024 [ 232.562672][T10096] hfsplus: found bad thread record in catalog [ 232.659992][ T11] hfsplus: found bad thread record in catalog [ 232.673772][ T11] hfsplus: b-tree write err: -5, ino 8 [ 232.758102][ T8693] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 232.778148][ T8703] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 232.788893][ T5775] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 232.795845][ T5782] Bluetooth: hci4: command 0x1003 tx timeout [ 232.949176][T10103] CIFS: Attempting to mount //127.0.0.1/share [ 232.970694][ T8693] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 232.983081][ T8693] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 232.995563][ T8693] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 233.006757][ T8693] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 233.015598][ T8703] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 233.025577][ T8703] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.027811][ T8693] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.041280][ T8703] usb 1-1: config 0 descriptor?? [ 233.063302][ T8693] usb 7-1: config 0 descriptor?? [ 233.068604][ T8703] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 233.195038][T10111] loop5: detected capacity change from 0 to 512 [ 233.204900][T10111] EXT4-fs: Ignoring removed nobh option [ 233.227267][T10111] EXT4-fs (loop5): Test dummy encryption mode enabled [ 233.243978][T10111] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -13 [ 233.255936][T10111] EXT4-fs error (device loop5): ext4_clear_blocks:883: inode #13: comm syz.5.1260: attempt to clear invalid blocks 1 len 1 [ 233.290318][T10111] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 233.306311][T10111] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.1260: invalid indirect mapped block 1819239214 (level 0) [ 233.323559][T10111] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.1260: invalid indirect mapped block 1819239214 (level 1) [ 233.344139][T10111] EXT4-fs (loop5): 1 truncate cleaned up [ 233.355690][T10111] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 233.396220][T10111] EXT4-fs error (device loop5): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.5.1260: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0 [ 233.426399][T10111] EXT4-fs error (device loop5): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.5.1260: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0 [ 233.493760][ T8693] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 233.509189][ T8693] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 233.510139][ T7293] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.527298][ T8693] plantronics 0003:047F:FFFF.000E: No inputs registered, leaving [ 233.591688][ T8693] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 233.776710][T10103] CIFS: VFS: cifs_mount failed w/return code = -112 [ 233.916047][ T8703] gspca_stv06xx: I2C: Read error writing address: -71 [ 233.953020][ T8703] usb 1-1: USB disconnect, device number 17 [ 234.420326][T10125] loop7: detected capacity change from 0 to 32768 [ 234.508026][ T8703] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 234.717937][ T8703] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 234.729299][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.764839][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 234.804200][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 234.832072][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.844322][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 234.878080][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 234.886480][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.905818][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 234.943320][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 234.962517][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.973402][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 235.001357][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 235.015179][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.024870][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 235.068024][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 235.108885][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.129038][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 235.156122][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 235.166072][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.185147][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 235.208215][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 235.217497][ T8703] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.243169][ T8703] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 235.281108][ T8703] usb 6-1: config 0 interface 0 has no altsetting 0 [ 235.294554][ T8703] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 235.324652][ T8703] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 235.356567][ T8703] usb 6-1: Product: syz [ 235.371865][ T8703] usb 6-1: Manufacturer: syz [ 235.376550][ T8703] usb 6-1: SerialNumber: syz [ 235.396228][ T8703] usb 6-1: config 0 descriptor?? [ 235.457281][ T8703] yurex 6-1:0.0: USB YUREX device now attached to Yurex #1 [ 235.682681][ T8693] usb 7-1: USB disconnect, device number 6 [ 235.708434][ T5784] usb 6-1: USB disconnect, device number 12 [ 235.745700][ T5784] yurex 6-1:0.0: USB YUREX #1 now disconnected [ 235.962463][T10177] syzkaller1: entered promiscuous mode [ 235.976751][T10177] syzkaller1: entered allmulticast mode [ 236.248216][ T8693] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 236.286704][T10196] loop7: detected capacity change from 0 to 16 [ 236.311444][T10196] erofs: (device loop7): mounted with root inode @ nid 36. [ 236.460792][ T8693] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 236.486189][ T8693] usb 7-1: config 0 has no interface number 0 [ 236.513126][ T8693] usb 7-1: config 0 interface 41 has no altsetting 0 [ 236.543816][ T8693] usb 7-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 236.574510][ T8693] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.585294][ T8693] usb 7-1: Product: syz [ 236.597930][ T8693] usb 7-1: Manufacturer: syz [ 236.602588][ T8693] usb 7-1: SerialNumber: syz [ 236.646924][ T8693] usb 7-1: config 0 descriptor?? [ 236.717240][T10193] loop0: detected capacity change from 0 to 32768 [ 236.757318][T10193] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.1278 (10193) [ 236.792724][T10193] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 236.814119][T10193] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 236.833534][T10193] BTRFS info (device loop0): metadata ratio 220 [ 236.840514][T10193] BTRFS info (device loop0): setting nodatasum [ 236.886450][T10193] BTRFS info (device loop0): metadata ratio 4 [ 236.895868][T10193] BTRFS info (device loop0): enabling ssd optimizations [ 236.910841][T10193] BTRFS info (device loop0): allowing degraded mounts [ 236.917828][T10193] BTRFS info (device loop0): using free space tree [ 237.052675][T10193] BTRFS info (device loop0): auto enabling async discard [ 237.397488][T10245] binder: 10244:10245 ioctl 4018620d 0 returned -22 [ 237.426798][ T5780] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 237.684424][ T8693] CoreChips: probe of 7-1:0.41 failed with error -71 [ 237.697377][ T5767] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop0 scanned by udevd (5767) [ 237.716207][ T8693] usb 7-1: USB disconnect, device number 7 [ 237.968372][ T8694] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 238.200051][ T8694] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 238.221641][ T8694] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.252777][ T8694] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 238.296585][ T8694] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 238.313788][ T8694] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.351166][ T8694] usb 1-1: config 0 descriptor?? [ 238.526847][T10251] loop5: detected capacity change from 0 to 40427 [ 238.561569][T10251] F2FS-fs (loop5): invalid crc value [ 238.611583][T10251] F2FS-fs (loop5): Found nat_bits in checkpoint [ 238.770255][T10251] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 238.837818][ T8694] plantronics 0003:047F:FFFF.000F: No inputs registered, leaving [ 238.862261][ T8694] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 238.906877][ T7293] syz-executor: attempt to access beyond end of device [ 238.906877][ T7293] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 238.958049][ T7293] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 239.143792][T10287] loop6: detected capacity change from 0 to 512 [ 239.167587][T10289] loop7: detected capacity change from 0 to 512 [ 239.184214][T10287] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 239.229489][T10287] EXT4-fs warning (device loop6): ext4_multi_mount_protect:292: Invalid MMP block in superblock [ 239.346126][T10289] EXT4-fs error (device loop7): ext4_orphan_get:1434: comm syz.7.1297: bad orphan inode 16 [ 239.424919][T10289] ext4_test_bit(bit=15, block=18) = 1 [ 239.474525][T10289] is_bad_inode(inode)=0 [ 239.494058][T10289] NEXT_ORPHAN(inode)=83886080 [ 239.519964][T10289] max_ino=32 [ 239.534263][T10289] i_nlink=0 [ 239.611946][T10289] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 239.646600][ T3437] Quota error (device loop7): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 239.669072][T10289] ext4 filesystem being mounted at /43/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 239.684998][ T3437] EXT4-fs error (device loop7): ext4_release_dquot:6989: comm kworker/u4:9: Failed to release dquot type 1 [ 239.849436][ T9340] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 240.031739][T10311] loop5: detected capacity change from 0 to 512 [ 240.651829][T10333] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1305'. [ 240.912900][T10340] "syz.0.1307" (10340) uses obsolete ecb(arc4) skcipher [ 241.019383][ T790] usb 1-1: USB disconnect, device number 18 [ 241.104394][T10318] loop5: detected capacity change from 0 to 40427 [ 241.154831][T10318] F2FS-fs (loop5): invalid crc value [ 241.191916][T10318] F2FS-fs (loop5): Found nat_bits in checkpoint [ 241.368500][T10318] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 241.651111][T10339] loop7: detected capacity change from 0 to 40427 [ 241.689712][T10339] F2FS-fs (loop7): Invalid log_blocksize (268), supports only 12 [ 241.722489][T10339] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 241.741685][ T7293] syz-executor: attempt to access beyond end of device [ 241.741685][ T7293] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 241.781917][ T7293] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 241.811094][T10339] F2FS-fs (loop7): Found nat_bits in checkpoint [ 242.009975][T10368] loop0: detected capacity change from 0 to 1024 [ 242.120444][T10339] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 242.127627][T10339] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 242.518565][T10383] loop6: detected capacity change from 0 to 2048 [ 242.555694][T10383] loop6: p2 p3 < > p4 < p5 > [ 242.560135][T10385] loop8: detected capacity change from 0 to 7 [ 242.565779][T10383] loop6: partition table partially beyond EOD, truncated [ 242.569211][T10385] Dev loop8: unable to read RDB block 7 [ 242.584604][T10383] loop6: p2 start 53543428 is beyond EOD, truncated [ 242.595374][T10385] loop8: unable to read partition table [ 242.603448][T10383] loop6: p3 start 4284289 is beyond EOD, truncated [ 242.614752][T10385] loop8: partition table beyond EOD, truncated [ 242.619637][T10388] loop5: detected capacity change from 0 to 1024 [ 242.622323][T10383] loop6: p5 start 53543428 is beyond EOD, truncated [ 242.640237][T10385] loop_reread_partitions: partition scan of loop8 (þè¢Ñâ·û) failed (rc=-5) [ 242.666331][ T5142] loop6: p2 p3 < > p4 < p5 > [ 242.673821][ T5142] loop6: partition table partially beyond EOD, truncated [ 242.688341][ T5142] loop6: p2 start 53543428 is beyond EOD, truncated [ 242.699608][ T5142] loop6: p3 start 4284289 is beyond EOD, truncated [ 242.728353][ T5142] loop6: p5 start 53543428 is beyond EOD, truncated [ 242.767839][T10388] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 242.858459][T10388] ext4 filesystem being mounted at /204/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.987137][T10388] EXT4-fs error (device loop5): ext4_map_blocks:720: inode #15: comm syz.5.1314: lblock 0 mapped to illegal pblock 0 (length 4) [ 243.036609][T10388] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 117 [ 243.068666][T10388] EXT4-fs (loop5): This should not happen!! Data will be lost [ 243.068666][T10388] [ 243.269678][ T3478] EXT4-fs error (device loop5): ext4_map_blocks:720: inode #15: block 4: comm kworker/u4:11: lblock 4 mapped to illegal pblock 4 (length 2) [ 243.329225][ T3478] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 243.388073][ T3478] EXT4-fs (loop5): This should not happen!! Data will be lost [ 243.388073][ T3478] [ 243.415538][ T3478] EXT4-fs error (device loop5): ext4_map_blocks:720: inode #15: block 8: comm kworker/u4:11: lblock 8 mapped to illegal pblock 8 (length 8) [ 243.449748][ T3478] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 243.482979][ T3478] EXT4-fs (loop5): This should not happen!! Data will be lost [ 243.482979][ T3478] [ 243.496579][T10411] loop0: detected capacity change from 0 to 1024 [ 243.536508][ T7293] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 243.581005][T10411] hfsplus: invalid length 32517 has been corrected to 255 [ 243.864902][T10419] netlink: 'syz.6.1324': attribute type 64 has an invalid length. [ 243.911503][T10419] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.919368][T10419] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.937728][ T2913] hfsplus: b-tree write err: -5, ino 20 [ 243.994972][T10422] netlink: 'syz.6.1324': attribute type 64 has an invalid length. [ 245.567820][T10443] loop0: detected capacity change from 0 to 40427 [ 245.606524][T10443] F2FS-fs (loop0): Wrong segment_count / block_count (31 > 0) [ 245.630015][T10443] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 245.653368][T10443] F2FS-fs (loop0): invalid crc value [ 245.685160][T10443] F2FS-fs (loop0): Found nat_bits in checkpoint [ 245.774807][T10485] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1339'. [ 245.834771][T10443] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0 [ 245.852708][T10443] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 246.012072][T10443] syz.0.1329: attempt to access beyond end of device [ 246.012072][T10443] loop0: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 246.054035][T10443] F2FS-fs (loop0): Remounting filesystem read-only [ 246.119542][T10443] syz.0.1329: attempt to access beyond end of device [ 246.119542][T10443] loop0: rw=2049, sector=40992, nr_sectors = 8 limit=40427 [ 246.150476][T10443] F2FS-fs (loop0): Remounting filesystem read-only [ 246.537252][T10476] loop6: detected capacity change from 0 to 40427 [ 246.597752][T10476] F2FS-fs (loop6): invalid crc value [ 246.653700][T10476] F2FS-fs (loop6): Found nat_bits in checkpoint [ 246.869498][T10476] F2FS-fs (loop6): Start checkpoint disabled! [ 246.881978][T10507] loop7: detected capacity change from 0 to 512 [ 246.985231][T10507] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 246.991362][T10476] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 247.018980][T10507] ext4 filesystem being mounted at /55/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 247.144782][T10476] syz.6.1338: attempt to access beyond end of device [ 247.144782][T10476] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 247.187804][T10476] syz.6.1338: attempt to access beyond end of device [ 247.187804][T10476] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 247.260239][T10517] loop5: detected capacity change from 0 to 4096 [ 247.280423][ T9340] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 247.348975][T10517] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 247.357499][T10517] EXT4-fs (loop5): Test dummy encryption mode enabled [ 247.444417][T10517] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 247.478557][ T3478] kworker/u4:11: attempt to access beyond end of device [ 247.478557][ T3478] loop6: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 247.517601][ T3478] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 247.546946][ T3478] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 247.587106][T10528] FAULT_INJECTION: forcing a failure. [ 247.587106][T10528] name failslab, interval 1, probability 0, space 0, times 0 [ 247.647380][T10528] CPU: 1 PID: 10528 Comm: syz.7.1348 Not tainted syzkaller #0 [ 247.655107][T10528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 247.665208][T10528] Call Trace: [ 247.668514][T10528] [ 247.671558][T10528] dump_stack_lvl+0x18c/0x250 [ 247.676291][T10528] ? show_regs_print_info+0x20/0x20 [ 247.681544][T10528] ? load_image+0x420/0x420 [ 247.686098][T10528] ? __might_sleep+0xe0/0xe0 [ 247.690770][T10528] ? __lock_acquire+0x7d80/0x7d80 [ 247.696086][T10528] should_fail_ex+0x394/0x4c0 [ 247.700810][T10528] should_failslab+0x9/0x20 [ 247.705352][T10528] slab_pre_alloc_hook+0x59/0x300 [ 247.710420][T10528] ? key_put+0x9c/0xc0 [ 247.714575][T10528] kmem_cache_alloc+0x5a/0x2c0 [ 247.719383][T10528] ? prepare_creds+0x30/0x5d0 [ 247.724120][T10528] prepare_creds+0x30/0x5d0 [ 247.728796][T10528] join_session_keyring+0x1b/0x440 [ 247.733971][T10528] lookup_user_key+0x4e6/0x1140 [ 247.738927][T10528] ? lookup_user_key_possessed+0x40/0x40 [ 247.744613][T10528] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 247.750743][T10528] keyctl_keyring_move+0x3d/0x110 [ 247.755800][T10528] __se_sys_keyctl+0x84a/0xb50 [ 247.760591][T10528] ? __x64_sys_keyctl+0xc0/0xc0 [ 247.765446][T10528] ? do_futex+0x2ff/0x3e0 [ 247.769780][T10528] ? __ia32_sys_get_robust_list+0x110/0x110 [ 247.775688][T10528] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 247.781678][T10528] ? lock_chain_count+0x20/0x20 [ 247.786544][T10528] ? lockdep_hardirqs_on+0x98/0x150 [ 247.791741][T10528] ? __x64_sys_keyctl+0x20/0xc0 [ 247.796602][T10528] do_syscall_64+0x55/0xb0 [ 247.801051][T10528] ? clear_bhb_loop+0x40/0x90 [ 247.805912][T10528] ? clear_bhb_loop+0x40/0x90 [ 247.810723][T10528] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 247.816630][T10528] RIP: 0033:0x7fe5c3d9e159 [ 247.821054][T10528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.840677][T10528] RSP: 002b:00007fe5c4c20028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 247.849104][T10528] RAX: ffffffffffffffda RBX: 00007fe5c4025fa0 RCX: 00007fe5c3d9e159 [ 247.857172][T10528] RDX: 0000000000000000 RSI: fffffffffffffffd RDI: 000000000000001e [ 247.865148][T10528] RBP: 00007fe5c3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 247.873133][T10528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 247.881124][T10528] R13: 00007fe5c4026038 R14: 00007fe5c4025fa0 R15: 00007ffdac105cb8 [ 247.889139][T10528] [ 247.979018][T10517] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 248.067240][ T7293] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 248.319624][T10544] loop7: detected capacity change from 0 to 2048 [ 248.383702][T10544] Alternate GPT is invalid, using primary GPT. [ 248.398283][T10544] loop7: p1 p2 p3 [ 248.402093][T10544] loop7: partition table partially beyond EOD, truncated [ 248.458006][ T8706] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 248.663034][ T8706] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 248.705505][ T8706] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 248.765406][ T8706] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 248.795462][ T8706] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 248.808341][ T8706] usb 1-1: Manufacturer: syz [ 248.825437][ T8706] usb 1-1: config 0 descriptor?? [ 248.912471][ T5765] udevd[5765]: inotify_add_watch(7, /dev/loop7p3, 10) failed: No such file or directory [ 248.936325][ T7302] udevd[7302]: inotify_add_watch(7, /dev/loop7p2, 10) failed: No such file or directory [ 248.954893][ T5767] udevd[5767]: inotify_add_watch(7, /dev/loop7p1, 10) failed: No such file or directory [ 249.087035][T10545] loop5: detected capacity change from 0 to 32768 [ 249.171016][T10545] syz.5.1352: attempt to access beyond end of device [ 249.171016][T10545] loop14: rw=0, sector=8, nr_sectors = 8 limit=0 [ 249.224050][T10545] lbmIODone: I/O error in JFS log [ 249.264888][T10545] *** Log Format Error ! *** [ 249.278677][T10545] lmLogInit: exit(-22) [ 249.288719][T10545] lmLogOpen: exit(-22) [ 249.354591][T10545] jfs_dirty_inode called on read-only volume [ 249.372654][T10545] Is remount racy? [ 249.386080][T10575] jfs_dirty_inode called on read-only volume [ 249.395294][T10575] Is remount racy? [ 249.408882][T10575] jfs_dirty_inode called on read-only volume [ 249.431436][T10575] Is remount racy? [ 249.447478][T10575] jfs_dirty_inode called on read-only volume [ 249.468129][T10575] Is remount racy? [ 249.662886][ T8706] input: syz Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:256C:006D.0010/input/input22 [ 249.764264][ T8706] input: syz Pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:256C:006D.0010/input/input23 [ 249.803586][ T8706] input: syz Touch Strip as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:256C:006D.0010/input/input24 [ 249.850731][ T8706] input: syz Dial as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:256C:006D.0010/input/input25 [ 249.877739][T10589] loop5: detected capacity change from 0 to 764 [ 249.888035][ T8706] uclogic 0003:256C:006D.0010: input,hidraw0: USB HID v0.00 Keypad [syz] on usb-dummy_hcd.0-1/input0 [ 249.919930][T10589] rock: directory entry would overflow storage [ 249.926148][T10589] rock: sig=0x5850, size=36, remaining=22 [ 249.935874][ T8706] usb 1-1: USB disconnect, device number 19 [ 250.296812][T10592] fido_id[10592]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 250.373090][T10600] loop5: detected capacity change from 0 to 64 [ 250.484299][T10600] hfs: keylen 1794 too large [ 250.497613][T10600] hfs: keylen 1794 too large [ 250.595538][T10601] hfs: keylen 1794 too large [ 250.904538][T10603] loop0: detected capacity change from 0 to 256 [ 250.932173][T10603] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011a39, chksum : 0xd4e5c97b, utbl_chksum : 0xe619d30d) [ 251.021237][ T28] audit: type=1804 audit(1790866527.633:61): pid=10603 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1368" name="/newroot/351/file0/bus" dev="loop0" ino=1048631 res=1 errno=0 [ 251.065846][T10603] exFAT-fs (loop0): error, invalid size(size(0) > aligned(9223372036854777344) [ 251.065846][T10603] [ 251.079501][T10603] exFAT-fs (loop0): Filesystem has been set read-only [ 251.129786][T10599] loop6: detected capacity change from 0 to 131072 [ 251.139602][T10599] F2FS-fs (loop6): invalid crc value [ 251.159937][ T11] hfs: keylen 1794 too large [ 251.175277][T10599] F2FS-fs (loop6): Found nat_bits in checkpoint [ 251.251204][T10599] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 251.812602][T10619] CacheFiles: Failed to register: -95 [ 252.338771][T10635] loop0: detected capacity change from 0 to 128 [ 252.393077][T10635] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 252.479614][T10635] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 252.788267][ T5778] Bluetooth: hci1: command 0x0406 tx timeout [ 252.828013][ T5784] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 253.028068][ T5784] usb 6-1: Using ep0 maxpacket: 32 [ 253.043176][ T5784] usb 6-1: config 0 has an invalid interface number: 3 but max is 0 [ 253.059500][ T5784] usb 6-1: config 0 has no interface number 0 [ 253.078042][ T5784] usb 6-1: config 0 interface 3 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.082472][T10656] loop6: detected capacity change from 0 to 2048 [ 253.098242][ T5784] usb 6-1: config 0 interface 3 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 253.116284][ T5784] usb 6-1: New USB device found, idVendor=5543, idProduct=0045, bcdDevice= 0.00 [ 253.126692][ T5784] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.140397][ T5784] usb 6-1: config 0 descriptor?? [ 253.146957][T10656] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 253.179422][T10656] ext4 filesystem being mounted at /77/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 253.261416][T10656] FS-Cache: Cache "CacheFiles" added (type cachefiles) [ 253.275479][T10656] CacheFiles: File cache on CacheFiles registered [ 253.296295][T10654] CacheFiles: File cache on CacheFiles unregistering [ 253.303580][T10654] FS-Cache: Withdrawing cache "CacheFiles" (0 objs) [ 253.382805][ T9109] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 253.564256][ T5784] uclogic 0003:5543:0045.0011: interface is invalid, ignoring [ 253.682628][T10677] vcan0: entered allmulticast mode [ 253.694759][T10677] vcan0: left allmulticast mode [ 253.793021][T10683] loop6: detected capacity change from 0 to 164 [ 253.829143][ T5831] usb 6-1: USB disconnect, device number 13 [ 254.307149][T10691] loop0: detected capacity change from 0 to 40427 [ 254.321315][T10691] F2FS-fs (loop0): invalid crc value [ 254.336059][T10691] F2FS-fs (loop0): Found nat_bits in checkpoint [ 254.488067][T10691] F2FS-fs (loop0): Start checkpoint disabled! [ 254.552310][T10691] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 254.781901][T10707] loop5: detected capacity change from 0 to 128 [ 254.838882][T10707] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 254.887543][T10707] ext4 filesystem being mounted at /229/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 254.932866][T10701] loop6: detected capacity change from 0 to 40427 [ 254.963218][T10701] F2FS-fs (loop6): build fault injection attr: rate: 14, type: 0x7ffff [ 254.971925][T10701] F2FS-fs (loop6): build fault injection attr: rate: 0, type: 0xe4 [ 254.987495][T10701] F2FS-fs (loop6): invalid crc value [ 255.005836][T10701] F2FS-fs (loop6): Found nat_bits in checkpoint [ 255.091078][T10701] F2FS-fs (loop6): inject page alloc in f2fs_grab_cache_page of f2fs_ra_meta_pages+0x665/0x970 [ 255.134672][ T7293] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 255.183750][T10701] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 255.267463][T10701] F2FS-fs (loop6): inject alloc nid in f2fs_alloc_nid of f2fs_get_dnode_of_data+0x885/0x1a80 [ 255.303039][T10701] F2FS-fs (loop6): inject alloc nid in f2fs_alloc_nid of f2fs_new_inode+0x10d/0x1030 [ 255.314883][ T12] kworker/u4:1: attempt to access beyond end of device [ 255.314883][ T12] loop0: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 255.343612][ T12] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 255.391767][ T9109] syz-executor: attempt to access beyond end of device [ 255.391767][ T9109] loop6: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 255.437949][ T9109] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 255.456611][ T9109] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 255.646087][T10715] loop5: detected capacity change from 0 to 32768 [ 255.717834][T10715] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 255.835676][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.845381][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.879061][T10715] XFS (loop5): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 255.953435][T10715] XFS (loop5): Starting recovery (logdev: internal) [ 255.976564][T10715] XFS (loop5): Ending recovery (logdev: internal) [ 256.050729][ T28] audit: type=1800 audit(1790866532.673:62): pid=10715 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1413" name="file1" dev="loop5" ino=4422 res=0 errno=0 [ 256.111836][ T7293] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 256.878054][ T5831] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 257.013621][T10760] loop0: detected capacity change from 0 to 2048 [ 257.035934][T10760] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 257.048176][ T5831] usb 7-1: Using ep0 maxpacket: 8 [ 257.059976][ T5831] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 257.069374][ T5831] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 257.082758][T10760] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 257.092609][ T5831] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 257.128142][ T5831] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 257.147437][ T5831] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 257.165124][ T5831] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 257.188113][ T5831] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.443109][ T5831] usb 7-1: usb_control_msg returned -32 [ 257.457952][ T5831] usbtmc 7-1:16.0: can't read capabilities [ 258.515623][T10799] IPVS: You probably need to specify IP address on multicast interface. [ 258.524918][T10799] IPVS: Error connecting to the multicast addr [ 258.585518][T10812] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1452'. [ 258.619569][T10812] bond1: option mode: invalid value (69) [ 258.629632][T10812] bond1 (unregistering): Released all slaves [ 258.843552][T10818] loop5: detected capacity change from 0 to 256 [ 258.900172][T10820] loop7: detected capacity change from 0 to 512 [ 258.916742][T10818] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x8dc06734, utbl_chksum : 0xe619d30d) [ 258.952807][T10820] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a802c01c, mo2=0002] [ 258.996376][T10820] System zones: 0-2, 18-18, 34-35 [ 259.024737][T10820] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 259.085678][T10820] ext4 filesystem being mounted at /66/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 259.154527][T10832] loop5: detected capacity change from 0 to 2048 [ 259.202103][T10832] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000900 r/w without journal. Quota mode: none. [ 259.270736][ T9340] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.280795][T10832] EXT4-fs error (device loop5): ext4_validate_block_bitmap:439: comm syz.5.1459: bg 0: block 240: padding at end of block bitmap is not set [ 259.378551][T10832] EXT4-fs error (device loop5) in ext4_setattr:5695: error 28 [ 259.495801][ T7293] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 259.635941][ T8694] usb 7-1: USB disconnect, device number 8 [ 259.809136][T10854] sctp: [Deprecated]: syz.0.1468 (pid 10854) Use of int in max_burst socket option deprecated. [ 259.809136][T10854] Use struct sctp_assoc_value instead [ 259.983170][T10864] loop6: detected capacity change from 0 to 64 [ 260.263255][T10870] loop6: detected capacity change from 0 to 256 [ 260.387203][ T28] audit: type=1800 audit(1790866537.003:63): pid=10870 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1476" name="file2" dev="loop6" ino=1048634 res=0 errno=0 [ 260.500939][T10862] loop7: detected capacity change from 0 to 32768 [ 260.529871][T10862] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by syz.7.1472 (10862) [ 260.616684][T10862] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 260.643658][T10862] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 260.671014][T10862] BTRFS info (device loop7): using free space tree [ 260.839969][T10862] BTRFS info (device loop7): enabling ssd optimizations [ 260.847700][T10862] BTRFS info (device loop7): auto enabling async discard [ 260.970661][ T28] audit: type=1800 audit(1790866537.593:64): pid=10862 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1472" name="file1" dev="loop7" ino=260 res=0 errno=0 [ 261.189950][ T9340] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 261.284783][T10911] loop6: detected capacity change from 0 to 2048 [ 261.466498][T10911] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000900 r/w without journal. Quota mode: none. [ 261.647577][T10911] EXT4-fs error (device loop6): ext4_validate_block_bitmap:439: comm syz.6.1483: bg 0: block 240: padding at end of block bitmap is not set [ 261.666751][T10911] EXT4-fs error (device loop6) in ext4_setattr:5695: error 28 [ 261.711435][T10926] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1486'. [ 261.799630][ T9109] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 262.251917][T10946] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 262.516378][T10957] Bluetooth: MGMT ver 1.22 [ 262.635626][T10940] loop0: detected capacity change from 0 to 32768 [ 262.698255][ T5764] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 262.706948][ T28] audit: type=1800 audit(1790866539.323:65): pid=10940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1489" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 262.787625][ T28] audit: type=1800 audit(1790866539.403:66): pid=10940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1489" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 262.862287][ T28] audit: type=1800 audit(1790866539.403:67): pid=10940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1489" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 262.917949][ T5764] usb 7-1: Using ep0 maxpacket: 16 [ 262.957971][ T5764] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.982503][ T5764] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 263.005576][ T5764] usb 7-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 263.016004][ T5764] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.044761][ T5764] usb 7-1: config 0 descriptor?? [ 263.092383][T10969] size and base must be multiples of 4 kiB [ 263.099603][T10969] CPU: 1 PID: 10969 Comm: syz.5.1497 Not tainted syzkaller #0 [ 263.107125][T10969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 263.117297][T10969] Call Trace: [ 263.120592][T10969] [ 263.123544][T10969] dump_stack_lvl+0x18c/0x250 [ 263.128281][T10969] ? show_regs_print_info+0x20/0x20 [ 263.133527][T10969] ? load_image+0x420/0x420 [ 263.138154][T10969] ? __might_fault+0xaa/0x120 [ 263.142852][T10969] ? __might_fault+0xc6/0x120 [ 263.147552][T10969] mtrr_add+0xd0/0x100 [ 263.151646][T10969] mtrr_ioctl+0xc96/0x13a0 [ 263.156092][T10969] ? mtrr_close+0x200/0x200 [ 263.160642][T10969] ? __fget_files+0x28/0x460 [ 263.165270][T10969] ? mtrr_close+0x200/0x200 [ 263.169802][T10969] proc_reg_unlocked_ioctl+0x1d2/0x2c0 [ 263.175382][T10969] ? proc_reg_poll+0x290/0x290 [ 263.180179][T10969] __se_sys_ioctl+0xfd/0x170 [ 263.184804][T10969] do_syscall_64+0x55/0xb0 [ 263.189252][T10969] ? clear_bhb_loop+0x40/0x90 [ 263.193993][T10969] ? clear_bhb_loop+0x40/0x90 [ 263.198707][T10969] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 263.204639][T10969] RIP: 0033:0x7fce01f9e159 [ 263.209080][T10969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 263.228721][T10969] RSP: 002b:00007fce02dc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 263.237179][T10969] RAX: ffffffffffffffda RBX: 00007fce02225fa0 RCX: 00007fce01f9e159 [ 263.245189][T10969] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000003 [ 263.253195][T10969] RBP: 00007fce0203506b R08: 0000000000000000 R09: 0000000000000000 [ 263.261200][T10969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 263.269200][T10969] R13: 00007fce02226038 R14: 00007fce02225fa0 R15: 00007ffe9425cdc8 [ 263.277225][T10969] [ 263.496627][ T5764] hid (null): report_id 0 is invalid [ 263.517925][ T5764] hid (null): report_id 4252247276 is invalid [ 263.527955][ T5764] hid (null): unknown global tag 0xe [ 263.533313][ T5764] hid (null): global environment stack underflow [ 263.550964][ T5764] hid (null): usage index exceeded [ 263.691298][ T5764] usb 7-1: string descriptor 0 read error: -71 [ 263.707705][T10976] loop0: detected capacity change from 0 to 32768 [ 263.730692][ T5764] usb 7-1: Max retries (5) exceeded reading string descriptor 200 [ 263.743980][ T5764] letsketch: probe of 0003:6161:4D15.0012 failed with error -32 [ 263.744145][T10976] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 263.764614][ T5764] usb 7-1: USB disconnect, device number 9 [ 263.863548][T10976] XFS (loop0): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 263.887133][T10976] XFS (loop0): Starting recovery (logdev: internal) [ 263.909326][T10976] XFS (loop0): Ending recovery (logdev: internal) [ 263.947317][ T28] audit: type=1800 audit(1790866540.563:68): pid=10976 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1499" name="file1" dev="loop0" ino=4422 res=0 errno=0 [ 263.992602][ T5780] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 264.348457][T10995] nbd6: detected capacity change from 0 to 127 [ 264.369803][T10997] block nbd6: NBD_DISCONNECT [ 264.381208][T10997] block nbd6: Disconnected due to user request. [ 264.401190][T10997] block nbd6: shutting down sockets [ 264.421317][ C0] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 264.430753][ C0] Buffer I/O error on dev nbd6, logical block 0, async page read [ 264.439280][ C0] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 264.448415][ C0] Buffer I/O error on dev nbd6, logical block 1, async page read [ 264.456173][ C0] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 264.465261][ C0] Buffer I/O error on dev nbd6, logical block 2, async page read [ 264.473064][ C0] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 264.482164][ C0] Buffer I/O error on dev nbd6, logical block 3, async page read [ 264.491259][ T24] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.501366][ T24] Buffer I/O error on dev nbd6, logical block 0, async page read [ 264.509320][ T24] Buffer I/O error on dev nbd6, logical block 1, async page read [ 264.517072][ T24] Buffer I/O error on dev nbd6, logical block 2, async page read [ 264.525090][ T24] Buffer I/O error on dev nbd6, logical block 3, async page read [ 264.548466][ T24] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.558024][ T5775] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 264.566196][ T5775] Bluetooth: hci0: command 0x0c1a tx timeout [ 264.572403][ T24] Buffer I/O error on dev nbd6, logical block 0, async page read [ 264.580283][ T24] Buffer I/O error on dev nbd6, logical block 1, async page read [ 264.588404][ T24] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.597761][ T24] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.607494][ T24] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.617480][ T24] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.628990][ T9020] ldm_validate_partition_table(): Disk read failed. [ 264.638530][ T9020] Dev nbd6: unable to read RDB block 0 [ 264.649033][ T9020] nbd6: unable to read partition table [ 264.669068][ T9020] ldm_validate_partition_table(): Disk read failed. [ 264.707360][ T9020] Dev nbd6: unable to read RDB block 0 [ 264.735359][ T9020] nbd6: unable to read partition table [ 264.853875][T11012] loop7: detected capacity change from 0 to 64 [ 264.911976][ T28] audit: type=1800 audit(1790866541.533:69): pid=11012 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1512" name="file1" dev="loop7" ino=22 res=0 errno=0 [ 264.998274][ T5764] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 265.009817][T11015] loop6: detected capacity change from 0 to 1024 [ 265.033434][T11015] hfsplus: invalid length 32517 has been corrected to 255 [ 265.083682][ T28] audit: type=1800 audit(1790866541.703:70): pid=11015 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1513" name="file1" dev="loop6" ino=20 res=0 errno=0 [ 265.160322][ T3478] hfsplus: b-tree write err: -5, ino 20 [ 265.220385][ T5764] usb 6-1: Using ep0 maxpacket: 8 [ 265.251542][ T5764] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 265.278313][ T5764] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 265.297766][ T5764] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.320287][ T5764] usb 6-1: config 0 descriptor?? [ 265.373490][T11023] loop6: detected capacity change from 0 to 4096 [ 265.387527][T11023] EXT4-fs: Ignoring removed nobh option [ 265.400132][T11023] EXT4-fs: Ignoring removed bh option [ 265.425582][T11023] EXT4-fs (loop6): Test dummy encryption mode enabled [ 265.463489][T11023] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 265.545767][ T5764] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 265.571439][T11030] loop0: detected capacity change from 0 to 4096 [ 265.585765][T11030] ntfs3: loop0: Failed to load $AttrDef (-2) [ 265.673718][ T9109] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 266.288922][T11059] FAULT_INJECTION: forcing a failure. [ 266.288922][T11059] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 266.328147][T11059] CPU: 0 PID: 11059 Comm: syz.6.1531 Not tainted syzkaller #0 [ 266.335677][T11059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 266.345764][T11059] Call Trace: [ 266.349060][T11059] [ 266.352009][T11059] dump_stack_lvl+0x18c/0x250 [ 266.356728][T11059] ? show_regs_print_info+0x20/0x20 [ 266.361975][T11059] ? load_image+0x420/0x420 [ 266.366507][T11059] ? __lock_acquire+0x7d80/0x7d80 [ 266.371565][T11059] should_fail_ex+0x394/0x4c0 [ 266.376280][T11059] prepare_alloc_pages+0x1e1/0x5b0 [ 266.381456][T11059] __alloc_pages+0x134/0x460 [ 266.386167][T11059] ? zone_statistics+0x170/0x170 [ 266.391142][T11059] ? alloc_pages+0x4e1/0x740 [ 266.395770][T11059] __get_free_pages+0xc/0x30 [ 266.400389][T11059] kasan_populate_vmalloc_pte+0x35/0x100 [ 266.403646][ T5764] usb 6-1: USB disconnect, device number 14 [ 266.406072][T11059] __apply_to_page_range+0x860/0xdd0 [ 266.417298][T11059] ? kasan_populate_vmalloc+0x70/0x70 [ 266.422719][T11059] ? apply_to_page_range+0x50/0x50 [ 266.427872][T11059] ? do_raw_spin_unlock+0x121/0x230 [ 266.433110][T11059] alloc_vmap_area+0x1d26/0x1e50 [ 266.438098][T11059] ? vm_map_ram+0xcf0/0xcf0 [ 266.442634][T11059] ? rcu_is_watching+0x15/0xb0 [ 266.447439][T11059] __get_vm_area_node+0x162/0x370 [ 266.452506][T11059] __vmalloc_node_range+0x36f/0x1320 [ 266.457836][T11059] ? dev_map_alloc+0x1f6/0x4c0 [ 266.462657][T11059] ? free_vm_area+0x50/0x50 [ 266.467194][T11059] ? rcu_is_watching+0x15/0xb0 [ 266.471998][T11059] ? bpf_map_area_alloc+0x5e/0x110 [ 266.477146][T11059] bpf_map_area_alloc+0xf1/0x110 [ 266.482125][T11059] ? dev_map_alloc+0x1f6/0x4c0 [ 266.486920][T11059] dev_map_alloc+0x1f6/0x4c0 [ 266.491541][T11059] map_create+0x877/0x12f0 [ 266.495996][T11059] __sys_bpf+0x651/0x890 [ 266.500451][T11059] ? bpf_link_show_fdinfo+0x560/0x560 [ 266.505871][T11059] ? lock_chain_count+0x20/0x20 [ 266.510773][T11059] __x64_sys_bpf+0x7c/0x90 [ 266.515216][T11059] do_syscall_64+0x55/0xb0 [ 266.519667][T11059] ? clear_bhb_loop+0x40/0x90 [ 266.524387][T11059] ? clear_bhb_loop+0x40/0x90 [ 266.529097][T11059] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 266.535607][T11059] RIP: 0033:0x7f2de6f9e159 [ 266.540066][T11059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.560053][T11059] RSP: 002b:00007f2de7e03028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 266.568504][T11059] RAX: ffffffffffffffda RBX: 00007f2de7225fa0 RCX: 00007f2de6f9e159 [ 266.576588][T11059] RDX: 0000000000000048 RSI: 0000200000000540 RDI: 0000000000000000 [ 266.584586][T11059] RBP: 00007f2de703506b R08: 0000000000000000 R09: 0000000000000000 [ 266.592599][T11059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 266.600610][T11059] R13: 00007f2de7226038 R14: 00007f2de7225fa0 R15: 00007ffc1c600288 [ 266.608621][T11059] [ 266.893562][T11070] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1536'. [ 266.899368][ T5764] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 267.127945][ T5764] usb 6-1: Using ep0 maxpacket: 16 [ 267.135097][ T5764] usb 6-1: config index 0 descriptor too short (expected 16456, got 72) [ 267.148103][ T5764] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 267.176658][ T5764] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 267.203556][ T5764] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 267.215313][ T5764] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 267.224354][ T5764] usb 6-1: config 0 has no interface number 0 [ 267.234539][ T5764] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 267.247908][ T5764] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 267.268228][ T5764] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 267.283947][ T5764] usb 6-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 267.317921][ T5764] usb 6-1: config 0 interface 125 has no altsetting 0 [ 267.327999][ T5764] usb 6-1: config 0 interface 125 has no altsetting 2 [ 267.337831][ T5764] usb 6-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 267.359223][ T5764] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.367267][ T5764] usb 6-1: Product: syz [ 267.381729][ T5764] usb 6-1: Manufacturer: syz [ 267.386390][ T5764] usb 6-1: SerialNumber: syz [ 267.409152][ T5764] usb 6-1: config 0 descriptor?? [ 267.441604][ T5764] usb 6-1: selecting invalid altsetting 2 [ 267.750149][ T8694] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 267.774535][T11076] IPVS: You probably need to specify IP address on multicast interface. [ 267.783353][ T8694] hid-generic 0000:0000:0000.0013: hidraw0: HID v0.00 Device [syz1] on syz0 [ 267.812499][T11076] IPVS: Error connecting to the multicast addr [ 267.823414][T11091] size and base must be multiples of 4 kiB [ 267.845831][T11091] CPU: 0 PID: 11091 Comm: syz.7.1545 Not tainted syzkaller #0 [ 267.853360][T11091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 267.863533][T11091] Call Trace: [ 267.866840][T11091] [ 267.869800][T11091] dump_stack_lvl+0x18c/0x250 [ 267.874519][T11091] ? show_regs_print_info+0x20/0x20 [ 267.879757][T11091] ? load_image+0x420/0x420 [ 267.884307][T11091] ? __might_fault+0xaa/0x120 [ 267.889022][T11091] ? __might_fault+0xc6/0x120 [ 267.893744][T11091] mtrr_add+0xd0/0x100 [ 267.897854][T11091] mtrr_ioctl+0xc96/0x13a0 [ 267.902315][T11091] ? mtrr_close+0x200/0x200 [ 267.906880][T11091] ? __fget_files+0x28/0x460 [ 267.911557][T11091] ? mtrr_close+0x200/0x200 [ 267.916100][T11091] proc_reg_unlocked_ioctl+0x1d2/0x2c0 [ 267.921609][T11091] ? proc_reg_poll+0x290/0x290 [ 267.926417][T11091] __se_sys_ioctl+0xfd/0x170 [ 267.931061][T11091] do_syscall_64+0x55/0xb0 [ 267.935522][T11091] ? clear_bhb_loop+0x40/0x90 [ 267.940246][T11091] ? clear_bhb_loop+0x40/0x90 [ 267.945149][T11091] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 267.951090][T11091] RIP: 0033:0x7fe5c3d9e159 [ 267.955509][T11091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.975277][T11091] RSP: 002b:00007fe5c4c20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 267.983704][T11091] RAX: ffffffffffffffda RBX: 00007fe5c4025fa0 RCX: 00007fe5c3d9e159 [ 267.991704][T11091] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000003 [ 267.999687][T11091] RBP: 00007fe5c3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 268.007661][T11091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 268.015632][T11091] R13: 00007fe5c4026038 R14: 00007fe5c4025fa0 R15: 00007ffdac105cb8 [ 268.023631][T11091] [ 268.264074][ T5764] parport0: fix this legacy no-device port driver! [ 268.474494][ T790] usb 6-1: USB disconnect, device number 15 [ 268.598218][ T5764] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 268.790402][ T5764] usb 7-1: unable to get BOS descriptor or descriptor too short [ 268.816145][ T5764] usb 7-1: config 1 has an invalid interface association descriptor of length 2, skipping [ 268.841806][ T5764] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 268.854865][ T5764] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 268.875630][ T5764] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 268.915855][ T5764] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.936339][ T5764] usb 7-1: Product: syz [ 268.956724][ T5764] usb 7-1: Manufacturer: syz [ 268.972832][ T5764] usb 7-1: SerialNumber: syz [ 269.208640][ T5764] cdc_ncm 7-1:1.0: skipping garbage [ 269.220376][ T5764] cdc_ncm 7-1:1.0: skipping garbage [ 269.225718][ T5764] cdc_ncm 7-1:1.0: invalid descriptor buffer length [ 269.228390][T11099] loop7: detected capacity change from 0 to 131072 [ 269.235158][ T5764] cdc_ncm 7-1:1.0: NCM or ECM functional descriptors missing [ 269.251037][T11099] F2FS-fs (loop7): invalid crc value [ 269.288861][T11099] F2FS-fs (loop7): Found nat_bits in checkpoint [ 269.289900][ T5764] cdc_ncm 7-1:1.0: bind() failure [ 269.323595][ T5764] usb 7-1: USB disconnect, device number 10 [ 269.351094][T11099] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 269.457216][T11099] F2FS-fs (loop7): lookup inode (7) has corrupted xattr [ 269.469842][ T28] audit: type=1800 audit(1790866546.093:71): pid=11099 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1548" name="file1" dev="loop7" ino=7 res=0 errno=0 [ 269.708862][ T5831] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 269.933418][ T5831] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 269.957999][ T5831] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 269.997973][ T5831] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 270.035274][T11127] loop0: detected capacity change from 0 to 2048 [ 270.040654][ T5831] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 270.057916][ T5831] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.086916][ T5831] usb 6-1: Product: syz [ 270.104870][ T5831] usb 6-1: Manufacturer: syz [ 270.120009][ T5831] usb 6-1: SerialNumber: syz [ 270.125984][T11127] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 270.143474][ T5831] cdc_mbim 6-1:1.0: skipping garbage [ 270.352391][T11113] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 270.387148][ T5780] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 270.980094][T11113] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 271.008042][ T790] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 271.190910][ T5831] cdc_mbim 6-1:1.0: bind() failure [ 271.211047][ T5831] cdc_ncm: probe of 6-1:1.1 failed with error -71 [ 271.214423][ T790] usb 7-1: Using ep0 maxpacket: 16 [ 271.222655][ T5831] cdc_mbim: probe of 6-1:1.1 failed with error -71 [ 271.223756][ T5831] usbtest: probe of 6-1:1.1 failed with error -71 [ 271.232185][ T790] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 271.244904][ T790] usb 7-1: config 0 has no interface number 0 [ 271.249270][ T5831] usb 6-1: USB disconnect, device number 16 [ 271.257089][ T790] usb 7-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 271.271130][ T790] usb 7-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 271.283782][ T790] usb 7-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 271.310090][ T790] usb 7-1: config 0 interface 1 has no altsetting 0 [ 271.327967][ T790] usb 7-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 271.337108][ T790] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.366324][ T790] usb 7-1: config 0 descriptor?? [ 271.382265][ T790] usbhid 7-1:0.1: fixing wrong optional hid class descriptors count [ 271.469397][T11165] hsr0: entered promiscuous mode [ 271.480423][T11165] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1574'. [ 271.493196][T11165] hsr_slave_0: left promiscuous mode [ 271.508553][T11165] hsr_slave_1: left promiscuous mode [ 271.581907][T11165] hsr0 (unregistering): left promiscuous mode [ 271.803069][ T790] elan 0003:04F3:074D.0014: failed to start in urb: -90 [ 271.934998][T11178] netlink: 'syz.5.1580': attribute type 2 has an invalid length. [ 271.947644][T11178] netlink: 'syz.5.1580': attribute type 2 has an invalid length. [ 272.195971][ T790] elan 0003:04F3:074D.0014: Get report error for parm 6: -71 [ 272.197110][ T5831] IPVS: starting estimator thread 0... [ 272.232126][ T790] elan 0003:04F3:074D.0014: hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.6-1/input1 [ 272.279040][ T790] elan 0003:04F3:074D.0014: Input device is not registered [ 272.301303][ T790] elan: probe of 0003:04F3:074D.0014 failed with error -119 [ 272.318725][T11189] IPVS: using max 18 ests per chain, 43200 per kthread [ 272.328090][ T8693] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 272.339351][ T790] usb 7-1: USB disconnect, device number 11 [ 272.426578][T11192] fido_id[11192]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 272.429688][T11195] loop5: detected capacity change from 0 to 6 [ 272.488771][T11195] Dev loop5: unable to read RDB block 6 [ 272.495003][T11195] loop5: unable to read partition table [ 272.508346][T11195] loop5: partition table beyond EOD, truncated [ 272.526600][T11195] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 272.577925][ T8693] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 272.586115][ T8693] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.633737][ T8693] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.657114][ T8693] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 272.674377][ T8693] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 272.694134][ T8693] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.729117][ T8693] usb 6-1: config 0 descriptor?? [ 273.021868][T11206] serio: Serial port ttynull [ 273.161558][ T8693] plantronics 0003:047F:FFFF.0015: No inputs registered, leaving [ 273.183719][ T8693] plantronics 0003:047F:FFFF.0015: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 273.308087][ T8694] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 273.443144][ T5764] usb 6-1: USB disconnect, device number 17 [ 273.492763][ T8694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 273.504192][ T8694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 273.514086][ T8694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 273.524958][ T8694] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 273.534117][ T8694] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.545173][ T8694] usb 7-1: config 0 descriptor?? [ 273.971578][ T8694] plantronics 0003:047F:FFFF.0016: No inputs registered, leaving [ 273.998260][ T8694] plantronics 0003:047F:FFFF.0016: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 274.058935][T11215] loop5: detected capacity change from 0 to 512 [ 274.078529][T11215] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 274.201995][T11217] input: syz0 as /devices/virtual/input/input29 [ 274.526519][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805d4b4400: rx timeout, send abort [ 274.539339][ C1] vxcan1: j1939_xtp_rx_abort_one: 0xffff88805d4b4400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 274.708030][ T790] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 274.887989][ T790] usb 6-1: Using ep0 maxpacket: 8 [ 274.895633][ T790] usb 6-1: unable to get BOS descriptor or descriptor too short [ 274.907794][ T790] usb 6-1: config 140 has an invalid descriptor of length 0, skipping remainder of the config [ 274.918394][ T790] usb 6-1: config 140 has 1 interface, different from the descriptor's value: 2 [ 274.930757][ T790] usb 6-1: New USB device found, idVendor=1039, idProduct=2101, bcdDevice=25.81 [ 274.940162][ T790] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.949411][ T790] usb 6-1: Product: syz [ 274.953608][ T790] usb 6-1: Manufacturer: syz [ 274.959852][ T790] usb 6-1: SerialNumber: syz [ 275.189322][ T790] usb 6-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2101) Rev (0X2581): Eagle I [ 275.886397][ T790] usb 6-1: reset high-speed USB device number 18 using dummy_hcd [ 276.126190][ T790] usb 6-1: unable to get BOS descriptor or descriptor too short [ 276.157063][ T790] usb 6-1: device firmware changed [ 276.161556][ T8693] usb 7-1: USB disconnect, device number 12 [ 276.181313][ T790] usb 6-1: [ueagle-atm] pre-firmware device, uploading firmware [ 276.218417][ T790] usb 6-1: [ueagle-atm] loading firmware ueagle-atm/eagleI.fw [ 276.227526][ T8705] usb 6-1: Direct firmware load for ueagle-atm/eagleI.fw failed with error -2 [ 276.245053][ T790] usb 6-1: USB disconnect, device number 18 [ 276.258206][ T8705] usb 6-1: Falling back to sysfs fallback for: ueagle-atm/eagleI.fw [ 276.332813][T11237] loop0: detected capacity change from 0 to 8192 [ 276.382717][T11237] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 276.415604][T11237] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 276.426077][T11237] REISERFS (device loop0): using ordered data mode [ 276.432985][T11237] reiserfs: using flush barriers [ 276.441191][T11237] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 276.459470][T11237] REISERFS (device loop0): checking transaction log (loop0) [ 276.464477][T11245] FAULT_INJECTION: forcing a failure. [ 276.464477][T11245] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 276.525188][T11245] CPU: 0 PID: 11245 Comm: syz.6.1606 Not tainted syzkaller #0 [ 276.532718][T11245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 276.542801][T11245] Call Trace: [ 276.546102][T11245] [ 276.549056][T11245] dump_stack_lvl+0x18c/0x250 [ 276.553769][T11245] ? show_regs_print_info+0x20/0x20 [ 276.559028][T11245] ? load_image+0x420/0x420 [ 276.563565][T11245] ? __lock_acquire+0x7d80/0x7d80 [ 276.568646][T11245] ? do_futex+0x2ff/0x3e0 [ 276.573017][T11245] should_fail_ex+0x394/0x4c0 [ 276.577738][T11245] strncpy_from_user+0x36/0x2f0 [ 276.582631][T11245] __se_sys_add_key+0xdc/0x410 [ 276.587432][T11245] ? __x64_sys_add_key+0xc0/0xc0 [ 276.592412][T11245] ? lockdep_hardirqs_on+0x98/0x150 [ 276.597645][T11245] ? __x64_sys_add_key+0x20/0xc0 [ 276.602624][T11245] do_syscall_64+0x55/0xb0 [ 276.607079][T11245] ? clear_bhb_loop+0x40/0x90 [ 276.611892][T11245] ? clear_bhb_loop+0x40/0x90 [ 276.616611][T11245] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 276.622543][T11245] RIP: 0033:0x7f2de6f9e159 [ 276.627249][T11245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 276.646890][T11245] RSP: 002b:00007f2de7e03028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 276.655348][T11245] RAX: ffffffffffffffda RBX: 00007f2de7225fa0 RCX: 00007f2de6f9e159 [ 276.663353][T11245] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 276.671354][T11245] RBP: 00007f2de703506b R08: ffffffffffffffff R09: 0000000000000000 [ 276.679359][T11245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 276.687369][T11245] R13: 00007f2de7226038 R14: 00007f2de7225fa0 R15: 00007ffc1c600288 [ 276.695392][T11245] [ 276.851074][T11237] REISERFS (device loop0): Using tea hash to sort names [ 276.865736][T11237] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 277.010435][T11248] loop7: detected capacity change from 0 to 32768 [ 277.038085][T11248] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop7 scanned by syz.7.1608 (11248) [ 277.085018][T11248] BTRFS info (device loop7): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 277.111641][T11248] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 277.139453][T11248] BTRFS info (device loop7): setting nodatacow, compression disabled [ 277.147606][T11248] BTRFS info (device loop7): setting datasum, datacow enabled [ 277.181937][T11248] BTRFS info (device loop7): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 277.208362][T11248] BTRFS info (device loop7): force zstd compression, level 3 [ 277.215831][T11248] BTRFS info (device loop7): turning on sync discard [ 277.248777][T11248] BTRFS warning (device loop7): excessive commit interval 43283 [ 277.256494][T11248] BTRFS info (device loop7): enabling ssd optimizations [ 277.281351][T11248] BTRFS info (device loop7): using spread ssd allocation scheme [ 277.295361][T11248] BTRFS info (device loop7): not using ssd optimizations [ 277.314197][ T8706] IPVS: starting estimator thread 0... [ 277.328056][T11248] BTRFS info (device loop7): not using spread ssd allocation scheme [ 277.348028][T11248] BTRFS info (device loop7): using free space tree [ 277.429658][T11262] IPVS: using max 35 ests per chain, 84000 per kthread [ 277.547737][ T28] audit: type=1800 audit(1790866554.163:72): pid=11248 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1608" name="file1" dev="loop7" ino=260 res=0 errno=0 [ 277.691348][T11248] BTRFS info (device loop7): balance: start -sconvert=raid0,usage=0..1342177280 [ 277.794323][T11248] BTRFS info (device loop7): relocating block group 1048576 flags system [ 277.822638][T11248] BTRFS info (device loop7): balance: canceled [ 277.968382][ T9340] BTRFS info (device loop7): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 278.404462][T11302] loop6: detected capacity change from 0 to 4096 [ 278.653762][T11309] FAULT_INJECTION: forcing a failure. [ 278.653762][T11309] name failslab, interval 1, probability 0, space 0, times 0 [ 278.678018][T11309] CPU: 1 PID: 11309 Comm: syz.0.1628 Not tainted syzkaller #0 [ 278.685773][T11309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 278.695867][T11309] Call Trace: [ 278.699185][T11309] [ 278.702143][T11309] dump_stack_lvl+0x18c/0x250 [ 278.706889][T11309] ? show_regs_print_info+0x20/0x20 [ 278.712308][T11309] ? load_image+0x420/0x420 [ 278.716947][T11309] ? __might_sleep+0xe0/0xe0 [ 278.722482][T11309] ? __lock_acquire+0x7d80/0x7d80 [ 278.727561][T11309] ? mark_lock+0x94/0x320 [ 278.731934][T11309] should_fail_ex+0x394/0x4c0 [ 278.736630][T11309] should_failslab+0x9/0x20 [ 278.741145][T11309] slab_pre_alloc_hook+0x59/0x300 [ 278.746183][T11309] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 278.751909][T11309] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 278.757629][T11309] __kmem_cache_alloc_node+0x53/0x250 [ 278.763014][T11309] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 278.768736][T11309] __kmalloc+0xa7/0x240 [ 278.772903][T11309] tomoyo_realpath_from_path+0xe6/0x5c0 [ 278.778449][T11309] ? tomoyo_domain+0xd6/0x120 [ 278.783129][T11309] tomoyo_path_perm+0x282/0x560 [ 278.788003][T11309] ? tomoyo_path_perm+0x250/0x560 [ 278.793055][T11309] ? tomoyo_path_permission+0x3a0/0x3a0 [ 278.798621][T11309] ? futex_wait+0x4a7/0x5c0 [ 278.803161][T11309] security_inode_getattr+0xd3/0x120 [ 278.808462][T11309] __x64_sys_newfstat+0x12c/0x250 [ 278.813488][T11309] ? __ia32_sys_newfstatat+0x1f0/0x1f0 [ 278.818963][T11309] ? lockdep_hardirqs_on+0x98/0x150 [ 278.824170][T11309] do_syscall_64+0x55/0xb0 [ 278.828654][T11309] ? clear_bhb_loop+0x40/0x90 [ 278.833437][T11309] ? clear_bhb_loop+0x40/0x90 [ 278.838123][T11309] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 278.844035][T11309] RIP: 0033:0x7f31b3d9e159 [ 278.848453][T11309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.868068][T11309] RSP: 002b:00007f31b4d52028 EFLAGS: 00000246 ORIG_RAX: 0000000000000005 [ 278.876490][T11309] RAX: ffffffffffffffda RBX: 00007f31b4025fa0 RCX: 00007f31b3d9e159 [ 278.884469][T11309] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 278.892454][T11309] RBP: 00007f31b3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 278.900430][T11309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.908399][T11309] R13: 00007f31b4026038 R14: 00007f31b4025fa0 R15: 00007fff7b100298 [ 278.916388][T11309] [ 278.947571][T11309] ERROR: Out of memory at tomoyo_realpath_from_path. [ 279.034633][T11304] loop5: detected capacity change from 0 to 32768 [ 279.102835][T11304] XFS (loop5): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 279.136062][T11304] XFS (loop5): Ending clean mount [ 279.242462][T11321] device-mapper: ioctl: Invalid ioctl structure: name t, dev f801 [ 279.648306][ T7293] XFS (loop5): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 279.837487][T11336] loop0: detected capacity change from 0 to 2048 [ 279.933876][T11336] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 280.020663][T11344] loop6: detected capacity change from 0 to 4096 [ 280.078381][T11345] FAULT_INJECTION: forcing a failure. [ 280.078381][T11345] name failslab, interval 1, probability 0, space 0, times 0 [ 280.117106][T11347] loop7: detected capacity change from 0 to 256 [ 280.117625][T11336] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 280.149464][T11345] CPU: 1 PID: 11345 Comm: syz.5.1634 Not tainted syzkaller #0 [ 280.157001][T11345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.168013][T11345] Call Trace: [ 280.171326][T11345] [ 280.174289][T11345] dump_stack_lvl+0x18c/0x250 [ 280.179013][T11345] ? show_regs_print_info+0x20/0x20 [ 280.184426][T11345] ? load_image+0x420/0x420 [ 280.188974][T11345] ? __lock_acquire+0x7d80/0x7d80 [ 280.194132][T11345] should_fail_ex+0x394/0x4c0 [ 280.198874][T11345] should_failslab+0x9/0x20 [ 280.203413][T11345] slab_pre_alloc_hook+0x59/0x300 [ 280.208480][T11345] ? kvmalloc_node+0x70/0x180 [ 280.213195][T11345] ? kvmalloc_node+0x70/0x180 [ 280.217915][T11345] __kmem_cache_alloc_node+0x53/0x250 [ 280.223439][T11345] ? kvmalloc_node+0x70/0x180 [ 280.229386][T11345] __kmalloc_node+0xa6/0x240 [ 280.234040][T11345] kvmalloc_node+0x70/0x180 [ 280.238564][T11345] newary+0x13d/0xab0 [ 280.242612][T11345] ? ipcget+0x13c/0xe10 [ 280.246808][T11345] ipcget+0x9ee/0xe10 [ 280.250825][T11345] ? ipcget+0x13c/0xe10 [ 280.255032][T11345] ? ipc_obtain_object_check+0x1a0/0x1a0 [ 280.260714][T11345] __x64_sys_semget+0x1ab/0x210 [ 280.265606][T11345] ? sem_more_checks+0xa0/0xa0 [ 280.270426][T11345] ? lockdep_hardirqs_on+0x98/0x150 [ 280.275672][T11345] do_syscall_64+0x55/0xb0 [ 280.280128][T11345] ? clear_bhb_loop+0x40/0x90 [ 280.284829][T11345] ? clear_bhb_loop+0x40/0x90 [ 280.289516][T11345] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 280.295418][T11345] RIP: 0033:0x7fce01f9e159 [ 280.299862][T11345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.319570][T11345] RSP: 002b:00007fce02dc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000040 [ 280.328041][T11345] RAX: ffffffffffffffda RBX: 00007fce02225fa0 RCX: 00007fce01f9e159 [ 280.336027][T11345] RDX: 0000000000000200 RSI: 0000000000000003 RDI: 00000000798e264a [ 280.344002][T11345] RBP: 00007fce0203506b R08: 0000000000000000 R09: 0000000000000000 [ 280.351976][T11345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 280.360034][T11345] R13: 00007fce02226038 R14: 00007fce02225fa0 R15: 00007ffe9425cdc8 [ 280.368022][T11345] [ 280.557987][ T28] audit: type=1800 audit(1790866557.163:73): pid=11344 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1641" name="file1" dev="loop6" ino=33 res=0 errno=0 [ 280.879641][T11361] team_slave_0: entered promiscuous mode [ 280.886319][T11361] team_slave_1: entered promiscuous mode [ 280.895272][T11361] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 280.927580][T11364] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 281.841786][T11398] loop7: detected capacity change from 0 to 256 [ 281.880888][T11398] exfat: Unknown parameter '01777777777777777777777' [ 282.350692][T11414] loop0: detected capacity change from 0 to 256 [ 282.401120][T11414] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011a39, chksum : 0xd7c18d7b, utbl_chksum : 0xe619d30d) [ 282.501497][T11419] loop7: detected capacity change from 0 to 1024 [ 282.548254][ T8693] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 282.762298][ T8693] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 282.785056][ T8693] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 282.805588][ T8693] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 282.832486][ T8693] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 282.848422][ T8693] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 282.856481][ T8693] usb 7-1: Product: syz [ 282.879005][ T8693] usb 7-1: Manufacturer: syz [ 282.891023][T11412] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 282.908893][ T8693] garmin_gps 7-1:1.0: Garmin GPS usb/tty converter detected [ 282.932522][ T8693] usb 7-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 282.954292][T11426] syzkaller1: entered promiscuous mode [ 283.009262][T11426] syzkaller1: entered allmulticast mode [ 283.190625][ T8693] usb 7-1: USB disconnect, device number 13 [ 283.210302][ T8693] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 283.239900][ T8693] garmin_gps 7-1:1.0: device disconnected [ 283.662646][T11446] erspan0: entered promiscuous mode [ 283.731890][T11449] mkiss: ax0: crc mode is auto. [ 283.906307][T11453] netlink: 104 bytes leftover after parsing attributes in process `syz.7.1689'. [ 284.296802][ T8693] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 284.484693][T11458] loop5: detected capacity change from 0 to 32768 [ 284.556328][T11458] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 284.613820][ T8693] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 284.866977][ T7293] ocfs2: Unmounting device (7,5) on (node local) [ 284.969155][T11460] ceph: No mds server is up or the cluster is laggy [ 285.338100][T11488] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1699'. [ 285.350687][T11492] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1699'. [ 285.379067][T11492] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1699'. [ 285.454253][T11496] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 285.465569][T11494] loop7: detected capacity change from 0 to 2048 [ 285.485772][T11494] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 285.908547][ T8703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 285.991110][T11511] loop6: detected capacity change from 0 to 4096 [ 286.022953][T11511] ntfs: (device loop6): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 286.093432][T11511] ntfs: (device loop6): read_ntfs_boot_sector(): Hot-fix: Recovering invalid primary boot sector from backup copy. [ 286.140156][T11511] ntfs: (device loop6): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 286.156601][T11518] loop7: detected capacity change from 0 to 256 [ 286.157735][T11511] ntfs: (device loop6): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 286.173355][T11518] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 286.198273][T11511] ntfs: (device loop6): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 286.207256][T11511] ntfs: (device loop6): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 286.265626][T11518] FAT-fs (loop7): Directory bread(block 64) failed [ 286.286905][T11511] ntfs: (device loop6): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 286.295890][T11518] FAT-fs (loop7): Directory bread(block 65) failed [ 286.324697][T11518] FAT-fs (loop7): Directory bread(block 66) failed [ 286.331489][T11511] ntfs: (device loop6): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 286.358415][T11518] FAT-fs (loop7): Directory bread(block 67) failed [ 286.376946][T11518] FAT-fs (loop7): Directory bread(block 68) failed [ 286.394147][T11518] FAT-fs (loop7): Directory bread(block 69) failed [ 286.405151][T11511] ntfs: (device loop6): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 286.418113][T11518] FAT-fs (loop7): Directory bread(block 70) failed [ 286.437953][T11511] ntfs: (device loop6): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 286.459348][T11518] FAT-fs (loop7): Directory bread(block 71) failed [ 286.466282][T11518] FAT-fs (loop7): Directory bread(block 72) failed [ 286.483361][T11518] FAT-fs (loop7): Directory bread(block 73) failed [ 286.526825][T11511] ntfs: volume version 3.1. [ 286.565374][T11524] loop0: detected capacity change from 0 to 256 [ 286.587741][T11524] exfat: Unknown parameter '01777777777777777777777' [ 286.961040][ T8703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 287.154807][T11534] loop7: detected capacity change from 0 to 4096 [ 287.188624][ T8693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 287.508412][ T8693] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 288.027634][ T8702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 288.894453][ T2913] tipc: Subscription rejected, illegal request [ 289.030833][ T8696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.206416][T11600] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1751'. [ 289.222093][T11600] ip6gre1: entered promiscuous mode [ 289.227499][T11600] ip6gre1: entered allmulticast mode [ 289.528919][T11612] loop7: detected capacity change from 0 to 4096 [ 289.560673][T11612] ntfs3: loop7: ino=3, mi_enum_attr [ 289.766876][T11620] loop0: detected capacity change from 0 to 1024 [ 289.807981][ T8696] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 289.829527][T11620] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback. [ 289.920585][ T5780] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 289.999975][ T8696] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 290.007963][T11629] loop0: detected capacity change from 0 to 2048 [ 290.016449][ T8696] usb 7-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 290.016478][ T8696] usb 7-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 290.049673][T11629] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 290.068286][ T8707] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.080309][ T8696] usb 7-1: Product: syz [ 290.084540][ T8696] usb 7-1: Manufacturer: syz [ 290.091938][ T8696] usb 7-1: SerialNumber: syz [ 290.099447][ T8696] usb 7-1: config 0 descriptor?? [ 290.113558][ T8696] keyspan 7-1:0.0: Keyspan 4 port adapter converter detected [ 290.121486][ T8696] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 81 [ 290.132405][ T8696] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 88 [ 290.144382][ T8696] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 1 [ 290.155735][ T8696] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 290.171036][ T8696] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 2 [ 290.181818][ T8696] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 290.201462][ T8696] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 4 [ 290.216159][ T8696] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 290.232414][ T8696] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 6 [ 290.244195][ T8696] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 290.384727][T11632] loop0: detected capacity change from 0 to 512 [ 290.444208][T11632] EXT4-fs error (device loop0): ext4_iget_extra_inode:4752: inode #15: comm syz.0.1764: corrupted in-inode xattr: bad e_name length [ 290.471217][T11632] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.1764: couldn't read orphan inode 15 (err -117) [ 290.500880][T11632] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 290.548492][T11558] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.610262][ T5780] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 290.683479][T11558] usb 7-1: USB disconnect, device number 14 [ 290.706154][T11558] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 290.729131][T11558] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 290.753298][T11558] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 290.795020][T11558] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 290.824551][T11558] keyspan 7-1:0.0: device disconnected [ 291.130078][ T8707] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 291.348591][T11661] loop6: detected capacity change from 0 to 128 [ 291.416477][T11661] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 291.470161][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.494669][T11661] ext4 filesystem being mounted at /163/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 291.583500][ T9109] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 291.636076][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.771122][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.890536][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 291.992750][ T5775] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 292.003430][ T5775] Bluetooth: hci2: Injecting HCI hardware error event [ 292.015641][ T5778] Bluetooth: hci2: hardware error 0x00 [ 292.169862][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 292.190318][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 292.201523][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 292.212381][ T5782] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 292.221347][ T5782] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 292.230114][ T5782] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 292.273286][T11667] loop6: detected capacity change from 0 to 32768 [ 292.418390][T11674] loop0: detected capacity change from 0 to 128 [ 292.423430][ T12] tipc: Disabling bearer [ 292.472555][ T12] tipc: Left network mode [ 292.515801][T11674] EXT4-fs (loop0): Test dummy encryption mode enabled [ 292.596145][T11674] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 292.661784][T11674] ext4 filesystem being mounted at /486/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 292.887283][ T5780] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 293.097134][T11670] chnl_net:caif_netlink_parms(): no params data found [ 293.491840][T11670] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.503137][T11670] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.517369][T11670] bridge_slave_0: entered allmulticast mode [ 293.526975][T11670] bridge_slave_0: entered promiscuous mode [ 293.535983][T11670] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.543482][T11670] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.550871][T11670] bridge_slave_1: entered allmulticast mode [ 293.557769][T11670] bridge_slave_1: entered promiscuous mode [ 293.595877][T11708] »»»»»»: renamed from vlan0 (while UP) [ 293.652418][T11670] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 293.671804][T11670] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.801543][T11715] loop0: detected capacity change from 0 to 512 [ 293.863192][T11715] EXT4-fs error (device loop0): ext4_orphan_get:1434: comm syz.0.1791: bad orphan inode 11862016 [ 293.887537][T11670] team0: Port device team_slave_0 added [ 293.893386][T11715] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 293.911018][T11670] team0: Port device team_slave_1 added [ 293.937795][T11715] ext4 filesystem being mounted at /491/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 293.986572][T11670] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 293.995413][T11670] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 294.051674][T11670] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 294.069549][ T5778] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 294.089953][T11670] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 294.103180][T11670] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 294.185275][T11670] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 294.309482][ T5778] Bluetooth: hci1: command tx timeout [ 294.333038][ T5780] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 294.655026][T11739] loop0: detected capacity change from 0 to 256 [ 294.727082][T11741] loop6: detected capacity change from 0 to 128 [ 294.762666][T11741] EXT4-fs (loop6): mounting ext2 file system using the ext4 subsystem [ 294.833441][T11670] hsr_slave_0: entered promiscuous mode [ 294.850666][T11741] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 294.863428][T11670] hsr_slave_1: entered promiscuous mode [ 294.879555][T11741] ext2 filesystem being mounted at /170/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 294.916788][T11670] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 294.954123][T11670] Cannot create hsr debugfs directory [ 295.022349][T11749] FAULT_INJECTION: forcing a failure. [ 295.022349][T11749] name failslab, interval 1, probability 0, space 0, times 0 [ 295.035472][T11749] CPU: 1 PID: 11749 Comm: syz.7.1799 Not tainted syzkaller #0 [ 295.043113][T11749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 295.053196][T11749] Call Trace: [ 295.056505][T11749] [ 295.059468][T11749] dump_stack_lvl+0x18c/0x250 [ 295.065149][T11749] ? show_regs_print_info+0x20/0x20 [ 295.070398][T11749] ? load_image+0x420/0x420 [ 295.074941][T11749] ? __might_sleep+0xe0/0xe0 [ 295.079573][T11749] ? __lock_acquire+0x7d80/0x7d80 [ 295.084638][T11749] should_fail_ex+0x394/0x4c0 [ 295.089360][T11749] should_failslab+0x9/0x20 [ 295.093899][T11749] slab_pre_alloc_hook+0x59/0x300 [ 295.098971][T11749] ? newseg+0x235/0xb10 [ 295.103338][T11749] __kmem_cache_alloc_node+0x53/0x250 [ 295.108758][T11749] ? newseg+0x235/0xb10 [ 295.112958][T11749] kmalloc_trace+0x2a/0xe0 [ 295.117420][T11749] newseg+0x235/0xb10 [ 295.121442][T11749] ? ksys_shmget+0x140/0x140 [ 295.126051][T11749] ? file_end_write+0x159/0x250 [ 295.130914][T11749] ipcget+0x1d1/0xe10 [ 295.134914][T11749] ? do_futex+0x2ff/0x3e0 [ 295.139262][T11749] ? __ia32_sys_get_robust_list+0x110/0x110 [ 295.145195][T11749] ? ipc_obtain_object_check+0x1a0/0x1a0 [ 295.150872][T11749] __x64_sys_shmget+0x141/0x180 [ 295.155766][T11749] ? lock_chain_count+0x20/0x20 [ 295.160744][T11749] ? shm_more_checks+0x80/0x80 [ 295.165553][T11749] ? lockdep_hardirqs_on+0x98/0x150 [ 295.170793][T11749] do_syscall_64+0x55/0xb0 [ 295.175256][T11749] ? clear_bhb_loop+0x40/0x90 [ 295.176581][T11741] EXT4-fs error (device loop6): ext4_append:79: inode #2: comm syz.6.1797: Logical block already allocated [ 295.180042][T11749] ? clear_bhb_loop+0x40/0x90 [ 295.180244][T11749] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 295.180271][T11749] RIP: 0033:0x7fe5c3d9e159 [ 295.202672][T11741] EXT4-fs (loop6): Remounting filesystem read-only [ 295.202933][T11749] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.233517][T11749] RSP: 002b:00007fe5c4c20028 EFLAGS: 00000246 ORIG_RAX: 000000000000001d [ 295.242055][T11749] RAX: ffffffffffffffda RBX: 00007fe5c4025fa0 RCX: 00007fe5c3d9e159 [ 295.250067][T11749] RDX: 0000000000000800 RSI: 0000000000002000 RDI: 0000000000000000 [ 295.258066][T11749] RBP: 00007fe5c3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 295.266117][T11749] R10: 0000200000fc2000 R11: 0000000000000246 R12: 0000000000000000 [ 295.274083][T11749] R13: 00007fe5c4026038 R14: 00007fe5c4025fa0 R15: 00007ffdac105cb8 [ 295.282061][T11749] [ 295.357387][ T12] hsr_slave_0: left promiscuous mode [ 295.367519][ T9109] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 295.392652][ T12] hsr_slave_1: left promiscuous mode [ 295.428260][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 295.442896][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 295.458976][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 295.466562][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 295.492410][ T12] bridge_slave_1: left allmulticast mode [ 295.500746][ T12] bridge_slave_1: left promiscuous mode [ 295.506530][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.531141][T11756] loop7: detected capacity change from 0 to 128 [ 295.545276][ T12] bridge_slave_0: left allmulticast mode [ 295.560915][ T12] bridge_slave_0: left promiscuous mode [ 295.577466][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.653113][ T12] veth1_macvtap: left promiscuous mode [ 295.662729][ T12] veth1_vlan: left promiscuous mode [ 295.685433][ T12] veth0_vlan: left promiscuous mode [ 296.408943][ T5778] Bluetooth: hci1: command tx timeout [ 296.734210][T11780] loop7: detected capacity change from 0 to 8192 [ 296.757977][T11780] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 296.777446][T11780] REISERFS (device loop7): found reiserfs format "3.6" with non-standard journal [ 296.787045][T11780] REISERFS (device loop7): using ordered data mode [ 296.794421][T11780] reiserfs: using flush barriers [ 296.807949][T11780] REISERFS (device loop7): journal params: device loop7, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 296.824977][T11780] REISERFS (device loop7): checking transaction log (loop7) [ 297.023975][T11780] REISERFS (device loop7): Using tea hash to sort names [ 297.032497][T11780] REISERFS (device loop7): Created .reiserfs_priv - reserved for xattr storage. [ 297.059794][ T12] team0 (unregistering): Port device team_slave_1 removed [ 297.066684][T11780] [ 297.069719][T11780] ====================================================== [ 297.076755][T11780] WARNING: possible circular locking dependency detected [ 297.083807][T11780] syzkaller #0 Not tainted [ 297.088292][T11780] ------------------------------------------------------ [ 297.095317][T11780] syz.7.1812/11780 is trying to acquire lock: [ 297.103589][T11780] ffff88805c5a3e90 (&type->i_mutex_dir_key#13/2){+.+.}-{3:3}, at: delete_one_xattr+0xfa/0x2d0 [ 297.113868][T11780] [ 297.113868][T11780] but task is already holding lock: [ 297.121221][T11780] ffff88805c5a37f0 (&type->i_mutex_dir_key#13/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x89a/0xa30 [ 297.132187][T11780] [ 297.132187][T11780] which lock already depends on the new lock. [ 297.132187][T11780] [ 297.142583][T11780] [ 297.142583][T11780] the existing dependency chain (in reverse order) is: [ 297.151587][T11780] [ 297.151587][T11780] -> #2 (&type->i_mutex_dir_key#13/3){+.+.}-{3:3}: [ 297.160372][T11780] down_write_nested+0x9e/0x200 [ 297.165753][T11780] open_xa_dir+0x146/0x6f0 [ 297.170687][T11780] xattr_lookup+0x22/0x2a0 [ 297.175626][T11780] reiserfs_xattr_get+0x114/0x5a0 [ 297.181173][T11780] __vfs_getxattr+0x406/0x440 [ 297.186369][T11780] cap_inode_need_killpriv+0x45/0x60 [ 297.192173][T11780] security_inode_need_killpriv+0x62/0x90 [ 297.198416][T11780] __file_remove_privs+0x23f/0x600 [ 297.204054][T11780] __generic_file_write_iter+0x7c/0x230 [ 297.210140][T11780] generic_file_write_iter+0xaf/0x2e0 [ 297.216045][T11780] do_iter_write+0x747/0xc50 [ 297.221161][T11780] do_writev+0x27f/0x480 [ 297.225928][T11780] do_syscall_64+0x55/0xb0 [ 297.230886][T11780] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.237335][T11780] [ 297.237335][T11780] -> #1 (&sb->s_type->i_mutex_key#29){+.+.}-{3:3}: [ 297.246034][T11780] down_write+0x97/0x200 [ 297.250801][T11780] vfs_rename+0x6f4/0xe60 [ 297.255649][T11780] do_renameat2+0x8b0/0xc80 [ 297.261033][T11780] __x64_sys_renameat2+0xd2/0xe0 [ 297.266510][T11780] do_syscall_64+0x55/0xb0 [ 297.271450][T11780] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.277865][T11780] [ 297.277865][T11780] -> #0 (&type->i_mutex_dir_key#13/2){+.+.}-{3:3}: [ 297.286583][T11780] __lock_acquire+0x37ef/0x7d80 [ 297.291967][T11780] lock_acquire+0x19e/0x420 [ 297.296991][T11780] down_write_nested+0x9e/0x200 [ 297.302356][T11780] delete_one_xattr+0xfa/0x2d0 [ 297.307637][T11780] reiserfs_for_each_xattr+0x8a6/0xa30 [ 297.313624][T11780] reiserfs_delete_xattrs+0x20/0x90 [ 297.319342][T11780] reiserfs_evict_inode+0x24a/0x4c0 [ 297.325089][T11780] evict+0x4b7/0x8a0 [ 297.329502][T11780] vfs_rmdir+0x378/0x4b0 [ 297.334269][T11780] do_rmdir+0x29f/0x590 [ 297.338938][T11780] __x64_sys_unlinkat+0xc4/0xe0 [ 297.344331][T11780] do_syscall_64+0x55/0xb0 [ 297.349268][T11780] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.355683][T11780] [ 297.355683][T11780] other info that might help us debug this: [ 297.355683][T11780] [ 297.365903][T11780] Chain exists of: [ 297.365903][T11780] &type->i_mutex_dir_key#13/2 --> &sb->s_type->i_mutex_key#29 --> &type->i_mutex_dir_key#13/3 [ 297.365903][T11780] [ 297.382181][T11780] Possible unsafe locking scenario: [ 297.382181][T11780] [ 297.389643][T11780] CPU0 CPU1 [ 297.395018][T11780] ---- ---- [ 297.400370][T11780] lock(&type->i_mutex_dir_key#13/3); [ 297.405836][T11780] lock(&sb->s_type->i_mutex_key#29); [ 297.413828][T11780] lock(&type->i_mutex_dir_key#13/3); [ 297.421813][T11780] lock(&type->i_mutex_dir_key#13/2); [ 297.427363][T11780] [ 297.427363][T11780] *** DEADLOCK *** [ 297.427363][T11780] [ 297.435499][T11780] 3 locks held by syz.7.1812/11780: [ 297.440685][T11780] #0: ffff88807ab76418 (sb_writers#23){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 297.449930][T11780] #1: ffff88805c5a0990 (&type->i_mutex_dir_key#13/1){+.+.}-{3:3}, at: do_rmdir+0x1c6/0x590 [ 297.460030][T11780] #2: ffff88805c5a37f0 (&type->i_mutex_dir_key#13/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x89a/0xa30 [ 297.471435][T11780] [ 297.471435][T11780] stack backtrace: [ 297.477311][T11780] CPU: 1 PID: 11780 Comm: syz.7.1812 Not tainted syzkaller #0 [ 297.484790][T11780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.494839][T11780] Call Trace: [ 297.498117][T11780] [ 297.501046][T11780] dump_stack_lvl+0x18c/0x250 [ 297.505733][T11780] ? load_image+0x420/0x420 [ 297.510239][T11780] ? show_regs_print_info+0x20/0x20 [ 297.515444][T11780] ? print_circular_bug+0x12b/0x1a0 [ 297.520650][T11780] check_noncircular+0x2fc/0x400 [ 297.525583][T11780] ? reiserfs_write_lock_nested+0x60/0xd0 [ 297.531334][T11780] ? look_up_lock_class+0x75/0x140 [ 297.536439][T11780] ? print_deadlock_bug+0x5d0/0x5d0 [ 297.541634][T11780] ? lockdep_lock+0xf5/0x230 [ 297.546226][T11780] ? _find_first_zero_bit+0xd6/0x100 [ 297.551514][T11780] __lock_acquire+0x37ef/0x7d80 [ 297.556374][T11780] ? verify_lock_unused+0x140/0x140 [ 297.561576][T11780] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 297.567208][T11780] ? verify_lock_unused+0x140/0x140 [ 297.572407][T11780] ? mutex_unlock+0x10/0x10 [ 297.576910][T11780] lock_acquire+0x19e/0x420 [ 297.581407][T11780] ? delete_one_xattr+0xfa/0x2d0 [ 297.586341][T11780] ? __might_sleep+0xe0/0xe0 [ 297.590930][T11780] ? read_lock_is_recursive+0x20/0x20 [ 297.596322][T11780] ? __might_sleep+0xe0/0xe0 [ 297.600911][T11780] ? read_lock_is_recursive+0x20/0x20 [ 297.606288][T11780] down_write_nested+0x9e/0x200 [ 297.611139][T11780] ? delete_one_xattr+0xfa/0x2d0 [ 297.616075][T11780] ? down_read_non_owner+0x310/0x310 [ 297.621362][T11780] ? down_write_nested+0x175/0x200 [ 297.626468][T11780] ? down_read_non_owner+0x310/0x310 [ 297.631751][T11780] delete_one_xattr+0xfa/0x2d0 [ 297.636513][T11780] reiserfs_for_each_xattr+0x8a6/0xa30 [ 297.641972][T11780] ? reiserfs_for_each_xattr+0xa30/0xa30 [ 297.647604][T11780] ? reiserfs_delete_xattrs+0x90/0x90 [ 297.652974][T11780] ? reiserfs_xattr_init+0x6a0/0x6a0 [ 297.658263][T11780] ? inode_wait_for_writeback+0x1e3/0x230 [ 297.663980][T11780] ? __rwlock_init+0x150/0x150 [ 297.668745][T11780] reiserfs_delete_xattrs+0x20/0x90 [ 297.673939][T11780] reiserfs_evict_inode+0x24a/0x4c0 [ 297.679137][T11780] ? evict+0x482/0x8a0 [ 297.683209][T11780] ? entry_points_to_object+0x260/0x260 [ 297.688756][T11780] ? do_raw_spin_lock+0x11f/0x2b0 [ 297.693788][T11780] ? do_raw_spin_unlock+0x121/0x230 [ 297.699001][T11780] ? entry_points_to_object+0x260/0x260 [ 297.704551][T11780] evict+0x4b7/0x8a0 [ 297.708446][T11780] ? __lock_acquire+0x7d80/0x7d80 [ 297.713469][T11780] ? proc_nr_inodes+0x230/0x230 [ 297.718317][T11780] ? do_raw_spin_unlock+0x121/0x230 [ 297.723538][T11780] ? _raw_spin_unlock+0x28/0x40 [ 297.728418][T11780] vfs_rmdir+0x378/0x4b0 [ 297.732676][T11780] do_rmdir+0x29f/0x590 [ 297.736839][T11780] ? __check_object_size+0x4fc/0xa40 [ 297.742130][T11780] ? d_delete_notify+0x150/0x150 [ 297.747064][T11780] ? getname_flags+0x20a/0x500 [ 297.751839][T11780] __x64_sys_unlinkat+0xc4/0xe0 [ 297.756702][T11780] do_syscall_64+0x55/0xb0 [ 297.761123][T11780] ? clear_bhb_loop+0x40/0x90 [ 297.765797][T11780] ? clear_bhb_loop+0x40/0x90 [ 297.770470][T11780] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.776360][T11780] RIP: 0033:0x7fe5c3d9e159 [ 297.780771][T11780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 297.800385][T11780] RSP: 002b:00007fe5c4c20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 297.809652][T11780] RAX: ffffffffffffffda RBX: 00007fe5c4025fa0 RCX: 00007fe5c3d9e159 [ 297.817634][T11780] RDX: 0000000000000200 RSI: 00002000000001c0 RDI: ffffffffffffff9c SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 297.825628][T11780] RBP: 00007fe5c3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 297.833599][T11780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 297.841569][T11780] R13: 00007fe5c4026038 R14: 00007fe5c4025fa0 R15: 00007ffdac105cb8 [ 297.849542][T11780] [ 297.852657][ C1] vkms_vblank_simulate: vblank timer overrun [ 297.977787][ T12] team0 (unregistering): Port device team_slave_0 removed [ 298.054224][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 298.172310][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 298.478122][ T5778] Bluetooth: hci1: command tx timeout [ 298.697574][ T12] bond0 (unregistering): Released all slaves [ 298.797227][T11761] netlink: 'syz.0.1803': attribute type 3 has an invalid length. [ 298.797754][T11758] netdevsim netdevsim6: Direct firmware load for .® failed with error -2 [ 298.806513][T11759] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 298.817881][T11758] netdevsim netdevsim6: Falling back to sysfs fallback for: .® [ 298.824822][ T28] kauditd_printk_skb: 10 callbacks suppressed [ 298.824838][ T28] audit: type=1800 audit(1790866575.423:75): pid=11759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1801" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 298.847955][T11759] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 298.876799][T11759] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 299.697166][ T12] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.793130][ T12] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.890391][ T12] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.953527][ T12] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.076223][ T12] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.134260][ T12] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.183419][ T12] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.254547][ T12] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.250624][ T12] hsr_slave_0: left promiscuous mode [ 301.256563][ T12] hsr_slave_1: left promiscuous mode [ 301.262841][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 301.272986][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 301.283621][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 301.291486][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 301.302603][ T12] bridge_slave_1: left allmulticast mode [ 301.315611][ T12] bridge_slave_1: left promiscuous mode [ 301.321663][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.332316][ T12] bridge_slave_0: left allmulticast mode [ 301.338217][ T12] bridge_slave_0: left promiscuous mode [ 301.343877][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.353674][ T12] hsr_slave_0: left promiscuous mode [ 301.359642][ T12] hsr_slave_1: left promiscuous mode [ 301.365728][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 301.376444][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 301.384580][ T12] bridge_slave_1: left allmulticast mode [ 301.390532][ T12] bridge_slave_1: left promiscuous mode [ 301.396344][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.406323][ T12] bridge_slave_0: left allmulticast mode [ 301.412208][ T12] bridge_slave_0: left promiscuous mode [ 301.419769][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.433544][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 301.443171][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 301.453765][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 301.461756][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 301.470071][ T12] bridge_slave_1: left allmulticast mode [ 301.475738][ T12] bridge_slave_1: left promiscuous mode [ 301.481534][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.489896][ T12] bridge_slave_0: left allmulticast mode [ 301.495670][ T12] bridge_slave_0: left promiscuous mode [ 301.501839][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.513362][ T12] veth1_macvtap: left promiscuous mode [ 301.519444][ T12] veth0_macvtap: left promiscuous mode [ 301.525084][ T12] veth1_vlan: left promiscuous mode [ 301.530380][ T12] veth0_vlan: left promiscuous mode [ 301.536175][ T12] team_slave_0: left promiscuous mode [ 301.541616][ T12] team_slave_1: left promiscuous mode [ 301.547263][ T12] veth1_macvtap: left promiscuous mode [ 301.553098][ T12] veth0_macvtap: left promiscuous mode [ 301.559476][ T12] veth1_vlan: left promiscuous mode [ 301.564735][ T12] veth0_vlan: left promiscuous mode [ 301.788951][ T12] team0 (unregistering): Port device team_slave_1 removed [ 301.826939][ T12] team0 (unregistering): Port device team_slave_0 removed [ 301.841368][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 301.854541][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 301.964563][ T12] bond0 (unregistering): Released all slaves [ 302.106396][ T12] team0 (unregistering): Port device team_slave_1 removed [ 302.144285][ T12] team0 (unregistering): Port device team_slave_0 removed [ 302.177225][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 302.215668][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 302.271183][ T12] bond0 (unregistering): Released all slaves [ 302.473349][ T12] team0 (unregistering): Port device team_slave_1 removed [ 302.514782][ T12] team0 (unregistering): Port device team_slave_0 removed [ 302.553566][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 302.599352][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 302.676158][ T12] bond0 (unregistering): Released all slaves [ 303.426869][ T12] IPVS: stop unused estimator thread 0... [ 303.495005][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.570677][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.634146][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.683400][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.402978][ T12] hsr_slave_0: left promiscuous mode [ 304.411911][ T12] hsr_slave_1: left promiscuous mode [ 304.428878][ T12] veth1_macvtap: left promiscuous mode [ 304.434512][ T12] veth0_macvtap: left promiscuous mode [ 304.440166][ T12] veth1_vlan: left promiscuous mode [ 304.445471][ T12] veth0_vlan: left promiscuous mode [ 304.990990][ T12] bond0 (unregistering): Released all slaves [ 305.449237][ T12] IPVS: stop unused estimator thread 0...